Azure 服务的虚拟网络集成Virtual network integration for Azure services

通过将 Azure 服务集成到 Azure 虚拟网络,可从虚拟机或虚拟网络中的计算资源私密访问服务。Integrating Azure services to an Azure virtual network enables private access to the service from virtual machines or compute resources in the virtual network. 可通过以下选项在虚拟网络中集成 Azure 服务:You can integrate Azure services in your virtual network with the following options:

  • 将服务的专用实例部署到虚拟网络中。Deploying dedicated instances of the service into a virtual network. 随后即可在虚拟网络内以及从本地网络私密访问这些服务。The services can then be privately accessed within the virtual network and from on-premises networks.
  • 通过服务终结点将虚拟网络扩展到服务。Extending a virtual network to the service, through service endpoints. 服务终结点可使单个服务资源在虚拟网络中得到保护。Service endpoints allow individual service resources to be secured to the virtual network.

若要将多个 Azure 服务集成到虚拟网络,可组合一种或多种上述模式。To integrate multiple Azure services to your virtual network, you can combine one or more of the above patterns. 例如,可将 HDInsight 部署到虚拟网络中,并通过服务终结点保护该 HDInsight 子网的存储帐户。For example, you can deploy HDInsight into your virtual network and secure a storage account to the HDInsight subnet through Service endpoints.

将 Azure 服务部署到虚拟网络Deploy Azure services into virtual networks

虚拟网络中部署专用 Azure 服务时,可通过专用 IP 地址与服务资源进行私密通信。When you deploy dedicated Azure services in a virtual network, you can communicate with the service resources privately, through private IP addresses.

虚拟网络中部署的服务

在虚拟网络中部署服务可提供以下功能:Deploying services within a virtual network provides the following capabilities:

  • 虚拟网络内的资源可以通过专用 IP 地址彼此进行私密通信。Resources within the virtual network can communicate with each other privately, through private IP addresses. 例如,在虚拟网络中,在虚拟机上运行的 HDInsight 与 SQL Server 之间可直接传输数据。Example, directly transferring data between HDInsight and SQL Server running on a virtual machine, in the virtual network.
  • 本地资源可通过站点到站点 VPN(VPN 网关)ExpressRoute 使用专用 IP 地址访问虚拟网络中的资源。On-premises resources can access resources in a virtual network using private IP addresses over a Site-to-Site VPN (VPN Gateway) or ExpressRoute.
  • 虚拟网络可使用专用 IP 地址进行对等互连,实现虚拟网络中资源之间的彼此通信。Virtual networks can be peered to enable resources in the virtual networks to communicate with each other, using private IP addresses.
  • 虚拟网络中的服务实例由 Azure 服务完全托管,用于监视实例的运行状况并根据负载提供所需规模。Service instances in a virtual network are fully managed by the Azure service, to monitor health of the instances, and provide required scale, based on load.
  • 服务实例部署在虚拟网络的子网中。Service instances are deployed into a subnet in a virtual network. 根据服务提供的指南,必须通过网络安全组对子网开放入站和出站网络访问。Inbound and outbound network access must be opened through network security groups for the subnet, per guidance provided by the services.
  • (可选)服务可能需要一个委派子网作为显式标识符,用于表示子网可承载特定服务。Optionally, services might require a delegated subnet as an explicit identifier that a subnet can host a particular service. 子网委派为服务提供了显式权限,以便在子网中创建服务专属资源。Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet.

可部署到虚拟网络中的服务Services that can be deployed into a virtual network

类别Category 服务Service
计算Compute 虚拟机:LinuxWindowsVirtual machines: Linux or Windows
虚拟机规模集Virtual machine scale sets
云服务:仅限虚拟网络(经典)Cloud Service: Virtual network (classic) only
Azure BatchAzure Batch
网络Network 应用程序网关 - WAFApplication Gateway - WAF
VPN 网关VPN Gateway
网络虚拟设备Network Virtual Appliances
数据Data RedisCacheRedisCache
Azure SQL 数据库托管实例Azure SQL Database Managed Instance
分析Analytics Azure HDInsightAzure HDInsight
WebWeb API 管理API Management
应用服务环境App Service Environment

Azure 服务的服务终结点Service endpoints for Azure services

某些 Azure 服务无法部署在虚拟网络中。Some Azure services can't be deployed in virtual networks. 可选择通过启用虚拟网络服务终结点,将某些服务资源的访问限制为仅特定虚拟网络子网。You can restrict access to some of the service resources to only specific virtual network subnets, if you choose, by enabling a virtual network service endpoint. 详细了解虚拟网络服务终结点,以及可以为终结点启用的服务。Learn more about virtual network service endpoints, and the services that endpoints can be enabled for.