Azure 网络观察程序中的网络配置诊断简介Introduction to Network Configuration Diagnostics in Azure Network Watcher

网络配置诊断工具有助于客户了解 Azure 虚拟网络中允许或拒绝哪些流量流,以及供调试用的详细信息。The Network Configuration Diagnostic tool helps customers understand which traffic flows will be allowed or denied in your Azure Virtual Network along with detailed information for debugging. 你可以通过此工具了解 NSG 规则是否配置正确。It can help your in understanding if your NSG rules are configured correctly.


要使用网络配置诊断,必须在订阅中启用网络观察程序。For using Network Configuration Diagnostics, Network Watcher must be enabled in your subscription. 请参阅创建 Azure 网络观察程序实例来启用。See Create an Azure Network Watcher instance to enable.


  • Azure 中的资源通过虚拟网络 (VNET) 和子网进行连接。Your resources in Azure are connected via Virtual Networks (VNETs) and subnets. 可以使用网络安全组 (NSG) 来管理这些 VNet 和子网的安全性。The security of these VNets and subnets can be managed using a Network Security Group (NSG).
  • NSG 包含一系列安全规则,这些规则可以允许或拒绝连接到的资源的网络流量。An NSG contains a list of security rules that allow or deny network traffic to resources it is connected to. 可以将 NSG 与子网、单个 VM 或附加到 VM 的单个网络接口 (NIC) 进行关联。NSGs can be associated with subnets, individual VMs, or individual network interfaces (NICs) attached to VMs.
  • 网络中的所有流量流都是使用适用 NSG 中的规则评估的。All traffic flows in your network are evaluated using the rules in the applicable NSG.
  • 根据优先级从最低到最高计算规则Rules are evaluated based on priority number from lowest to highest

网络配置诊断的工作原理How does Network Configuration Diagnostic work?

对于给定的流,NCD 工具运行流的模拟,并返回是否允许(或拒绝)流,以及有关允许/拒绝流规则的详细信息。For a given flow, the NCD tool runs a simulation of the flow and returns whether the flow would be allowed (or denied) and detailed information about rules allowing/denying the flow. 客户必须提供流的详细信息,如源、目的地、协议等。该工具返回是允许流量还是拒绝流量、为指定流进行评估的 NSG 规则以及每个规则的评估结果。Customers must provide details of a flow like source, destination, protocol, etc. The tool returns whether traffic was allowed or denied, the NSG rules that were evaluated for the specified flow and the evaluation results for every rule.

后续步骤Next steps

通过其他接口使用网络配置诊断Use Network Configuration Diagnostic through other interfaces