将防火墙后的工作区用于 Azure 机器学习Use workspace behind a Firewall for Azure Machine Learning

本文介绍如何配置 Azure 防火墙以控制对 Azure 机器学习工作区和公共 Internet 的访问。In this article, learn how to configure Azure Firewall to control access to your Azure Machine Learning workspace and the public internet. 若要详细了解如何保护 Azure 机器学习,请参阅 Azure 机器学习的企业安全性To learn more about securing Azure Machine Learning, see Enterprise security for Azure Machine Learning

警告

只有在代码优先体验中才支持访问防火墙后面的数据存储。Access to data storage behind a firewall is only supported in code first experiences. 不支持使用 Azure 机器学习工作室访问防火墙后的数据。Using the Azure Machine Learning studio to access data behind a firewall is not supported. 若要使用工作室处理专用网络上的数据存储,必须首先设置虚拟网络,然后授予工作室访问存储在虚拟网络内部的数据的权限To work with data storage on a private network with the studio, you must first set up a virtual network and give the studio access to data stored inside of a virtual network.

Azure 防火墙Azure Firewall

使用 Azure 防火墙时,请使用目标网络地址转换 (DNAT) 为入站流量创建 NAT 规则。When using Azure Firewall, use destination network address translation (DNAT) to create NAT rules for inbound traffic. 对于出站流量,请创建“网络”和/或“应用程序”规则 。For outbound traffic, create network and/or application rules. 一些 Azure 防火墙概念中更详细地介绍了这些规则集合。These rule collections are described in more detail in What are some Azure Firewall concepts.

入站配置Inbound configuration

如果使用“计算实例”或“计算群集”Azure 机器学习,请为包含 Azure 机器学习资源的子网添加用户定义的路由 (UDR)If you use an Azure Machine Learning compute instance or compute cluster, add a user-defined routes (UDRs) for the subnet that contains the Azure Machine Learning resources. 此路由将流量从 BatchNodeManagementAzureMachineLearning 资源的 IP 地址强制发送到计算实例和计算群集的公共 IP。This route forces traffic from the IP addresses of the BatchNodeManagement and AzureMachineLearning resources to the public IP of your compute instance and compute cluster.

借助这些 UDR,Batch 服务可以与计算节点进行通信,以便进行任务计划编制。These UDRs enable the Batch service to communicate with compute nodes for task scheduling. 还要添加 Azure 机器学习服务的 IP 地址,因为这是访问计算实例所必需的。Also add the IP address for the Azure Machine Learning service, as this is required for access to Compute Instances. 添加 Azure 机器学习服务的 IP 时,必须同时添加主要和次要 Azure 区域的 IP。When adding the IP for the Azure Machine Learning service, you must add the IP for both the primary and secondary Azure regions. 主要区域是工作区所在的区域。The primary region being the one where your workspace is located.

若要查找次要区域,请参阅使用 Azure 配对区域确保业务连续性和灾难恢复To find the secondary region, see the Ensure business continuity & disaster recovery using Azure Paired Regions.

若要获取 Batch 服务和 Azure 机器学习服务的 IP 地址列表,请使用以下方法之一:To get a list of IP addresses of the Batch service and Azure Machine Learning service, use one of the following methods:

  • 下载 Azure IP 范围和服务标记,并在文件中搜索 BatchNodeManagement.<region>AzureMachineLearning.<region>(其中 <region> 是你的 Azure 区域)。Download the Azure IP Ranges and Service Tags and search the file for BatchNodeManagement.<region> and AzureMachineLearning.<region>, where <region> is your Azure region.

  • 使用 Azure CLI 下载信息。Use the Azure CLI to download the information. 以下示例下载 IP 地址信息,并筛选出“中国东部”区域的信息:The following example downloads the IP address information and filters out the information for the China East region:

    az network list-service-tags -l "China East" --query "values[?starts_with(id, 'Batch')] | [?properties.region=='chinaeast']"
    # Get primary region IPs
    az network list-service-tags -l "China East" --query "values[?starts_with(id, 'AzureMachineLearning')] | [?properties.region=='chinaeast']"
    # Get secondary region IPs
    az network list-service-tags -l "China North" --query "values[?starts_with(id, 'AzureMachineLearning')] | [?properties.region=='chinanorth']"
    

    提示

    使用以下链接下载 IP 地址列表:Use the following link to download a list of IP addresses:

添加 UDR 时,请为每个相关的 Batch IP 地址前缀定义路由,并将“下一跃点类型”设置为“Internet”。 When you add the UDRs, define the route for each related Batch IP address prefix and set Next hop type to Internet. 下图显示了 Azure 门户中此 UDR 的示例:The following image shows an example of this UDR in the Azure portal:

地址前缀的 UDR 示例

重要

IP 地址可能会随时间推移而改变。The IP addresses may change over time.

