创建虚拟网络对等互连 - 资源管理器,不同的订阅Create a virtual network peering - Resource Manager, different subscriptions

本教程介绍如何在通过资源管理器创建的虚拟网络间创建虚拟网络对等互连。In this tutorial, you learn to create a virtual network peering between virtual networks created through Resource Manager. 虚拟网络位于不同订阅。The virtual networks exist in different subscriptions. 在两个虚拟网络之间建立对等互连可让不同虚拟网络中的资源以相同的带宽和延迟彼此通信,就像这些资源位于同一个虚拟网络中一样。Peering two virtual networks enables resources in different virtual networks to communicate with each other with the same bandwidth and latency as though the resources were in the same virtual network. 了解有关虚拟网络对等互连的详细信息。Learn more about Virtual network peering.

创建虚拟网络对等互连的步骤有所不同,具体取决于虚拟网络是否位于相同订阅,以及创建虚拟网络的 Azure 部署模型The steps to create a virtual network peering are different, depending on whether the virtual networks are in the same, or different, subscriptions, and which Azure deployment model the virtual networks are created through. 选择下表中的方案,了解如何采用其他方案创建虚拟网络对等互连:Learn how to create a virtual network peering in other scenarios by selecting the scenario from the following table:

Azure 部署模型Azure deployment model Azure 订阅Azure subscription
均为资源管理器模型Both Resource Manager 相同Same
一个为资源管理器模型,一个为经典模型One Resource Manager, one classic 相同Same
一个为资源管理器模型,一个为经典模型One Resource Manager, one classic 不同Different

不能在通过经典部署模型部署的两个虚拟网络之间创建对等互连。A virtual network peering cannot be created between two virtual networks deployed through the classic deployment model. 如需连接两个通过经典部署模型创建的虚拟网络,可使用 Azure VPN 网关来连接它们。If you need to connect virtual networks that were both created through the classic deployment model, you can use an Azure VPN Gateway to connect the virtual networks.

本教程将在同一区域中的虚拟网络之间建立对等互连。This tutorial peers virtual networks in the same region. 还可以将不同受支持的区域中的虚拟网络对等互连。You can also peer virtual networks in different supported regions. 建议在对等互连虚拟网络之前让自己熟悉对等互连的要求和约束It's recommended that you familiarize yourself with the peering requirements and constraints before peering virtual networks.

可以使用 Azure 门户、Azure 命令行接口 (CLI)、Azure PowerShell、或 Azure 资源管理器模板创建虚拟网络对等互连。You can use the Azure portal, the Azure command-line interface (CLI), Azure PowerShell, or an Azure Resource Manager template to create a virtual network peering. 选择前面的任何工具链接可以直接转到使用所选工具创建虚拟网络对等互连的步骤。Select any of the previous tool links to go directly to the steps for creating a virtual network peering using your tool of choice.

创建对等互连 - Azure 门户Create peering - Azure portal

下述步骤对每个订阅使用不同的帐户。The following steps use different accounts for each subscription. 如果使用的帐户可访问这两个订阅,则可使用相同帐户完成所有步骤,跳过注销门户的步骤,及为虚拟网络分配其他用户权限的步骤。If you're using an account that has permissions to both subscriptions, you can use the same account for all steps, skip the steps for logging out of the portal, and skip the steps for assigning another user permissions to the virtual networks.

  1. 以用户 A 的身份登录到 Azure 门户Log in to the Azure portal as UserA. 用于登录的帐户必须拥有创建虚拟网络对等互连的必要权限。The account you log in with must have the necessary permissions to create a virtual network peering. 有关权限列表,请参阅虚拟网络对等互连权限For a list of permissions, see Virtual network peering permissions.

  2. 选择“+ 创建资源”,然后依次选择“网络”和“虚拟网络” 。Select + Create a resource, select Networking, and then select Virtual network.

  3. 为以下设置选择或输入以下示例值,然后选择“创建” :Select or enter the following example values for the following settings, then select Create:

    • 名称myVnetAName: myVnetA
    • 地址空间10.0.0.0/16Address space: 10.0.0.0/16
    • 子网名称:默认值 Subnet name: default
    • 子网地址范围10.0.0.0/24Subnet address range: 10.0.0.0/24
    • 订阅:选择订阅 A。Subscription: Select subscription A.
    • 资源组:选择“新建” ,然后输入 myResourceGroupA Resource group: Select Create new and enter myResourceGroupA
    • 位置中国东部Location: China East
  4. 在门户顶部的“搜索资源”框中键入 myVnetAIn the Search resources box at the top of the portal, type myVnetA. 选择出现在搜索结果中的“myVnetA” 。Select myVnetA when it appears in the search results.

