Azure 虚拟机规模集的网络Networking for Azure virtual machine scale sets

通过门户部署 Azure 虚拟机规模集时,某些网络属性(例如带入站 NAT 规则的 Azure 负载均衡器)是默认设置的。When you deploy an Azure virtual machine scale set through the portal, certain network properties are defaulted, for example an Azure Load Balancer with inbound NAT rules. 本文介绍如何使用部分较高级的可以对规模集配置的网络功能。This article describes how to use some of the more advanced networking features that you can configure with scale sets.

可以使用 Azure Resource Manager 模板配置本文介绍的所有功能。You can configure all of the features covered in this article using Azure Resource Manager templates. 此外,还为选定功能提供了 Azure CLI 和 PowerShell 示例。Azure CLI and PowerShell examples are also included for selected features.

加速网络Accelerated Networking

Azure 加速网络可以实现对虚拟机的单根 I/O 虚拟化 (SR-IOV),从而提升网络性能。Azure Accelerated Networking improves network performance by enabling single root I/O virtualization (SR-IOV) to a virtual machine. 若要详细了解如何使用加速网络,请查看适用于 WindowsLinux 虚拟机的加速网络。To learn more about using Accelerated networking, see Accelerated networking for Windows or Linux virtual machines. 若要对规模集使用加速网络,请在规模集的 networkInterfaceConfigurations 设置中将 enableAcceleratedNetworking 设置为 true。To use accelerated networking with scale sets, set enableAcceleratedNetworking to true in your scale set's networkInterfaceConfigurations settings. 例如:For example:

"networkProfile": {
    "networkInterfaceConfigurations": [
    {
      "name": "niconfig1",
      "properties": {
        "primary": true,
        "enableAcceleratedNetworking" : true,
        "ipConfigurations": [
          ...
        ]
      }
    }
   ]
}

带 Azure 负载均衡器的 Azure 虚拟机规模集Azure virtual machine scale sets with Azure Load Balancer

请参阅 Azure 负载平衡器和虚拟机规模集,详细了解如何根据你的场景使用虚拟机规模集配置标准负载平衡器。See Azure Load Balancer and Virtual Machine Scale Sets to learn more about how to configure your Standard Load Balancer with Virtual Machine Scale Sets based on your scenario.

创建引用应用程序网关的规模集Create a scale set that references an Application Gateway

若要创建使用应用程序网关的规模集,请在规模集的 ipConfigurations 节中引用应用程序网关的后端地址池,如此 ARM 模板配置所示:To create a scale set that uses an application gateway, reference the backend address pool of the application gateway in the ipConfigurations section of your scale set as in this ARM template config:

"ipConfigurations": [{
  "name": "{config-name}",
  "properties": {
  "subnet": {
    "id": "{subnet-id}"
  },
  "ApplicationGatewayBackendAddressPools": [{
    "id": "/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.Network/applicationGateways/{gateway-name}/backendAddressPools/{pool-name}"
  }]
}]

备注

请注意,应用程序网关必须与规模集在同一虚拟网络中,但必须与规模集在不同子网中。Note that the application gateway must be in the same virtual network as the scale set but must be in a different subnet from the scale set.

可配置的 DNS 设置Configurable DNS Settings

默认情况下,规模集采用其创建时所在的 VNET 和子网的特定 DNS 设置。By default, scale sets take on the specific DNS settings of the VNET and subnet they were created in. 但是,可以直接配置规模集的 DNS 设置。You can however, configure the DNS settings for a scale set directly.

通过可配置的 DNS 服务器创建规模集Creating a scale set with configurable DNS servers

若要通过 Azure CLI 使用自定义 DNS 配置创建规模集,请将 --dns-servers 参数添加到 vmss create 命令中,后接空格分隔的服务器 IP 地址 。To create a scale set with a custom DNS configuration using the Azure CLI, add the --dns-servers argument to the vmss create command, followed by space separated server ip addresses. 例如:For example:

--dns-servers 10.0.0.6 10.0.0.5

若要在 Azure 模板中配置自定义 DNS 服务器,请将 dnsSettings 属性添加到规模集的 networkInterfaceConfigurations 节。To configure custom DNS servers in an Azure template, add a dnsSettings property to the scale set networkInterfaceConfigurations section. 例如:For example:

"dnsSettings":{
    "dnsServers":["10.0.0.6", "10.0.0.5"]
}

使用可配置的虚拟机域名创建规模集Creating a scale set with configurable virtual machine domain names

若要通过 CLI 使用自定义 DNS 名称为虚拟机创建规模集,请将 --vm-domain-name 参数添加到 virtual machine scale set create 命令中,后接表示域名的字符串。To create a scale set with a custom DNS name for virtual machines using the CLI, add the --vm-domain-name argument to the virtual machine scale set create command, followed by a string representing the domain name.