有关详细信息,请参阅在虚拟网络中创建 Azure Batch 池For more information, see Create an Azure Batch pool in a virtual network.

出站配置Outbound configuration

  1. 添加网络规则,允许来自以下服务标记中的流量流向 和 : Add Network rules, allowing traffic to and from the following service tags:

    • AzureActiveDirectoryAzureActiveDirectory
    • AzureMachineLearningAzureMachineLearning
    • AzureResourceManagerAzureResourceManager
    • Storage.regionStorage.region
    • KeyVault.regionKeyVault.region
    • ContainerRegistry.regionContainerRegistry.region

    如果计划使用 Microsoft 提供的默认 Docker 映像并启用用户管理的依赖项,则还必须添加以下服务标记:If you plan on using the default Docker images provided by Microsoft, and enabling user-managed dependencies, you must also add the following service tags:

    • MicrosoftContainerRegistry.regionMicrosoftContainerRegistry.region
    • AzureFrontDoor.FirstPartyAzureFrontDoor.FirstParty

    对于包含 region 的条目,请替换为所使用的 Azure 区域。For entries that contain region, replace with the Azure region that you are using.

    对于“协议”,请选择“TCP”。For the protocol, select TCP. 对于源和目标的“端口”,请选择“*”。For the source and destination ports, select *.

  2. 为以下主机添加应用程序规则:Add Application rules for the following hosts:

    备注

    这不是 Internet 上所有 Python 资源所需的完整主机列表,这只是最常使用的主机列表。This is not a complete list of the hosts required for all Python resources on the internet, only the most commonly used. 例如,如果需要访问 GitHub 存储库或其他主机,则必须标识并添加该方案所需的主机。For example, if you need access to a GitHub repository or other host, you must identify and add the required hosts for that scenario.

    主机名Host name 用途Purpose
    graph.windows.netgraph.windows.net 由 Azure 机器学习计算实例/群集使用。Used by Azure Machine Learning compute instance/cluster.
    anaconda.comanaconda.com
    *.anaconda.com*.anaconda.com
    用于安装默认包。Used to install default packages.
    *.anaconda.org*.anaconda.org 用于获取存储库数据。Used to get repo data.
    pypi.orgpypi.org 用于列出默认索引的依赖项(如果有),索引不会被用户设置覆盖。Used to list dependencies from the default index, if any, and the index is not overwritten by user settings. 如果索引被覆盖,则还必须允许“*.pythonhosted.org”。If the index is overwritten, you must also allow *.pythonhosted.org.
    cloud.r-project.orgcloud.r-project.org 在安装用于 R 开发的 CRAN 包时使用。Used when installing CRAN packages for R development.
    *pytorch.org*pytorch.org 由基于 PyTorch 的一些示例使用。Used by some examples based on PyTorch.
    *.tensorflow.org*.tensorflow.org 由基于 Tensorflow 的一些示例使用。Used by some examples based on Tensorflow.

    对于“协议:端口”,请选择“http, https” 。For Protocol:Port, select use http, https.

    有关配置应用程序规则的详细信息,请参阅部署和配置 Azure 防火墙For more information on configuring application rules, see Deploy and configure Azure Firewall.

  3. 若要限制对部署到 Azure Kubernetes Service (AKS) 的模型的访问,请参阅限制 Azure Kubernetes Service 中的出口流量To restrict access to models deployed to Azure Kubernetes Service (AKS), see Restrict egress traffic in Azure Kubernetes Service.

其他防火墙Other firewalls

本部分中的指南是通用的,因为每个防火墙都有自己的术语和特定配置。The guidance in this section is generic, as each firewall has its own terminology and specific configurations. 如果你对如何允许通过防火墙进行通信有疑问,请查阅你正在使用的防火墙的相关文档。If you have questions about how to allow communication through your firewall, please consult the documentation for the firewall you are using.

如果未正确配置,则防火墙可能会在使用工作区时导致问题。If not configured correctly, the firewall can cause problems using your workspace. Azure 机器学习工作区使用各种主机名。There are a variety of host names that are used both by the Azure Machine Learning workspace. 以下部分列出了 Azure 机器学习所需的主机。The following sections list hosts that are required for Azure Machine Learning.

