解決ExpressRoute下agentserviceapi.guestconfiguration.azure.com無法連線造成azcmagent連線失敗

前篇（07）（08）提到，不論在 Windows 或 Linux 之下，我們最終都會碰到 AZCM0026: Network Error 錯誤，從錯誤訊息及測試得知 agentserviceapi.guestconfiguration.azure.com 這個端點無法正常連線。

PS C:\> & "$env:ProgramW6432\AzureConnectedMachineAgent\azcmagent.exe" connect --service-principal-id "$ServicePrincipalId" --service-principal-secret "$ServicePrincipalClientSecret" --resource-group "$env:RESOURCE_GROUP" --tenant-id "$env:TENANT_ID" --location "$env:LOCATION" --subscription-id "$env:SUBSCRIPTION_ID" --cloud "$env:CLOUD" --correlation-id "$env:CORRELATION_ID";
INFO    Connecting machine to Azure... This might take a few minutes.
INFO    Testing connectivity to endpoints that are needed to connect to Azure... This might take a few minutes.
INFO    Exit Code:  AZCM0026: Network Error
INFO    For troubleshooting, see https://aka.ms/arc/azcmerror
FATAL   required endpoints unavailable: https://agentserviceapi.guestconfiguration.azure.com

PS C:\> azcmagent.exe check --location "eastasia"
INFO    Testing connectivity to endpoints that are needed to connect to Azure... This might take a few minutes.
ENDPOINT                                              |REACHABLE  |PRIVATE  |TLS      |PROXY
https://agentserviceapi.guestconfiguration.azure.com  |false      |false    |unknown  |not used
https://ea.his.arc.azure.com                          |true       |false    |TLS 1.3  |not used
https://eastasia-gas.guestconfiguration.azure.com     |true       |false    |TLS 1.3  |not used
https://gbl.his.arc.azure.com                         |true       |false    |TLS 1.3  |not used
https://login.microsoftonline.com                     |true       |false    |TLS 1.3  |not used
https://login.windows.net                             |true       |false    |TLS 1.3  |not used
https://management.azure.com                          |true       |false    |TLS 1.3  |not used
https://pas.windows.net                               |true       |false    |TLS 1.2  |not used

後續與微軟技術支援連線查詢問題時，大致確定方向是 ExpressRoute 的設定問題。在 Microsoft Peering 模式下，並沒有任何防火牆設定。技術支援原本是覺得 ExpressRoute 少了 Azure Arc 某組 IP Range 設定，請我們手動匯入設定。

結果是少了某組 IP 設定沒錯，但不能手動匯入。關鍵在同事做了 nslookup 動作：

PS C:\> nslookup agentserviceapi.guestconfiguration.azure.com

Non-authoritative answer:
Name:    kc-gas-cses-1d.koreacentral.cloudapp.azure.com
Address:  20.44.31.37
Aliases:  agentserviceapi.guestconfiguration.azure.com
          agentserviceapi.privatelink.guestconfiguration.azure.com
          agentserviceapi.trafficmanager.net

在 ExpressRoute 的 Microsoft Peering 有個 Route Filters 組態，負責開關 ExpressRoute 的流量能與那些資料中心流通。

簡單來說，有看到 nslookup 裡面 koreacentral 關鍵字嗎？也就是說，eastasia 區域的 agentserviceapi.guestconfiguration.azure.com 會導向 koreacentral 資料中心。因此，我們將 koreacentral 加入到 Route Filters 的允許清單中之後，重新做連線測試：

PS C:\> azcmagent.exe check --location "eastasia"
INFO    Testing connectivity to endpoints that are needed to connect to Azure... This might take a few minutes.
ENDPOINT                                              |REACHABLE  |PRIVATE  |TLS      |PROXY
https://agentserviceapi.guestconfiguration.azure.com  |true       |false    |TLS 1.2  |not used
https://ea.his.arc.azure.com                          |true       |false    |TLS 1.3  |not used
https://eastasia-gas.guestconfiguration.azure.com     |true       |false    |TLS 1.3  |not used
https://gbl.his.arc.azure.com                         |true       |false    |TLS 1.3  |not used
https://login.microsoftonline.com                     |true       |false    |TLS 1.3  |not used
https://login.windows.net                             |true       |false    |TLS 1.3  |not used
https://management.azure.com                          |true       |false    |TLS 1.3  |not used
https://pas.windows.net                               |true       |false    |TLS 1.2  |not used

這樣就打通最後一關，Windows VM 與 Linux VM 們就能正常加入到 Azure Arc 清單中了。

KingKong Bruce記事

網頁

解決ExpressRoute下agentserviceapi.guestconfiguration.azure.com無法連線造成azcmagent連線失敗

解決ExpressRoute下agentserviceapi.guestconfiguration.azure.com無法連線造成azcmagent連線失敗

沒有留言:

張貼留言