若要在 Azure 模板中设置域名,请将 dnsSettings 属性添加到规模集的 networkInterfaceConfigurations 节。To set the domain name in an Azure template, add a dnsSettings property to the scale set networkInterfaceConfigurations section. 例如:For example:

"networkProfile": {
  "networkInterfaceConfigurations": [
    {
    "name": "nic1",
    "properties": {
      "primary": true,
      "ipConfigurations": [
      {
        "name": "ip1",
        "properties": {
          "subnet": {
            "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('vnetName'), '/subnets/subnet1')]"
          },
          "publicIPAddressconfiguration": {
            "name": "publicip",
            "properties": {
            "idleTimeoutInMinutes": 10,
              "dnsSettings": {
                "domainNameLabel": "[parameters('vmssDnsName')]"
              }
            }
          }
        }
      }
    ]
    }
}

单个虚拟机 DNS 名称的输出将采用以下形式:The output, for an individual virtual machine dns name would be in the following form:

<vm><vmindex>.<specifiedVmssDomainNameLabel>

每个虚拟机的公共 IPv4Public IPv4 per virtual machine

通常,Azure 规模集虚拟机不需要自己的公共 IP 地址。In general, Azure scale set virtual machines do not require their own public IP addresses. 大多数情况下,将公共 IP 地址关联到负载均衡器或单个虚拟机(又称 jumpbox)更经济,也更安全,后者随后会根据需要通过特定方式(例如,通过入站 NAT 规则)将传入连接路由到规模集虚拟机。For most scenarios, it is more economical and secure to associate a public IP address to a load balancer or to an individual virtual machine (also known as a jumpbox), which then routes incoming connections to scale set virtual machines as needed (for example, through inbound NAT rules).

但某些情况下,确实需要规模集虚拟机拥有自己的公共 IP 地址。However, some scenarios do require scale set virtual machines to have their own public IP addresses. 例如,玩游戏时,主机需直接连接到云虚拟机进行游戏的物理处理。An example is gaming, where a console needs to make a direct connection to a cloud virtual machine, which is doing game physics processing. 再举例来说,虚拟机有时需在分布式数据库中跨区域进行外部互连。Another example is where virtual machines need to make external connections to one another across regions in a distributed database.

使用公共 IP 为每个虚拟机创建规模集Creating a scale set with public IP per virtual machine

若要通过 CLI 创建向每个虚拟机分配公共 IP 地址的规模集,请将 --public-ip-per-vm 参数添加到 vmss create 命令中 。To create a scale set that assigns a public IP address to each virtual machine with the CLI, add the --public-ip-per-vm parameter to the vmss create command.

若要使用 Azure 模板创建规模集,请确保 Microsoft.Compute/virtualMachineScaleSets 资源的 API 版本至少为 2017-03-30,并将 publicIpAddressConfiguration JSON 属性添加到规模集的 ipConfigurations 节。To create a scale set using an Azure template, make sure the API version of the Microsoft.Compute/virtualMachineScaleSets resource is at least 2017-03-30, and add a publicIpAddressConfiguration JSON property to the scale set ipConfigurations section. 例如:For example:

"publicIpAddressConfiguration": {
    "name": "pub1",
    "properties": {
      "idleTimeoutInMinutes": 15
    }
}

示例模板:201-vmss-public-ip-linuxExample template: 201-vmss-public-ip-linux

在规模集中查询虚拟机的公共 IP 地址Querying the public IP addresses of the virtual machines in a scale set

若要通过 CLI 列出分配到规模集虚拟机的公共 IP 地址,请使用 az vmss list-instance-public-ips 命令。To list the public IP addresses assigned to scale set virtual machines using the CLI, use the az vmss list-instance-public-ips command.

若要使用 PowerShell 列出规模集的公共 IP 地址,请使用_Get-AzPublicIpAddress_ 命令。To list scale set public IP addresses using PowerShell, use the Get-AzPublicIpAddress command. 例如:For example:

Get-AzPublicIpAddress -ResourceGroupName myrg -VirtualMachineScaleSetName myvmss

也可以通过直接引用公共 IP 地址配置的资源 ID 来查询公共 IP 地址。You can also query the public IP addresses by referencing the resource ID of the public IP address configuration directly. 例如:For example:

Get-AzPublicIpAddress -ResourceGroupName myrg -Name myvmsspip

也可通过查询 Azure REST API 2017-03-30 或更高版本来显示分配到规模集虚拟机的公共 IP 地址。You can also display the public IP addresses assigned to the scale set virtual machines by querying the Azure REST API with version 2017-03-30 or higher.

