诊断虚拟机网络路由问题 - Azure CLIDiagnose a virtual machine network routing problem - Azure CLI

本文首先部署虚拟机 (VM),然后检查其与 IP 地址和 URL 的通信。In this article, you deploy a virtual machine (VM), and then check communications to an IP address and URL. 确定通信失败的原因以及解决方法。You determine the cause of a communication failure and how you can resolve it.

如果没有 Azure 试用版订阅,请在开始前创建一个试用版订阅If you don't have an Azure trail subscription, create a trial subscription before you begin.

先决条件Prerequisites

  • 如果需要,请安装 Azure CLI 来运行 CLI 参考命令。If you prefer, install the Azure CLI to run CLI reference commands.
    • 如果使用的是本地安装,请通过 Azure CLI 使用 az login 命令登录。If you're using a local install, sign in with Azure CLI by using the az login command. 若要完成身份验证过程,请遵循终端中显示的步骤。To finish the authentication process, follow the steps displayed in your terminal. 有关其他登录选项,请参阅使用 Azure CLI 登录See Sign in with Azure CLI for additional sign-in options.
    • 出现提示时,请在首次使用时安装 Azure CLI 扩展。When you're prompted, install Azure CLI extensions on first use. 有关扩展详细信息,请参阅使用 Azure CLI 的扩展For more information about extensions, see Use extensions with Azure CLI.
    • 运行 az version 以查找安装的版本和依赖库。Run az version to find the version and dependent libraries that are installed. 若要升级到最新版本,请运行 az upgradeTo upgrade to the latest version, run az upgrade.
  • 本文需要 Azure CLI 版本 2.0 或更高版本。This article requires version 2.0 or later of the Azure CLI.

  • 本文中的 Azure CLI 命令已格式化,适合在 Bash Shell 中运行。The Azure CLI commands in this article are formatted to run in a Bash shell.

备注

请先运行 az cloud set -n AzureChinaCloud 更改云环境,然后才能在 Azure 中国中使用 Azure CLI。Before you can use Azure CLI in Azure China , please run az cloud set -n AzureChinaCloud first to change the cloud environment. 若要切换回 Azure 公有云,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Azure Public Cloud, run az cloud set -n AzureCloud again.

创建 VMCreate a VM

在创建 VM 之前,必须创建该 VM 所属的资源组。Before you can create a VM, you must create a resource group to contain the VM. 使用 az group create 创建资源组。Create a resource group with az group create. 以下示例在“chinaeast” 位置创建名为“myResourceGroup” 的资源组:The following example creates a resource group named myResourceGroup in the chinaeast location:

az group create --name myResourceGroup --location chinaeast

使用 az vm create 创建 VM。Create a VM with az vm create. 如果默认密钥位置中尚不存在 SSH 密钥,该命令会创建它们。If SSH keys do not already exist in a default key location, the command creates them. 若要使用特定的一组密钥,请使用 --ssh-key-value 选项。To use a specific set of keys, use the --ssh-key-value option. 以下示例创建名为 myVm 的 VM :The following example creates a VM named myVm:

az vm create \
  --resource-group myResourceGroup \
  --name myVm \
  --image UbuntuLTS \
  --generate-ssh-keys

创建 VM 需要几分钟时间。The VM takes a few minutes to create. 在创建好 VM 且 Azure CLI 返回输出之前,请勿继续执行剩余的步骤。Don't continue with remaining steps until the VM is created and the Azure CLI returns output.

测试网络通信Test network communication

若要通过网络观察程序测试网络通信,必须先在要测试的 VM 所在区域中启用网络观察程序,然后使用网络观察程序的“下一个跃点”功能来测试通信。To test network communication with Network Watcher, you must first enable a network watcher in the region the VM that you want to test is in, and then use Network Watcher's next hop capability to test communication.

启用网络观察程序Enable network watcher

如果已在“中国东部”区域启用网络观察程序,请跳到使用下一跃点If you already have a network watcher enabled in the China East region, skip to Use next hop. 使用 az network watcher configure 命令在“中国东部”区域中创建网络观察程序:Use the az network watcher configure command to create a network watcher in the China East region:

az network watcher configure \
  --resource-group NetworkWatcherRG \
  --locations chinaeast \
  --enabled

使用下一个跃点Use next hop

Azure 自动创建到默认目标的路由。Azure automatically creates routes to default destinations. 可以创建自定义路由来覆盖默认路由。You may create custom routes that override the default routes. 有时,自定义路由可能会导致通信故障。Sometimes, custom routes can cause communication to fail. 要测试来自 VM 的路由,请使用 az network watcher show-next-hop 确定流量发送到特定地址时的下一个路由跃点。To test routing from a VM, use az network watcher show-next-hop to determine the next routing hop when traffic is destined for a specific address.

测试从 VM 发往 www.bing.com 的某个 IP 地址的出站通信:Test outbound communication from the VM to one of the IP addresses for www.bing.com:

az network watcher show-next-hop \
  --dest-ip 13.107.21.200 \
  --resource-group myResourceGroup \
  --source-ip 10.0.0.4 \
  --vm myVm \
  --nic myVmVMNic \
  --out table

数秒钟后,输出结果指示 nextHopType 为“Internet”,routeTableId 为“系统路由” 。After a few seconds, the output informs you that the nextHopType is Internet, and that the routeTableId is System Route. 此结果指示存在通往目标的有效路由。This result lets you know that there is a valid route to the destination.

