View the topology of an Azure virtual network

• An Azure account with an active subscription and the necessary permissions. Create a trial subscription.

• An Azure Virtual network with some resources connected to it. For more information, see Create a virtual network using the Azure portal.

• Network Watcher enabled in the virtual network region. For more information, see Enable Network Watcher for your region.

• Sign in to the Azure portal with your Azure account.

• An Azure account with an active subscription and the necessary permissions. create a trial subscription.

• An Azure Virtual network with some resources connected to it. For more information, see Create a virtual network using the Azure portal.

• Network Watcher enabled in the virtual network region. For more information, see Enable Network Watcher for your region.

• Azure PowerShell.

  The steps in this article run the Azure PowerShell cmdlets in local computer.

  You can install Azure PowerShell locally to run the cmdlets. If you run PowerShell locally, sign in to Azure using the Connect-AzAccount -Environment AzureChinaCloud cmdlet.

• An Azure account with an active subscription and the necessary permissions. create a trial subscription.

• An Azure Virtual network with some resources connected to it. For more information, see Create a virtual network using the Azure portal.

• Network Watcher enabled in the virtual network region. For more information, see Enable Network Watcher for your region.

• Azure CLI.

  The steps in this article run the Azure CLI commands in your local computer.

  You can install Azure CLI locally to run the commands. If you run Azure CLI locally, sign in to Azure using the az login command.

1. In the search box at the top of the portal, enter network watcher. Select Network Watcher from the search results.

   

2. Under Monitoring, select Topology.

3. Select the subscription and resource group of the virtual network that you want to view its topology, and then select the virtual network.

   

   The virtual network in this example has two subnets: mySubnet and GatewaySubnet. mySubnet has three virtual machines (VMs), two of them are in the backend pool of myLoadBalancer public load balancer. There are two network security groups: mySubnet-nsg is associated to mySubnet subnet and myVM-nsg is associated to myVM virtual machine. GatewaySubnet has VNetGW virtual network gateway (VPN gateway).

   Topology information is only shown for resources that are:

   • in the same resource group and region as the myVNet virtual network. For example, a network security group that exists in a resource group other than myResourceGroup, isn't shown, even if the network security group is associated to a subnet in the myVNet virtual network.
   • in the myVNet virtual network, or associated to resources in it. For example, a network security group that isn't associated to a subnet or network interface in the myVNet virtual network isn't shown, even if the network security group is in the myResourceGroup resource group.

4. Select Download topology to download the diagram as an editable image file in svg format.

Retrieve the topology of a resource group using Get-AzNetworkWatcherTopology. The following example retrieves the network topology of a virtual network in China East region listing the resources that are in the myResourceGroup resource group:

# Get a network level view of resources and their relationships in "myResourceGroup" resource group.
Get-AzNetworkWatcherTopology -Location 'chinaeast' -TargetResourceGroupName 'myResourceGroup'

Topology information is only returned for resources that are in the same resource group and region as the myVNet virtual network. For example, a network security group that exists in a resource group other than myResourceGroup, isn't listed, even if the network security group is associated to a subnet in the myVNet virtual network.

Learn more about the relationships and properties in the returned output.

Retrieve the topology of a resource group using az network watcher show-topology. The following example retrieves the network topology for myResourceGroup resource group:

# Get a network level view of resources and their relationships in "myResourceGroup" resource group.
az network watcher show-topology --resource-group 'myResourceGroup'

Topology information is only returned for resources that are in the same resource group and region as the myVNet virtual network. For example, a network security group that exists in a resource group other than myResourceGroup, isn't listed, even if the network security group is associated to a subnet in the myVNet virtual network.

Learn more about the relationships and properties in the returned output.