  5. 从左侧的垂直选项列表中选择“访问控制(IAM)”。 Select Access control (IAM) from the vertical list of options on the left side.

  6. 在“myVnetA - 访问控制(IAM)” 下,选择“+ 添加角色分配” 。Under myVnetA - Access control (IAM), select + Add role assignment.

  7. 在“角色”框中选择“网络参与者”。 Select Network contributor in the Role box.

  8. 在“选择”框中,选择 UserB,或者键入 UserB 的电子邮件地址来搜索该用户。 In the Select box, select UserB, or type UserB's email address to search for it.

  9. 选择“保存” 。Select Save.

  10. 在“myVnetA - 访问控制 (IAM)”下,选择左侧垂直选项列表中的“属性” 。Under myVnetA - Access control (IAM), select Properties from the vertical list of options on the left side. 复制“资源 ID”,在稍后的步骤中使用 。Copy the RESOURCE ID, which is used in a later step. 资源 ID 类似于以下示例:/subscriptions/<Subscription Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/virtualNetworks/myVnetAThe resource ID is similar to the following example: /subscriptions/<Subscription Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/virtualNetworks/myVnetA.

  11. 以 UserA 的身份注销门户,然后以 UserB 的身份登录。Log out of the portal as UserA, then log in as UserB.

  12. 完成步骤 2-3,在步骤 3 中输入或选择以下值:Complete steps 2-3, entering or selecting the following values in step 3:

    • 名称myVnetBName: myVnetB
    • 地址空间10.1.0.0/16Address space: 10.1.0.0/16
    • 子网名称:默认值 Subnet name: default
    • 子网地址范围10.1.0.0/24Subnet address range: 10.1.0.0/24
    • 订阅:选择订阅 B。Subscription: Select subscription B.
    • 资源组:选择“新建” ,然后输入 myResourceGroupB Resource group: Select Create new and enter myResourceGroupB
    • 位置中国东部Location: China East
  13. 在门户顶部的“搜索资源”框中键入 myVnetBIn the Search resources box at the top of the portal, type myVnetB. 选择出现在搜索结果中的“myVnetB” 。Select myVnetB when it appears in the search results.

  14. 在“myVnetB”下,选择左侧垂直选项列表中的“属性” 。Under myVnetB, select Properties from the vertical list of options on the left side. 复制“资源 ID”,在稍后的步骤中使用 。Copy the RESOURCE ID, which is used in a later step. 资源 ID 类似于以下示例:/subscriptions/<Subscription ID>/resourceGroups/myResourceGroupB/providers/Microsoft.ClassicNetwork/virtualNetworks/myVnetBThe resource ID is similar to the following example: /subscriptions/<Subscription ID>/resourceGroups/myResourceGroupB/providers/Microsoft.ClassicNetwork/virtualNetworks/myVnetB.

  15. 在“myVnetB”下选择“访问控制(IAM)”,然后为 myVnetB 完成步骤 5-10,在步骤 8 中输入 UserASelect Access control (IAM) under myVnetB, and then complete steps 5-10 for myVnetB, entering UserA in step 8.

  16. 以 UserB 的身份注销门户,然后以 UserA 的身份登录。Log out of the portal as UserB and log in as UserA.

  17. 在门户顶部的“搜索资源”框中键入 myVnetAIn the Search resources box at the top of the portal, type myVnetA. 选择出现在搜索结果中的“myVnetA” 。Select myVnetA when it appears in the search results.

  18. 选择“myVnetA” 。Select myVnetA.

  19. 在“设置” 下,选择“对等” 。Under SETTINGS, select Peerings.

