通过 PowerShell 使用虚拟网络对等互连连接虚拟网络Connect virtual networks with virtual network peering using PowerShell

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

可以使用虚拟网络对等互连将虚拟网络互相连接。You can connect virtual networks to each other with virtual network peering. 将虚拟网络对等互连后,两个虚拟网络中的资源将能够以相同的延迟和带宽相互通信,就像这些资源位于同一个虚拟网络中一样。Once virtual networks are peered, resources in both virtual networks are able to communicate with each other, with the same latency and bandwidth as if the resources were in the same virtual network. 在本文中,学习如何:In this article, you learn how to:

  • 创建两个虚拟网络Create two virtual networks
  • 使用虚拟网络对等互连连接两个虚拟网络。Connect two virtual networks with a virtual network peering
  • 将虚拟机 (VM) 部署到每个虚拟网络Deploy a virtual machine (VM) into each virtual network
  • VM 之间进行通信Communicate between VMs

如果没有 Azure 订阅,可在开始前创建一个试用帐户If you don't have an Azure subscription, create a trial account before you begin.

如果选择在本地安装和使用 PowerShell,则本文需要 Azure PowerShell 模块 1.0.0 或更高版本。If you choose to install and use PowerShell locally, this article requires the Azure PowerShell module version 1.0.0 or later. 运行 Get-Module -ListAvailable Az 查找已安装的版本。Run Get-Module -ListAvailable Az to find the installed version. 如果需要进行升级,请参阅 Install Azure PowerShell module(安装 Azure PowerShell 模块)。If you need to upgrade, see Install Azure PowerShell module. 如果在本地运行 PowerShell,则还需运行 Connect-AzAccount -Environment AzureChinaCloud 来创建与 Azure 的连接。If you are running PowerShell locally, you also need to run Connect-AzAccount -Environment AzureChinaCloud to create a connection with Azure.

创建虚拟网络Create virtual networks

创建虚拟网络之前,必须为虚拟网络创建资源组以及本文中创建的所有其他资源。Before creating a virtual network, you have to create a resource group for the virtual network, and all other resources created in this article. 使用 New-AzResourceGroup 创建资源组。Create a resource group with New-AzResourceGroup. 以下示例在“chinaeast”位置创建名为“myResourceGroup”的资源组。The following example creates a resource group named myResourceGroup in the chinaeast location.

Connect-AzAccount -Environment AzureChinaCloud
New-AzResourceGroup -ResourceGroupName myResourceGroup -Location ChinaEast

使用 New-AzVirtualNetwork 创建虚拟网络。Create a virtual network with New-AzVirtualNetwork. 以下示例创建地址前缀为 10.0.0.0/16 且名为 myVirtualNetwork1 的虚拟网络。The following example creates a virtual network named myVirtualNetwork1 with the address prefix 10.0.0.0/16.

$virtualNetwork1 = New-AzVirtualNetwork `
  -ResourceGroupName myResourceGroup `
  -Location ChinaEast `
  -Name myVirtualNetwork1 `
  -AddressPrefix 10.0.0.0/16

使用 New-AzVirtualNetworkSubnetConfig 创建子网配置。Create a subnet configuration with New-AzVirtualNetworkSubnetConfig. 以下示例创建地址前缀为 10.0.0.0/24 的子网配置:The following example creates a subnet configuration with a 10.0.0.0/24 address prefix:

$subnetConfig = Add-AzVirtualNetworkSubnetConfig `
  -Name Subnet1 `
  -AddressPrefix 10.0.0.0/24 `
  -VirtualNetwork $virtualNetwork1

使用 Set-AzVirtualNetwork 将子网配置写入虚拟网络,从而创建子网:Write the subnet configuration to the virtual network with Set-AzVirtualNetwork, which creates the subnet:

$virtualNetwork1 | Set-AzVirtualNetwork

创建地址前缀为 10.1.0.0/16 的虚拟网络和一个子网:Create a virtual network with a 10.1.0.0/16 address prefix and one subnet:

# Create the virtual network.
$virtualNetwork2 = New-AzVirtualNetwork `
  -ResourceGroupName myResourceGroup `
  -Location ChinaEast `
  -Name myVirtualNetwork2 `
  -AddressPrefix 10.1.0.0/16

# Create the subnet configuration.
$subnetConfig = Add-AzVirtualNetworkSubnetConfig `
  -Name Subnet1 `
  -AddressPrefix 10.1.0.0/24 `
  -VirtualNetwork $virtualNetwork2

# Write the subnet configuration to the virtual network.
$virtualNetwork2 | Set-AzVirtualNetwork

将虚拟网络对等互连Peer virtual networks

使用 Add-AzVirtualNetworkPeering 创建对等互连。Create a peering with Add-AzVirtualNetworkPeering. 以下示例将 myVirtualNetwork1 对等互连到 myVirtualNetwork2The following example peers myVirtualNetwork1 to myVirtualNetwork2.