Microsoft 主机Microsoft hosts

本部分中的主机归 Microsoft 所有,它们提供工作区正常工作所需的服务。The hosts in this section are owned by Microsoft, and provide services required for the proper functioning of your workspace. 下表列出了 Azure 公共、Azure 政府和 Azure 中国世纪互联区域的主机名。The following tables list the host names for the Azure public, Azure Government, and Azure China 21Vianet regions.

通用 Azure 主机General Azure hosts

要求Required for Azure 公共Azure public Azure GovernmentAzure Government Azure 中国世纪互联Azure China 21Vianet
Azure Active DirectoryAzure Active Directory login.microsoftonline.comlogin.microsoftonline.com login.microsoftonline.uslogin.microsoftonline.us login.chinacloudapi.cnlogin.chinacloudapi.cn
Azure 门户Azure portal management.azure.commanagement.azure.com management.azure.usmanagement.azure.us management.azure.cnmanagement.azure.cn
Azure 资源管理器Azure Resource Manager management.azure.commanagement.azure.com management.usgovcloudapi.netmanagement.usgovcloudapi.net management.chinacloudapi.cnmanagement.chinacloudapi.cn

Azure 机器学习主机Azure Machine Learning hosts

要求Required for Azure 公共Azure public Azure GovernmentAzure Government Azure 中国世纪互联Azure China 21Vianet
Azure 机器学习工作室Azure Machine Learning studio studio.ml.azure.cnstudio.ml.azure.cn ml.azure.usml.azure.us studio.ml.azure.cnstudio.ml.azure.cn
APIAPI *.azureml.ms*.azureml.ms *.ml.azure.us*.ml.azure.us *.ml.azure.cn*.ml.azure.cn
试验、历史记录、Hyperdrive、标记Experimentation, History, Hyperdrive, labeling *.experiments.azureml.net*.experiments.azureml.net *.ml.azure.us*.ml.azure.us *.ml.azure.cn*.ml.azure.cn
模型管理Model management *.modelmanagement.azureml.net*.modelmanagement.azureml.net *.ml.azure.us*.ml.azure.us *.ml.azure.cn*.ml.azure.cn
管道Pipeline *.aether.ms*.aether.ms *.ml.azure.us*.ml.azure.us *.ml.azure.cn*.ml.azure.cn
设计器(工作室服务)Designer (studio service) *.studioservice.azureml.com*.studioservice.azureml.com *.ml.azure.us*.ml.azure.us *.ml.azure.cn*.ml.azure.cn
集成笔记本Integrated notebook *.notebooks.azure.net*.notebooks.azure.net *.notebooks.usgovcloudapi.net*.notebooks.usgovcloudapi.net *.notebooks.chinacloudapi.cn*.notebooks.chinacloudapi.cn
集成笔记本Integrated notebook *.file.core.windows.net*.file.core.windows.net *.file.core.usgovcloudapi.net*.file.core.usgovcloudapi.net *.file.core.chinacloudapi.cn*.file.core.chinacloudapi.cn
集成笔记本Integrated notebook *.dfs.core.windows.net*.dfs.core.windows.net *.dfs.core.usgovcloudapi.net*.dfs.core.usgovcloudapi.net *.dfs.core.chinacloudapi.cn*.dfs.core.chinacloudapi.cn
集成笔记本Integrated notebook *.blob.core.windows.net*.blob.core.windows.net *.blob.core.usgovcloudapi.net*.blob.core.usgovcloudapi.net *.blob.core.chinacloudapi.cn*.blob.core.chinacloudapi.cn
集成笔记本Integrated notebook graph.microsoft.comgraph.microsoft.com graph.microsoft.usgraph.microsoft.us graph.chinacloudapi.cngraph.chinacloudapi.cn
集成笔记本Integrated notebook *.aznbcontent.net*.aznbcontent.net

Azure 机器学习计算实例和计算群集主机Azure Machine Learning compute instance and compute cluster hosts

要求Required for Azure 公共Azure public Azure GovernmentAzure Government Azure 中国世纪互联Azure China 21Vianet
计算群集/实例Compute cluster/instance *.batchai.core.windows.net*.batchai.core.windows.net *.batchai.core.usgovcloudapi.net*.batchai.core.usgovcloudapi.net *.batchai.ml.azure.cn*.batchai.ml.azure.cn
计算群集/实例Compute cluster/instance graph.windows.netgraph.windows.net graph.windows.netgraph.windows.net graph.chinacloudapi.cngraph.chinacloudapi.cn
计算实例Compute instance *.instances.azureml.net*.instances.azureml.net *.instances.azureml.us*.instances.azureml.us *.instances.azureml.cn*.instances.azureml.cn
计算实例Compute instance *.instances.azureml.ms*.instances.azureml.ms