  20. 在“myVnetA - 对等互连” 下,选择“+ 添加” 。Under myVnetA - Peerings, select + Add

  21. 在“添加对等互连” 下,输入或选择以下选项,然后选择“确定” :Under Add peering, enter, or select, the following options, then select OK:

    • 名称myVnetAToMyVnetBName: myVnetAToMyVnetB
    • 虚拟网络部署模型:选择“Resource Manager” 。Virtual network deployment model: Select Resource Manager.
    • 我知道我的资源 ID:选中此框。I know my resource ID: Check this box.
    • 资源 ID:输入步骤 14 中的资源 ID。Resource ID: Enter the resource ID from step 14.
    • 允许虚拟网络访问: 确保选中“已启用”。 Allow virtual network access: Ensure that Enabled is selected. 本教程不使用其他任何设置。No other settings are used in this tutorial. 若要了解所有对等互连设置,请阅读管理虚拟网络对等互连To learn about all peering settings, read Manage virtual network peerings.
  22. 在上一步骤中选择“确定”后,等待片刻,你创建的对等互连将会出现。 The peering you created appears a short wait after selecting OK in the previous step. 创建的 myVnetAToMyVnetB 对等互连的“对等互连状态”列中列出了“已启动” 。Initiated is listed in the PEERING STATUS column for the myVnetAToMyVnetB peering you created. 已将 myVnetA 对等互连到 myVnetB,但现在必须将 myVnetB 对等互连到 myVnetA。You've peered myVnetA to myVnetB, but now you must peer myVnetB to myVnetA. 必须朝两个方向创建对等互连才能让虚拟网络中的资源相互通信。The peering must be created in both directions to enable resources in the virtual networks to communicate with each other.

  23. 注销 UserA 的门户登录,然后以 UserB 的身份登录。Log out of the portal as UserA and log in as UserB.

  24. 针对 myVnetB 再次完成步骤 17-21。Complete steps 17-21 again for myVnetB. 在步骤 21 中,将对等互连命名为 myVnetBToMyVnetA,为“虚拟网络”选择“myVnetA”,并在“资源ID”框中输入步骤 10 中的 ID 。In step 21, name the peering myVnetBToMyVnetA, select myVnetA for Virtual network, and enter the ID from step 10 in the Resource ID box.

  25. 选择“确定”来为 myVnetB 创建对等互连后,几秒钟后,将会列出刚刚创建的 myVnetBToMyVnetA 对等互连,“对等互连状态”列中显示“已连接” 。A few seconds after selecting OK to create the peering for myVnetB, the myVnetBToMyVnetA peering you just created is listed with Connected in the PEERING STATUS column.

  26. 以 UserB 的身份注销门户,然后以 UserA 的身份登录。Log out of the portal as UserB and log in as UserA.

  27. 再次完成步骤 17-19。Complete steps 17-19 again. myVnetAToVNetB 对等互连的“对等互连状态”现也显示为“已连接” 。The PEERING STATUS for the myVnetAToVNetB peering is now also Connected. 对等互连中两个虚拟网络的“对等互连状态”列都显示为“已连接”后,即表示已成功建立对等互连。 The peering is successfully established after you see Connected in the PEERING STATUS column for both virtual networks in the peering. 在任一虚拟网络中创建的任何 Azure 资源现在都可通过其 IP 地址相互通信。Any Azure resources you create in either virtual network are now able to communicate with each other through their IP addresses. 如果为虚拟网络使用默认的 Azure 名称解析,则虚拟网络中的资源无法跨虚拟网络解析名称。If you're using default Azure name resolution for the virtual networks, the resources in the virtual networks are not able to resolve names across the virtual networks. 若要跨对等互连中的虚拟网络解析名称,必须创建自己的 DNS 服务器。If you want to resolve names across virtual networks in a peering, you must create your own DNS server. 了解如何使用自己的 DNS 服务器进行名称解析Learn how to set up Name resolution using your own DNS server.

  28. 可选:尽管本教程未介绍如何创建虚拟机,但可以在每个虚拟网络中创建一个虚拟机并将其相互连接,以验证连接性。Optional: Though creating virtual machines is not covered in this tutorial, you can create a virtual machine in each virtual network and connect from one virtual machine to the other, to validate connectivity.

  29. 可选:若要删除在本教程中创建的资源,请完成本文的删除资源部分中所述的步骤。Optional: To delete the resources that you create in this tutorial, complete the steps in the Delete resources section of this article.

创建对等互连 - Azure CLICreate peering - Azure CLI

本教程为每个订阅使用不同的帐户。This tutorial uses different accounts for each subscription. 如果使用的帐户可访问这两个订阅,则可使用相同帐户完成所有步骤,可跳过注销 Azure 的步骤,并删除创建用户角色分配的脚本行。If you're using an account that has permissions to both subscriptions, you can use the same account for all steps, skip the steps for logging out of Azure, and remove the lines of script that create user role assignments. 将以下所有脚本中的 UserA@azure.com 和 UserB@azure.com 替换为 UserA 和 UserB 使用的用户名。Replace UserA@azure.com and UserB@azure.com in all of the following scripts with the usernames you're using for UserA and UserB.