若要查询 Azure REST API,请执行以下操作:To query the Azure REST API:

GET https://management.chinacloudapi.cn/subscriptions/{your sub ID}/resourceGroups/{RG name}/providers/Microsoft.Compute/virtualMachineScaleSets/{scale set name}/publicipaddresses?api-version=2017-03-30

Azure REST API 的示例输出:Example output from the Azure REST API:

{
  "value": [
    {
      "name": "pub1",
      "id": "/subscriptions/your-subscription-id/resourceGroups/your-rg/providers/Microsoft.Compute/virtualMachineScaleSets/pipvmss/virtualMachines/0/networkInterfaces/pipvmssnic/ipConfigurations/yourvmssipconfig/publicIPAddresses/pub1",
      "etag": "W/\"a64060d5-4dea-4379-a11d-b23cd49a3c8d\"",
      "properties": {
        "provisioningState": "Succeeded",
        "resourceGuid": "ee8cb20f-af8e-4cd6-892f-441ae2bf701f",
        "ipAddress": "13.84.190.11",
        "publicIPAddressVersion": "IPv4",
        "publicIPAllocationMethod": "Dynamic",
        "idleTimeoutInMinutes": 15,
        "ipConfiguration": {
          "id": "/subscriptions/your-subscription-id/resourceGroups/your-rg/providers/Microsoft.Compute/virtualMachineScaleSets/yourvmss/virtualMachines/0/networkInterfaces/yourvmssnic/ipConfigurations/yourvmssipconfig"
        }
      }
    },
    {
      "name": "pub1",
      "id": "/subscriptions/your-subscription-id/resourceGroups/your-rg/providers/Microsoft.Compute/virtualMachineScaleSets/yourvmss/virtualMachines/3/networkInterfaces/yourvmssnic/ipConfigurations/yourvmssipconfig/publicIPAddresses/pub1",
      "etag": "W/\"5f6ff30c-a24c-4818-883c-61ebd5f9eee8\"",
      "properties": {
        "provisioningState": "Succeeded",
        "resourceGuid": "036ce266-403f-41bd-8578-d446d7397c2f",
        "ipAddress": "13.84.159.176",
        "publicIPAddressVersion": "IPv4",
        "publicIPAllocationMethod": "Dynamic",
        "idleTimeoutInMinutes": 15,
        "ipConfiguration": {
          "id": "/subscriptions/your-subscription-id/resourceGroups/your-rg/providers/Microsoft.Compute/virtualMachineScaleSets/yourvmss/virtualMachines/3/networkInterfaces/yourvmssnic/ipConfigurations/yourvmssipconfig"
        }
      }
    }

每个 NIC 多个 IP 地址Multiple IP addresses per NIC

在规模集中,附加到 VM 的每个 NIC 可以有一个或多个关联的 IP 配置。Every NIC attached to a VM in a scale set can have one or more IP configurations associated with it. 每个配置分配有一个专用 IP 地址。Each configuration is assigned one private IP address. 每个配置还可以有一个关联的公共 IP 地址资源。Each configuration may also have one public IP address resource associated with it. 若要了解可以为一个 NIC 分配多少个 IP 地址,以及可以在一个 Azure 订阅中使用多少个公共 IP 地址,请参阅 Azure 限制To understand how many IP addresses can be assigned to a NIC, and how many public IP addresses you can use in an Azure subscription, refer to Azure limits.

每个虚拟机多个 NICMultiple NICs per virtual machine

每个虚拟机最多可以有 8 个 NIC,具体取决于虚拟机大小。You can have up to 8 NICs per virtual machine, depending on machine size. 若要了解每个虚拟机的最大 NIC 数,请参阅 VM 大小一文。The maximum number of NICs per machine is available in the VM size article. 连接到 VM 实例的所有 NIC 都必须连接到同一虚拟网络。All NICs connected to a VM instance must connect to the same virtual network. NIC 可以连接到不同子网,但所有子网都必须属于同一虚拟网络。The NICs can connect to different subnets, but all subnets must be part of the same virtual network.