Azure 机器学习使用的关联资源Associated resources used by Azure Machine Learning

要求Required for Azure 公共Azure public Azure GovernmentAzure Government Azure 中国世纪互联Azure China 21Vianet
Azure 存储帐户Azure Storage Account core.windows.netcore.windows.net core.usgovcloudapi.netcore.usgovcloudapi.net core.chinacloudapi.cncore.chinacloudapi.cn
Azure Key VaultAzure Key Vault vault.azure.cnvault.azure.cn vault.usgovcloudapi.netvault.usgovcloudapi.net vault.azure.cnvault.azure.cn
Azure 容器注册表Azure Container Registry azurecr.ioazurecr.io azurecr.usazurecr.us azurecr.cnazurecr.cn
Microsoft 容器注册表Microsoft Container Registry mcr.microsoft.commcr.microsoft.com mcr.microsoft.commcr.microsoft.com mcr.microsoft.commcr.microsoft.com

提示

如果计划使用联合标识,请按照保护 Active Directory 联合身份验证服务的最佳做法一文的说明进行操作。If you plan on using federated identity, follow the Best practices for securing Active Directory Federation Services article.

另外,请使用强制隧道中的信息添加 BatchNodeManagementAzureMachineLearning 的 IP 地址。Also, use the information in forced tunneling to add IP addresses for BatchNodeManagement and AzureMachineLearning.

如需了解限制对部署到 Azure Kubernetes Service (AKS) 的模型的访问,请参阅限制 Azure Kubernetes Service 中的出口流量For information on restricting access to models deployed to Azure Kubernetes Service (AKS), see Restrict egress traffic in Azure Kubernetes Service.

Python 主机Python hosts

本部分中的主机用于安装 Python 包。The hosts in this section are used to install Python packages. 开发、训练和部署过程中需要使用它们。They are required during development, training, and deployment.

备注

这不是 Internet 上所有 Python 资源所需的完整主机列表,这只是最常使用的主机列表。This is not a complete list of the hosts required for all Python resources on the internet, only the most commonly used. 例如,如果需要访问 GitHub 存储库或其他主机,则必须标识并添加该方案所需的主机。For example, if you need access to a GitHub repository or other host, you must identify and add the required hosts for that scenario.

主机名Host name 用途Purpose
anaconda.comanaconda.com
*.anaconda.com*.anaconda.com
用于安装默认包。Used to install default packages.
*.anaconda.org*.anaconda.org 用于获取存储库数据。Used to get repo data.
pypi.orgpypi.org 用于列出默认索引的依赖项(如果有),索引不会被用户设置覆盖。Used to list dependencies from the default index, if any, and the index is not overwritten by user settings. 如果索引被覆盖,则还必须允许“*.pythonhosted.org”。If the index is overwritten, you must also allow *.pythonhosted.org.
*pytorch.org*pytorch.org 由基于 PyTorch 的一些示例使用。Used by some examples based on PyTorch.
*.tensorflow.org*.tensorflow.org 由基于 Tensorflow 的一些示例使用。Used by some examples based on Tensorflow.

R 主机R hosts

本部分中的主机用于安装 R 包。The hosts in this section are used to install R packages. 开发、训练和部署过程中需要使用它们。They are required during development, training, and deployment.

备注

这不是 Internet 上所有 R 资源所需的完整主机列表,这只是最常使用的主机列表。This is not a complete list of the hosts required for all R resources on the internet, only the most commonly used. 例如,如果需要访问 GitHub 存储库或其他主机,则必须标识并添加该方案所需的主机。For example, if you need access to a GitHub repository or other host, you must identify and add the required hosts for that scenario.

主机名Host name 用途Purpose
cloud.r-project.orgcloud.r-project.org 在安装 CRAN 包时使用。Used when installing CRAN packages.

重要

在内部,Azure 机器学习的 R SDK 使用 Python 包。Internally, the R SDK for Azure Machine Learning uses Python packages. 因此,还必须允许 Python 主机通过防火墙。So you must also allow Python hosts through the firewall.

后续步骤Next steps