以下脚本:The following scripts:

  • 需要 Azure CLI 2.0.4 或更高版本。Requires the Azure CLI version 2.0.4 or later. 若要查找版本,请运行 az --versionTo find the version, run az --version. 如果需要进行升级,请参阅安装 Azure CLIIf you need to upgrade, see Install Azure CLI.
  • 可以在 Bash shell 中使用。Works in a Bash shell. 有关在 Windows 客户端上运行 Azure CLI 脚本的选项,请参阅在 Windows 上安装 Azure CLIFor options on running Azure CLI scripts on Windows client, see Install the Azure CLI on Windows.

Note

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

  1. 使用 azure login -e AzureChinaCloud 命令打开 CLI 会话并以 UserA 的身份登录 Azure。Open a CLI session and log in to Azure as UserA using the azure login -e AzureChinaCloud command. 用于登录的帐户必须拥有创建虚拟网络对等互连的必要权限。The account you log in with must have the necessary permissions to create a virtual network peering. 有关权限列表,请参阅虚拟网络对等互连权限For a list of permissions, see Virtual network peering permissions.

  2. 将以下脚本复制到电脑上的文本编辑器,将 <SubscriptionA-Id> 替换为订阅 A 的 ID,然后复制修改后的脚本,将其粘贴到 CLI 会话,按 EnterCopy the following script to a text editor on your PC, replace <SubscriptionA-Id> with the ID of SubscriptionA, then copy the modified script, paste it in your CLI session, and press Enter. 如果不知道订阅 ID,请输入 az account show 命令。If you don't know your subscription Id, enter the az account show command. 输出中的 id 值就是订阅 ID。The value for id in the output is your subscription Id.

    # Create a resource group.
    az group create \
      --name myResourceGroupA \
      --location chinaeast
    
    # Create virtual network A.
    az network vnet create \
      --name myVnetA \
      --resource-group myResourceGroupA \
      --location chinaeast \
      --address-prefix 10.0.0.0/16
    
    # Assign UserB permissions to virtual network A.
    az role assignment create \
      --assignee UserB@azure.com \
      --role "Network Contributor" \
      --scope /subscriptions/<SubscriptionA-Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/VirtualNetworks/myVnetA
    
  3. 使用 az logout 命令注销 UserA 的 Azure 登录,然后以 UserB 的身份登录 Azure。Log out of Azure as UserA using the az logout command, then log in to Azure as UserB. 用于登录的帐户必须拥有创建虚拟网络对等互连的必要权限。The account you log in with must have the necessary permissions to create a virtual network peering. 有关权限列表,请参阅虚拟网络对等互连权限For a list of permissions, see Virtual network peering permissions.

  4. 创建 myVnetB。Create myVnetB. 将步骤 2 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 2 to a text editor on your PC. <SubscriptionA-Id> 替换为订阅 B 的 ID。Replace <SubscriptionA-Id> with the ID of SubscriptionB. 将 10.0.0.0/16 更改为 10.1.0.0/16,将所有 A 更改为 B,并将所有 B 更改为 A。复制修改后的脚本,将其粘贴到 CLI 会话,按 EnterChange 10.0.0.0/16 to 10.1.0.0/16, change all As to B, and all Bs to A. Copy the modified script, paste it in to your CLI session, and press Enter.

  5. 注销 UserB 的 Azure 登录,然后以 UserA 的身份登录 Azure。Log out of Azure as UserB and log in to Azure as UserA.

  6. 创建从 myVnetA 到 myVnetB 的虚拟网络对等互连。Create a virtual network peering from myVnetA to myVnetB. 将以下脚本内容复制到计算机上的文本编辑器。Copy the following script contents to a text editor on your PC. <SubscriptionB-Id> 替换为订阅 B 的 ID。Replace <SubscriptionB-Id> with the ID of SubscriptionB. 若要执行该脚本,请复制修改后的脚本,将其粘贴到 CLI 会话,按 Enter。To execute the script, copy the modified script, paste it into your CLI session, and press Enter.