测试从 VM 发往 172.31.0.100 的出站通信:Test outbound communication from the VM to 172.31.0.100:

az network watcher show-next-hop \
  --dest-ip 172.31.0.100 \
  --resource-group myResourceGroup \
  --source-ip 10.0.0.4 \
  --vm myVm \
  --nic myVmVMNic \
  --out table

输出结果指示“nextHopType”为“无”,“routeTableId”仍为“系统路由” 。The output returned informs you that None is the nextHopType, and that the routeTableId is also System Route. 此结果指示,虽然存在有效的通往目标的系统路由,但是没有将流量路由到目标的下一跃点。This result lets you know that, while there is a valid system route to the destination, there is no next hop to route the traffic to the destination.

查看路由详细信息View details of a route

若要进一步分析路由情况,请使用 az network nic show-effective-route-table 命令查看网络接口的有效路由:To analyze routing further, review the effective routes for the network interface with the az network nic show-effective-route-table command:

az network nic show-effective-route-table \
  --resource-group myResourceGroup \
  --name myVmVMNic

返回的输出中包含以下文本:The following text is included in the returned output:

{
  "additionalProperties": {
    "disableBgpRoutePropagation": false
  },
  "addressPrefix": [
    "0.0.0.0/0"
  ],
  "name": null,
  "nextHopIpAddress": [],
  "nextHopType": "Internet",
  "source": "Default",
  "state": "Active"
},

使用 az network watcher show-next-hop 命令测试在使用下一跃点中发送到的 13.107.21.200 的出站通信时,地址前缀为 0.0.0.0/0** 的路由用于将流量路由到该地址,因为该输出中没有其他路由包含该地址 。When you used the az network watcher show-next-hop command to test outbound communication to 13.107.21.200 in Use next hop, the route with the addressPrefix 0.0.0.0/0** was used to route traffic to the address, since no other route in the output includes the address. 默认情况下,未在另一路由的地址前缀中指定的所有地址都会路由到 Internet。By default, all addresses not specified within the address prefix of another route are routed to the internet.

但是,使用 az network watcher show-next-hop 命令测试发送到 172.31.0.100 的出站通信时,结果显示没有下一跃点类型。When you used the az network watcher show-next-hop command to test outbound communication to 172.31.0.100 however, the result informed you that there was no next hop type. 返回的输出中包含以下文本:In the returned output you also see the following text:

{
  "additionalProperties": {
    "disableBgpRoutePropagation": false
      },
  "addressPrefix": [
    "172.16.0.0/12"
  ],
  "name": null,
  "nextHopIpAddress": [],
  "nextHopType": "None",
  "source": "Default",
  "state": "Active"
},

az network watcher nic show-effective-route-table 命令的输出结果中可以看到,虽然有一个到 172.16.0.0/12 前缀的默认路由(其中包括地址 172.31.0.100),但“nextHopType”为“无” 。As you can see in the output from the az network watcher nic show-effective-route-table command, though there is a default route to the 172.16.0.0/12 prefix, which includes the 172.31.0.100 address, the nextHopType is None. Azure 会创建到 172.16.0.0/12 的默认路由,但不会无故指定下一个跃点类型。Azure creates a default route to 172.16.0.0/12, but doesn't specify a next hop type until there is a reason to. 在特定情况下,例如在已将 172.16.0.0/12 地址范围添加到虚拟网络的地址空间的情况下,Azure 会将路由的“nextHopType”更改为“虚拟网络”。 If, for example, you added the 172.16.0.0/12 address range to the address space of the virtual network, Azure changes the nextHopType to Virtual network for the route. 此时进行检查会将“nextHopType”显示为“虚拟网络” 。A check would then show Virtual network as the nextHopType.

清理资源Clean up resources

如果不再需要资源组及其包含的所有资源,可以使用 az group delete 将其删除:When no longer needed, you can use az group delete to remove the resource group and all of the resources it contains:

az group delete --name myResourceGroup --yes

后续步骤Next steps

本文介绍了如何创建 VM 并根据该 VM 诊断网络路由问题。In this article, you created a VM and diagnosed network routing from the VM. 同时说明了 Azure 可以创建多个默认路由,并且还测试了到两个不同目标的路由。You learned that Azure creates several default routes and tested routing to two different destinations. 详细了解 Azure 中的路由,以及如何创建自定义路由Learn more about routing in Azure and how to create custom routes.

对于出站 VM 连接,还可以使用网络观察程序的连接故障排除功能来确定延迟、VM 和终结点之间获得允许的和被拒绝的网络流量。For outbound VM connections, you can also determine the latency and allowed and denied network traffic between the VM and an endpoint using Network Watcher's connection troubleshoot capability. 可以使用网络观察程序的连接监视器功能监视 VM 和终结点(例如 IP 地址或 URL)之间在某段时间的通信情况。You can monitor communication between a VM and an endpoint, such as an IP address or URL, over time using the Network Watcher connection monitor capability. 如需了解如何操作,请参阅监视网络连接To learn how, see Monitor a network connection.