Add-AzVirtualNetworkPeering `
  -Name myVirtualNetwork1-myVirtualNetwork2 `
  -VirtualNetwork $virtualNetwork1 `
  -RemoteVirtualNetworkId $virtualNetwork2.Id

在上一个命令执行后返回的输出中,可以看到 PeeringStateInitiatedIn the output returned after the previous command executes, you see that the PeeringState is Initiated. 对等互连将保持 Initiated 状态,直到你创建从 myVirtualNetwork2myVirtualNetwork1 的对等互连。The peering remains in the Initiated state until you create the peering from myVirtualNetwork2 to myVirtualNetwork1. 创建从 myVirtualNetwork2myVirtualNetwork1 的对等互连。Create a peering from myVirtualNetwork2 to myVirtualNetwork1.

Add-AzVirtualNetworkPeering `
  -Name myVirtualNetwork2-myVirtualNetwork1 `
  -VirtualNetwork $virtualNetwork2 `
  -RemoteVirtualNetworkId $virtualNetwork1.Id

在上一个命令执行后返回的输出中,可以看到 peeringStateConnectedIn the output returned after the previous command executes, you see that the PeeringState is Connected. Azure 还将 myVirtualNetwork1-myVirtualNetwork2 对等互连的对等互连状态更改为 ConnectedAzure also changed the peering state of the myVirtualNetwork1-myVirtualNetwork2 peering to Connected. 使用 Get-AzVirtualNetworkPeering 确认 myVirtualNetwork1-myVirtualNetwork2 对等互连的对等互连状态是否已更改为“Connected”。Confirm that the peering state for the myVirtualNetwork1-myVirtualNetwork2 peering changed to Connected with Get-AzVirtualNetworkPeering.

Get-AzVirtualNetworkPeering `
  -ResourceGroupName myResourceGroup `
  -VirtualNetworkName myVirtualNetwork1 `
  | Select PeeringState

在两个虚拟网络中的对等互连的 PeeringStateConnected 之前,在一个虚拟网络中的资源无法与另一个虚拟网络中的资源通信。Resources in one virtual network cannot communicate with resources in the other virtual network until the PeeringState for the peerings in both virtual networks is Connected.

创建虚拟机Create virtual machines

在稍后的步骤中,会在每个虚拟网络中创建一个 VM,以便可以在它们之间进行通信。Create a VM in each virtual network so that you can communicate between them in a later step.

创建第一个 VMCreate the first VM

使用 New-AzVM 创建 VM。Create a VM with New-AzVM. 以下示例在 myVirtualNetwork1 虚拟网络中创建一个名为 myVm1 的 VM。The following example creates a VM named myVm1 in the myVirtualNetwork1 virtual network. -AsJob 选项会在后台创建 VM,因此可继续执行下一步。The -AsJob option creates the VM in the background, so you can continue to the next step. 系统提示时,请输入想要用来登录到 VM 的用户名和密码。When prompted, enter the user name and password you want to log in to the VM with.

New-AzVm `
  -ResourceGroupName "myResourceGroup" `
  -Location "China East" `
  -VirtualNetworkName "myVirtualNetwork1" `
  -SubnetName "Subnet1" `
  -ImageName "Win2016Datacenter" `
  -Name "myVm1" `
  -Size "Standard_A1" `
  -AsJob

创建第二个 VMCreate the second VM

New-AzVm `
  -ResourceGroupName "myResourceGroup" `
  -Location "China East" `
  -VirtualNetworkName "myVirtualNetwork2" `
  -SubnetName "Subnet1" `
  -ImageName "Win2016Datacenter" `
  -Size "Standard_A1" `
  -Name "myVm2"

创建 VM 需要几分钟时间。The VM takes a few minutes to create. 在 Azure 创建 VM 并将输出返回到 PowerShell 之前,不要继续执行后续步骤。Do not continue with later steps until Azure creates the VM and returns output to PowerShell.