    # Get the id for myVnetA.
    vnetAId=$(az network vnet show \
      --resource-group myResourceGroupA \
      --name myVnetA \
      --query id --out tsv)
    
    # Peer myVNetA to myVNetB.
    az network vnet peering create \
      --name myVnetAToMyVnetB \
      --resource-group myResourceGroupA \
      --vnet-name myVnetA \
      --remote-vnet-id /subscriptions/<SubscriptionB-Id>/resourceGroups/myResourceGroupB/providers/Microsoft.Network/VirtualNetworks/myVnetB \
      --allow-vnet-access
    
  7. 查看 myVnetA 的对等互连状态。View the peering state of myVnetA.

    az network vnet peering list \
      --resource-group myResourceGroupA \
      --vnet-name myVnetA \
      --output table
    

    状态为“已启动” 。The state is Initiated. 创建从 myVnetB 到 myVnetA 的对等互连后,状态即会变为“已连接” 。It changes to Connected once you create the peering to myVnetA from myVnetB.

  8. 注销 UserA 的 Azure 登录,然后以 UserB 的身份登录 Azure。Log out UserA from Azure and log in to Azure as UserB.

  9. 创建从 myVnetB 到 myVnetA 的对等互连。Create the peering from myVnetB to myVnetA. 将步骤 6 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 6 to a text editor on your PC. <SubscriptionB-Id> 替换为订阅 A 的 ID,将所有 A 更改为 B,并将所有 B 更改为 A。更改完成后,复制修改后的脚本,将其粘贴到 CLI 会话,按 EnterReplace <SubscriptionB-Id> with the ID for SubscriptionA and change all As to B and all Bs to A. Once you've made the changes, copy the modified script, paste it into your CLI session, and press Enter.

  10. 查看 myVnetB 的对等互连状态。View the peering state of myVnetB. 将步骤 7 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 7 to a text editor on your PC. 将资源组和虚拟网络名称中的 A 更改为 B,复制该脚本,将修改后的脚本粘贴到 CLI 会话,按 EnterChange A to B for the resource group and virtual network names, copy the script, paste the modified script in to your CLI session, and then press Enter. 对等互连状态为“已连接” 。The peering state is Connected. 创建从 myVnetB 到 myVnetA 的对等互连后,myVnetA 的对等互连状态变为“已连接” 。The peering state of myVnetA changes to Connected after you've created the peering from myVnetB to myVnetA. 可以 UserA 的身份重新登录 Azure,并再次完成步骤 7,验证 myVnetA 的对等互连状态。You can log UserA back in to Azure and complete step 7 again to verify the peering state of myVnetA.

    Note

    直到两个虚拟网络的对等互连状态均为“已连接”时,对等互连才建立成功 。The peering is not established until the peering state is Connected for both virtual networks.

  11. 可选:尽管本教程未介绍如何创建虚拟机,但可以在每个虚拟网络中创建一个虚拟机并将其相互连接,以验证连接性。Optional: Though creating virtual machines is not covered in this tutorial, you can create a virtual machine in each virtual network and connect from one virtual machine to the other, to validate connectivity.

  12. 可选:若要删除在本教程中创建的资源,请完成本文的删除资源中所述步骤。Optional: To delete the resources that you create in this tutorial, complete the steps in Delete resources in this article.

在任一虚拟网络中创建的任何 Azure 资源现在都可通过其 IP 地址相互通信。Any Azure resources you create in either virtual network are now able to communicate with each other through their IP addresses. 如果为虚拟网络使用默认的 Azure 名称解析,则虚拟网络中的资源无法跨虚拟网络解析名称。If you're using default Azure name resolution for the virtual networks, the resources in the virtual networks are not able to resolve names across the virtual networks. 若要跨对等互连中的虚拟网络解析名称,必须创建自己的 DNS 服务器。If you want to resolve names across virtual networks in a peering, you must create your own DNS server. 了解如何使用自己的 DNS 服务器进行名称解析Learn how to set up Name resolution using your own DNS server.

创建对等互连 - PowerShellCreate peering - PowerShell

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

本教程为每个订阅使用不同的帐户。This tutorial uses different accounts for each subscription. 如果使用的帐户可访问这两个订阅,则可使用相同帐户完成所有步骤,可跳过注销 Azure 的步骤,并删除创建用户角色分配的脚本行。If you're using an account that has permissions to both subscriptions, you can use the same account for all steps, skip the steps for logging out of Azure, and remove the lines of script that create user role assignments. 将以下所有脚本中的 UserA@azure.com 和 UserB@azure.com 替换为 UserA 和 UserB 使用的用户名。Replace UserA@azure.com and UserB@azure.com in all of the following scripts with the usernames you're using for UserA and UserB.