以下示例为规模集网络配置文件,显示每个虚拟机有多个 NIC 条目和多个公共 IP:The following example is a scale set network profile showing multiple NIC entries, and multiple public IPs per virtual machine:

"networkProfile": {
    "networkInterfaceConfigurations": [
        {
        "name": "nic1",
        "properties": {
            "primary": true,
            "ipConfigurations": [
            {
                "name": "ip1",
                "properties": {
                "subnet": {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('vnetName'), '/subnets/subnet1')]"
                },
                "publicipaddressconfiguration": {
                    "name": "pub1",
                    "properties": {
                    "idleTimeoutInMinutes": 15
                    }
                },
                "loadBalancerInboundNatPools": [
                    {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/inboundNatPools/natPool1')]"
                    }
                ],
                "loadBalancerBackendAddressPools": [
                    {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/backendAddressPools/addressPool1')]"
                    }
                ]
                }
            }
            ]
        }
        },
        {
        "name": "nic2",
        "properties": {
            "primary": false,
            "ipConfigurations": [
            {
                "name": "ip1",
                "properties": {
                "subnet": {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('vnetName'), '/subnets/subnet1')]"
                },
                "publicipaddressconfiguration": {
                    "name": "pub1",
                    "properties": {
                    "idleTimeoutInMinutes": 15
                    }
                },
                "loadBalancerInboundNatPools": [
                    {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/inboundNatPools/natPool1')]"
                    }
                ],
                "loadBalancerBackendAddressPools": [
                    {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/backendAddressPools/addressPool1')]"
                    }
                ]
                }
            }
            ]
        }
        }
    ]
}

每个规模集的 NSG 和 ASGNSG & ASGs per scale set

可以使用网络安全组通过安全规则来筛选 Azure 虚拟网络中出入 Azure 资源的流量。Network Security Groups allow you to filter traffic to and from Azure resources in an Azure virtual network using security rules. 可以通过应用程序安全组来处理 Azure 资源的网络安全问题,并将其作为应用程序结构的扩展组合起来。Application Security Groups enable you to handle network security of Azure resources and group them as an extension of your application's structure.

可以直接向规模集应用网络安全组,只需将引用添加到规模集虚拟机属性的网络接口配置节即可。Network Security Groups can be applied directly to a scale set, by adding a reference to the network interface configuration section of the scale set virtual machine properties.

也可以直接为规模集指定应用程序安全组,只需将引用添加到规模集虚拟机属性的网络接口 IP 配置节即可。Application Security Groups can also be specified directly to a scale set, by adding a reference to the network interface ip configurations section of the scale set virtual machine properties.

例如:For example:

"networkProfile": {
    "networkInterfaceConfigurations": [
        {
            "name": "nic1",
            "properties": {
                "primary": true,
                "ipConfigurations": [
                    {
                        "name": "ip1",
                        "properties": {
                            "subnet": {
                                "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/virtualNetworks/', variables('vnetName'), '/subnets/subnet1')]"
                            },
                            "applicationSecurityGroups": [
                                {
                                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/applicationSecurityGroups/', variables('asgName'))]"
                                }
                            ],
                "loadBalancerInboundNatPools": [
                                {
                                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/inboundNatPools/natPool1')]"
                                }
                            ],
                            "loadBalancerBackendAddressPools": [
                                {
                                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/loadBalancers/', variables('lbName'), '/backendAddressPools/addressPool1')]"
                                }
                            ]
                        }
                    }
                ],
                "networkSecurityGroup": {
                    "id": "[concat('/subscriptions/', subscription().subscriptionId,'/resourceGroups/', resourceGroup().name, '/providers/Microsoft.Network/networkSecurityGroups/', variables('nsgName'))]"
                }
            }
        }
    ]
}

若要验证网络安全组是否与规模集相关联,请使用 az vmss show 命令。To verify your Network Security Group is associated with your scale set, use the az vmss show command. 下面的示例使用 --query 来筛选结果,只显示输出的相关部分。The below example uses --query to filter the results and only show the relevant section of the output.

az vmss show \
    -g myResourceGroup \
    -n myScaleSet \
    --query virtualMachineProfile.networkProfile.networkInterfaceConfigurations[].networkSecurityGroup

[
  {
    "id": "/subscriptions/.../resourceGroups/myResourceGroup/providers/Microsoft.Network/networkSecurityGroups/nsgName",
    "resourceGroup": "myResourceGroup"
  }
]

若要验证应用程序安全组是否与规模集相关联,请使用 az vmss show 命令。To verify your Application Security Group is associated with your scale set, use the az vmss show command. 下面的示例使用 --query 来筛选结果,只显示输出的相关部分。The below example uses --query to filter the results and only show the relevant section of the output.

az vmss show \
    -g myResourceGroup \
    -n myScaleSet \
    --query virtualMachineProfile.networkProfile.networkInterfaceConfigurations[].ipConfigurations[].applicationSecurityGroups

[
  [
    {
      "id": "/subscriptions/.../resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationSecurityGroups/asgName",
      "resourceGroup": "myResourceGroup"
    }
  ]
]

后续步骤Next steps

有关 Azure 虚拟网络的详细信息,请参阅 Azure 虚拟网络概述For more information about Azure virtual networks, see Azure virtual networks overview.