VM 之间进行通信Communicate between VMs

可以从 Internet 连接到 VM 的公共 IP 地址。You can connect to a VM's public IP address from the internet. 使用 Get-AzPublicIpAddress 返回 VM 的公共 IP 地址。Use Get-AzPublicIpAddress to return the public IP address of a VM. 以下示例返回 myVm1 VM 的公共 IP 地址 :The following example returns the public IP address of the myVm1 VM:

Get-AzPublicIpAddress `
  -Name myVm1 `
  -ResourceGroupName myResourceGroup | Select IpAddress

从本地计算机使用以下命令创建与 myVm1 VM 的远程桌面会话 。Use the following command to create a remote desktop session with the myVm1 VM from your local computer. <publicIpAddress> 替换为上一命令返回的 IP 地址。Replace <publicIpAddress> with the IP address returned from the previous command.

mstsc /v:<publicIpAddress>

此时会创建远程桌面协议 (.rdp) 文件,并下载到计算机,同时打开该文件。A Remote Desktop Protocol (.rdp) file is created, downloaded to your computer, and opened. 输入用户名和密码(可能需要选择“更多选择”,然后选择“使用其他帐户”,以便指定在创建 VM 时输入的凭据),然后单击“确定”。 Enter the user name and password (you may need to select More choices, then Use a different account, to specify the credentials you entered when you created the VM), and then click OK. 你可能会在登录过程中收到证书警告。You may receive a certificate warning during the sign-in process. 单击“是”或“继续”继续进行连接。 Click Yes or Continue to proceed with the connection.

myVm1 VM 上,允许 Internet 控制消息协议 (ICMP) 通过 Windows 防火墙,以便在稍后的步骤中使用 PowerShell 从 myVm2 ping 此 VM:On the myVm1 VM, enable the Internet Control Message Protocol (ICMP) through the Windows firewall so you can ping this VM from myVm2 in a later step, using PowerShell:

New-NetFirewallRule -DisplayName "Allow ICMPv4-In" -Protocol ICMPv4

虽然本文中使用 ping 在 VM 之间进行通信,但在进行生产部署时,不建议允许 ICMP 通过 Windows 防火墙。Though ping is used to communicate between VMs in this article, allowing ICMP through the Windows Firewall for production deployments is not recommended.

若要连接到 myVm2 VM,请在 myVm1 VM 上通过命令提示符输入以下命令:To connect to the myVm2 VM, enter the following command from a command prompt on the myVm1 VM:

mstsc /v:10.1.0.4

由于已在 myVm1 上启用了 ping,因此,现在可以在 myVm2 VM 上通过命令提示符按 IP 地址对它执行 ping 操作:Since you enabled ping on myVm1, you can now ping it by IP address from a command prompt on the myVm2 VM:

ping 10.0.0.4

会收到四条回复。You receive four replies. 断开到 myVm1myVm2 的 RDP 会话。Disconnect your RDP sessions to both myVm1 and myVm2.

清理资源Clean up resources

如果不再需要资源组及其包含的所有资源,请使用 Remove-AzResourcegroup 将其删除。When no longer needed, use Remove-AzResourcegroup to remove the resource group and all of the resources it contains.

Remove-AzResourceGroup -Name myResourceGroup -Force

后续步骤Next steps

在本文中,你已学习了如何使用虚拟网络对等互连来连接同一 Azure 区域中的两个网络。In this article, you learned how to connect two networks in the same Azure region, with virtual network peering. 还可以将不同的受支持区域不同的 Azure 订阅中的虚拟网络对等互连。You can also peer virtual networks in different supported regions and in different Azure subscriptions. 若要详细了解虚拟网络对等互连,请参阅虚拟网络对等互连概述管理虚拟网络对等互连To learn more about virtual network peering, see Virtual network peering overview and Manage virtual network peerings.

可以通过 VPN 将自己的计算机连接到虚拟网络,并可与虚拟网络或对等虚拟网络中的资源进行交互。You can connect your own computer to a virtual network through a VPN, and interact with resources in a virtual network, or in peered virtual networks. 有关用来完成虚拟网络文章中涉及的许多任务的可重用脚本,请参阅脚本示例For reusable scripts to complete many of the tasks covered in the virtual network articles, see script samples.