  1. 确认你使用的是 Azure PowerShell 1.0.0 或更高版本。Confirm that you have Azure PowerShell version 1.0.0 or higher. 可以通过运行 Get-Module -Name Az 来执行此操作(我们建议你安装最新版本的 PowerShell Az 模块)。You can do this by running the Get-Module -Name Az We recommend installing the latest version of the PowerShell Az module. 如果不熟悉 Azure PowerShell,请参阅 Azure PowerShell 概述If you're new to Azure PowerShell, see Azure PowerShell overview.

  2. 启动 PowerShell 会话。Start a PowerShell session.

  3. 在 PowerShell 中,输入 Connect-AzAccount -Environment AzureChinaCloud 命令以 UserA 的身份登录 Azure。In PowerShell, log in to Azure as UserA by entering the Connect-AzAccount -Environment AzureChinaCloud command. 用于登录的帐户必须拥有创建虚拟网络对等互连的必要权限。The account you log in with must have the necessary permissions to create a virtual network peering. 有关权限列表,请参阅虚拟网络对等互连权限For a list of permissions, see Virtual network peering permissions.

  4. 创建资源组和虚拟网络 A。将以下脚本复制到电脑的文本编辑器。Create a resource group and virtual network A. Copy the following script to a text editor on your PC. <SubscriptionA-Id> 替换为订阅 A 的 ID。Replace <SubscriptionA-Id> with the ID of SubscriptionA. 如果不知道订阅 ID,请输入 Get-AzSubscription 命令查看。If you don't know your subscription Id, enter the Get-AzSubscription command to view it. 返回的输出中的 Id 值就是订阅 ID。The value for Id in the returned output is your subscription ID. 若要执行该脚本,请复制修改后的脚本,将其粘贴到 PowerShell,按 EnterTo execute the script, copy the modified script, paste it in to PowerShell, and then press Enter.

    # Create a resource group.
    New-AzResourceGroup `
      -Name MyResourceGroupA `
      -Location chinaeast
    
    # Create virtual network A.
    $vNetA = New-AzVirtualNetwork `
      -ResourceGroupName MyResourceGroupA `
      -Name 'myVnetA' `
      -AddressPrefix '10.0.0.0/16' `
      -Location chinaeast
    
    # Assign UserB permissions to myVnetA.
    New-AzRoleAssignment `
      -SignInName UserB@azure.com `
      -RoleDefinitionName "Network Contributor" `
      -Scope /subscriptions/<SubscriptionA-Id>/resourceGroups/myResourceGroupA/providers/Microsoft.Network/VirtualNetworks/myVnetA
    
  5. 注销 UserA 的 Azure 登录,然后以 UserB 的身份登录。Log out UserA from Azure and log in UserB. 用于登录的帐户必须拥有创建虚拟网络对等互连的必要权限。The account you log in with must have the necessary permissions to create a virtual network peering. 有关权限列表,请参阅虚拟网络对等互连权限For a list of permissions, see Virtual network peering permissions.

  6. 将步骤 4 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 4 to a text editor on your PC. <SubscriptionA-Id> 替换为订阅 B 的 ID。将 10.0.0.0/16 更改为 10.1.0.0/16。Replace <SubscriptionA-Id> with the ID for subscription B. Change 10.0.0.0/16 to 10.1.0.0/16. 将所有 A 更改为 B,并将所有 B 更改为 A。若要执行该脚本,请复制修改后的脚本,将其粘贴到 PowerShell,然后按 EnterChange all As to B and all Bs to A. To execute the script, copy the modified script, paste into PowerShell, and then press Enter.

  7. 注销用户 B 的 Azure 登录,然后以用户 A 的身份登录。Log out UserB from Azure and log in UserA.

  8. 创建从 myVnetA 到 myVnetB 的对等互连。Create the peering from myVnetA to myVnetB. 将以下脚本复制到电脑上的文本编辑器。Copy the following script to a text editor on your PC. <SubscriptionB-Id> 替换为订阅 B 的 ID。若要执行该脚本,请复制修改后的脚本,将其粘贴到 PowerShell,然后按 EnterReplace <SubscriptionB-Id> with the ID of subscription B. To execute the script, copy the modified script, paste in to PowerShell, and then press Enter.

    # Peer myVnetA to myVnetB.
    $vNetA=Get-AzVirtualNetwork -Name myVnetA -ResourceGroupName myResourceGroupA
    Add-AzVirtualNetworkPeering `
      -Name 'myVnetAToMyVnetB' `
      -VirtualNetwork $vNetA `
      -RemoteVirtualNetworkId "/subscriptions/<SubscriptionB-Id>/resourceGroups/myResourceGroupB/providers/Microsoft.Network/virtualNetworks/myVnetB"
    
  9. 查看 myVnetA 的对等互连状态。View the peering state of myVnetA.

