将防火墙后的工作区用于 Azure 机器学习Use workspace behind a Firewall for Azure Machine Learning

本文介绍如何配置 Azure 防火墙以控制对 Azure 机器学习工作区和公共 Internet 的访问。In this article, learn how to configure Azure Firewall to control access to your Azure Machine Learning workspace and the public internet. 若要详细了解如何保护 Azure 机器学习,请参阅 Azure 机器学习的企业安全性To learn more about securing Azure Machine Learning, see Enterprise security for Azure Machine Learning

虽然本文档中的信息基于使用 Azure 防火墙,但你应该能够将其与其他防火墙产品一起使用。While the information in this document is based on using Azure Firewall, you should be able to use it with other firewall products. 如果你对如何允许通过防火墙进行通信有疑问,请查阅你正在使用的防火墙的相关文档。If you have questions about how to allow communication through your firewall, please consult the documentation for the firewall you are using.

应用程序规则Application rules

在防火墙上创建应用程序规则,允许流量流入和流出本文中的地址。On your firewall, create an application rule allowing traffic to and from the addresses in this article.

提示

添加网络规则时,请将“协议”设置为“任何”,并将端口设置为 *When adding the network rule, set the Protocol to any, and the ports to *.

有关配置 Azure 防火墙的详细信息,请参阅部署和配置 Azure 防火墙For more information on configuring Azure Firewall, see Deploy and configure Azure Firewall.

Microsoft 主机Microsoft hosts

如果未正确配置,则防火墙可能会在使用工作区时导致问题。If not configured correctly, the firewall can cause problems using your workspace. Azure 机器学习工作区使用各种主机名。There are a variety of host names that are used both by the Azure Machine Learning workspace.

本部分中的主机归 Microsoft 所有,它们提供工作区正常工作所需的服务。The hosts in this section are owned by Microsoft, and provide services required for the proper functioning of your workspace.

主机名Host name 用途Purpose
login.microsoftonline.comlogin.microsoftonline.com 身份验证Authentication
management.azure.commanagement.azure.com 用于获取工作区信息Used to get the workspace information
*.batchai.core.windows.net*.batchai.core.windows.net 训练群集Training clusters
studio.ml.azure.cnstudio.ml.azure.cn Azure 机器学习工作室Azure Machine Learning studio
default.exp-tas.comdefault.exp-tas.com 由 Azure 机器学习工作室使用Used by the Azure Machine Learning studio
*.azureml.ms*.azureml.ms 由 Azure 机器学习 API 使用Used by Azure Machine Learning APIs
*.experiments.ml.azure.cn*.experiments.ml.azure.cn 由 Azure 机器学习中运行的试验使用Used by experiments running in Azure Machine Learning
*.modelmanagement.azureml.net*.modelmanagement.azureml.net 用于注册和部署模型Used to register and deploy models
mlworkspace.azure.aimlworkspace.azure.ai 由 Azure 门户在查看工作区时使用Used by the Azure portal when viewing a workspace
*.aether.ms*.aether.ms 在运行 Azure 机器学习管道时使用Used when running Azure Machine Learning pipelines
*.instances.azureml.net*.instances.azureml.net Azure 机器学习计算实例Azure Machine Learning compute instances
*.instances.azureml.ms*.instances.azureml.ms 当工作区启用了专用链接时的 Azure 机器学习计算实例Azure Machine Learning compute instances when workspace has Private Link enabled
windows.netwindows.net Azure Blob 存储Azure Blob Storage
vault.azure.netvault.azure.net Azure Key VaultAzure Key Vault
azurecr.ioazurecr.io Azure 容器注册表Azure Container Registry
mcr.microsoft.commcr.microsoft.com 用于 docker 基础映像的 Microsoft 容器注册表Microsoft Container Registry for base docker images
your-acr-server-name.azurecr.ioyour-acr-server-name.azurecr.io 仅当 Azure 容器注册表位于虚拟网络后面时才需要。Only needed if your Azure Container Registry is behind the virtual network. 通过此配置,将创建从 Microsoft 环境到订阅中的 ACR 实例的专用链接。In this configuration, a private link is created from the Microsoft environment to the ACR instance in your subscription. 将 ACR 服务器名称用于 Azure 机器学习工作区。Use the ACR server name for your Azure Machine Learning workspace.
*.notebooks.azure.net*.notebooks.azure.net Azure 机器学习工作室中的笔记本需要。Needed by the notebooks in Azure Machine Learning studio.
graph.windows.netgraph.windows.net 笔记本所需Needed for notebooks

提示

如果计划使用联合标识,请按照保护 Active Directory 联合身份验证服务的最佳做法一文的说明进行操作。If you plan on using federated identity, follow the Best practices for securing Active Directory Federation Services article.

Python 主机Python hosts

本部分中的主机用于安装 Python 包。The hosts in this section are used to install Python packages. 开发、训练和部署过程中需要使用它们。They are required during development, training, and deployment.

主机名Host name 用途Purpose
anaconda.comanaconda.com
*.anaconda.com*.anaconda.com
用于安装默认包。Used to install default packages.
*.anaconda.org*.anaconda.org 用于获取存储库数据。Used to get repo data.
pypi.orgpypi.org 用于列出默认索引的依赖项(如果有),索引不会被用户设置覆盖。Used to list dependencies from the default index, if any, and the index is not overwritten by user settings. 如果索引被覆盖,则还必须允许“*.pythonhosted.org”。If the index is overwritten, you must also allow *.pythonhosted.org .

R 主机R hosts

本部分中的主机用于安装 R 包。The hosts in this section are used to install R packages. 开发、训练和部署过程中需要使用它们。They are required during development, training, and deployment.

重要

在内部,Azure 机器学习的 R SDK 使用 Python 包。Internally, the R SDK for Azure Machine Learning uses Python packages. 因此,还必须允许 Python 主机通过防火墙。So you must also allow Python hosts through the firewall.

主机名Host name 用途Purpose
cloud.r-project.orgcloud.r-project.org 在安装 CRAN 包时使用。Used when installing CRAN packages.

后续步骤Next steps