    Get-AzVirtualNetworkPeering `
      -ResourceGroupName myResourceGroupA `
      -VirtualNetworkName myVnetA `
      | Format-Table VirtualNetworkName, PeeringState
    

    状态为“已启动” 。The state is Initiated. 设置从 myVnetB 到 myVnetA 的对等互连后,状态即会变为“已连接” 。It changes to Connected once you set up the peering to myVnetA from myVnetB.

  10. 注销 UserA 的 Azure 登录,然后以 UserB 的身份登录。Log out UserA from Azure and log in UserB.

  11. 创建从 myVnetB 到 myVnetA 的对等互连。Create the peering from myVnetB to myVnetA. 将步骤 8 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 8 to a text editor on your PC. <SubscriptionB-Id> 替换为订阅 A 的 ID,并分别将所有 A 更改为 B,将所有 B 更改为 A。要执行该脚本,请复制修改后的脚本,将其粘贴到 PowerShell,然后按 EnterReplace <SubscriptionB-Id> with the ID of subscription A and change all As to B and all Bs to A. To execute the script, copy the modified script, paste it in to PowerShell, and then press Enter.

  12. 查看 myVnetB 的对等互连状态。View the peering state of myVnetB. 将步骤 9 中的脚本内容复制到电脑的文本编辑器。Copy the script contents in step 9 to a text editor on your PC. 将资源组和虚拟网络名称中的 A 更改为 B。Change A to B for the resource group and virtual network names. 若要执行该脚本,请将修改后的脚本粘贴到 PowerShell,按 EnterTo execute the script, paste the modified script into PowerShell, and then press Enter. 状态为“已连接” 。The state is Connected. 创建从 myVnetB 到 myVnetA 的对等互连后,myVnetA 的对等互连状态变为“已连接” 。The peering state of myVnetA changes to Connected after you've created the peering from myVnetB to myVnetA. 可以 UserA 的身份重新登录 Azure,并再次完成步骤 9,验证 myVnetA 的对等互连状态。You can log UserA back in to Azure and complete step 9 again to verify the peering state of myVnetA.

    Note

    直到两个虚拟网络的对等互连状态均为“已连接”时,对等互连才建立成功 。The peering is not established until the peering state is Connected for both virtual networks.

    在任一虚拟网络中创建的任何 Azure 资源现在都可通过其 IP 地址相互通信。Any Azure resources you create in either virtual network are now able to communicate with each other through their IP addresses. 如果为虚拟网络使用默认的 Azure 名称解析,则虚拟网络中的资源无法跨虚拟网络解析名称。If you're using default Azure name resolution for the virtual networks, the resources in the virtual networks are not able to resolve names across the virtual networks. 若要跨对等互连中的虚拟网络解析名称,必须创建自己的 DNS 服务器。If you want to resolve names across virtual networks in a peering, you must create your own DNS server. 了解如何使用自己的 DNS 服务器进行名称解析Learn how to set up Name resolution using your own DNS server.

  13. 可选:尽管本教程未介绍如何创建虚拟机,但可以在每个虚拟网络中创建一个虚拟机并将其相互连接,以验证连接性。Optional: Though creating virtual machines is not covered in this tutorial, you can create a virtual machine in each virtual network and connect from one virtual machine to the other, to validate connectivity.

  14. 可选:若要删除在本教程中创建的资源,请完成本文的删除资源中所述步骤。Optional: To delete the resources that you create in this tutorial, complete the steps in Delete resources in this article.

创建对等互连 - 资源管理器模板Create peering - Resource Manager template

  1. 若要创建虚拟网络并分配合适的权限,请完成本文中门户Azure CLIPowerShell 部分中所述的步骤。To create a virtual network and assign the appropriate permissions, complete the steps in the Portal, Azure CLI, or PowerShell sections of this article.

  2. 将下面的文本保存到本地计算机上的某个文件中。Save the text that follows to a file on your local computer. <subscription ID> 替换为用户 A 的订阅 ID。Replace <subscription ID> with UserA's subscription ID. 例如,可能会将文件另存为 vnetpeeringA.json。You might save the file as vnetpeeringA.json, for example.

    {
        "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
        "contentVersion": "1.0.0.0",
        "parameters": {
        },
        "variables": {
        },
        "resources": [
            {
            "apiVersion": "2016-06-01",
            "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
            "name": "myVnetA/myVnetAToMyVnetB",
            "location": "[resourceGroup().location]",
            "properties": {
            "allowVirtualNetworkAccess": true,
            "allowForwardedTraffic": false,
            "allowGatewayTransit": false,
            "useRemoteGateways": false,
                "remoteVirtualNetwork": {
                "id": "/subscriptions/<subscription ID>/resourceGroups/PeeringTest/providers/Microsoft.Network/virtualNetworks/myVnetB"
                }
            }
            }
        ]
     }
    
  3. 以用户 A 的身份登录 Azure,并使用门户PowerShellAzure CLI 来部署模板。Log in to Azure as UserA and deploy the template using the portal, PowerShell, or the Azure CLI. 指定在步骤 2 中用于保存示例 json 文本的文件的文件名。Specify the file name you saved the example json text in step 2 to.

  4. 将步骤 2 中的示例 json 复制到本地计算机上的某地文件中,并对如下开头的行进行更改:Copy the example json from step 2 to a file on your computer and make changes to the lines that begin with:

    • name:将 myVnetA/myVnetAToMyVnetB 更改为 myVnetB/myVnetBToMyVnetA 。name: Change myVnetA/myVnetAToMyVnetB to myVnetB/myVnetBToMyVnetA.
    • id:将 <subscription ID> 替换为用户 B 的订阅 ID,并将 myVnetB 更改为 myVnetA 。id: Replace <subscription ID> with UserB's subscription ID and change myVnetB to myVnetA.
  5. 再次完成步骤 3,以用户 B 的身份登录 Azure。Complete step 3 again, logged in to Azure as UserB.

  6. 可选:尽管本教程未介绍如何创建虚拟机,但可以在每个虚拟网络中创建一个虚拟机并将其相互连接,以验证连接性。Optional: Though creating virtual machines is not covered in this tutorial, you can create a virtual machine in each virtual network and connect from one virtual machine to the other, to validate connectivity.

  7. 可选:若要删除在本教程中创建的资源,请使用 Azure 门户、PowerShell 或 Azure CLI 完成本文的删除资源部分中所述的步骤。Optional: To delete the resources that you create in this tutorial, complete the steps in the Delete resources section of this article, using either the Azure portal, PowerShell, or the Azure CLI.

删除资源Delete resources

完成本教程后,可能需要删除本教程中创建的资源,以免产生使用费。When you've finished this tutorial, you might want to delete the resources you created in the tutorial, so you don't incur usage charges. 删除资源组会删除其中包含的所有资源。Deleting a resource group also deletes all resources that are in the resource group.

Azure 门户Azure portal

  1. 以 UserA 的身份登录 Azure 门户。Log in to the Azure portal as UserA.
  2. 在门户的搜索框中,输入 myResourceGroupAIn the portal search box, enter myResourceGroupA. 在搜索结果中,选择“myResourceGroupA” 。In the search results, select myResourceGroupA.
  3. 选择“删除” 。Select Delete.
  4. 若要确认删除,请在“键入资源组名称”框中输入“myResourceGroupA”,然后选择“删除” 。To confirm the deletion, in the TYPE THE RESOURCE GROUP NAME box, enter myResourceGroupA, and then select Delete.
  5. 注销 UserA 的门户登录,然后以 UserB 的身份登录。Log out of the portal as UserA and log in as UserB.
  6. 完成 myResourceGroupB 的步骤 2-4.Complete steps 2-4 for myResourceGroupB.

Azure CLIAzure CLI

  1. 以 UserA 的身份登录 Azure,并执行以下命令:Log in to Azure as UserA and execute the following command:

    az group delete --name myResourceGroupA --yes
    
  2. 注销 UserA 的 Azure 登录,然后以 UserB 的身份登录。Log out of Azure as UserA and log in as UserB.

  3. 运行以下命令:Execute the following command:

    az group delete --name myResourceGroupB --yes
    

PowerShellPowerShell

  1. 以 UserA 的身份登录 Azure,并执行以下命令:Log in to Azure as UserA and execute the following command:

    Remove-AzResourceGroup -Name myResourceGroupA -force
    
  2. 注销 UserA 的 Azure 登录,然后以 UserB 的身份登录。Log out of Azure as UserA and log in as UserB.

  3. 运行以下命令:Execute the following command:

    Remove-AzResourceGroup -Name myResourceGroupB -force
    

后续步骤Next steps