添加、更改或删除虚拟网络子网Add, change, or delete a virtual network subnet

了解如何添加、更改或删除虚拟网络子网。Learn how to add, change, or delete a virtual network subnet. 部署到虚拟网络的所有 Azure 资源都将部署到虚拟网络内的子网中。All Azure resources deployed into a virtual network are deployed into a subnet within a virtual network. 如果不熟悉虚拟网络,可在虚拟网络概述中或通过完成入门了解相关详细信息。If you're new to virtual networks, you can learn more about them in the Virtual network overview or by completing a quickstart. 若要详细了解管理虚拟网络,请参阅创建、更改或删除虚拟网络To learn more about managing a virtual network, see Create, change, or delete a virtual network.

准备阶段Before you begin

如果你没有 Azure 帐户,请使用有效的订阅设置一个帐户。If you don't have one, set up an Azure account with an active subscription. 免费创建帐户Create an account for free. 然后在开始执行本文任一部分中的步骤之前完成以下任务之一:Then complete one of these tasks before starting steps in any section of this article:

  • 门户用户:使用 Azure 帐户登录到 Azure 门户Portal users: Sign in to the Azure portal with your Azure account.

  • PowerShell 用户PowerShell users:

    如果在本地运行 PowerShell,请使用 Azure PowerShell 模块 1.0.0 或更高版本。When you're running PowerShell locally, use Azure PowerShell module version 1.0.0 or later. 运行 Get-Module -ListAvailable Az.Network 查找已安装的版本。Run Get-Module -ListAvailable Az.Network to find the installed version. 如果需要进行升级,请参阅 Install Azure PowerShell module(安装 Azure PowerShell 模块)。If you need to upgrade, see Install Azure PowerShell module. 另请运行 Connect-AzAccount -Environment AzureChinaCloud 以创建与 Azure 的连接。Also run Connect-AzAccount -Environment AzureChinaCloud to create a connection with Azure.

  • Azure 命令行接口 (CLI) 用户Azure Command-line interface (CLI) users:

    在计算机中运行 CLI。Run the CLI from your computer. 使用 Azure CLI 版本 2.0.31 或更高版本。Use Azure CLI version 2.0.31 or later. 运行 az --version 查找已安装的版本。Run az --version to find the installed version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI. 另请运行 az login 以创建与 Azure 的连接。Also run az login to create a connection with Azure.

登录或连接到 Azure 所用的帐户必须分配有网络参与者角色角色或者分配有可执行权限中列出的适当操作的自定义角色The account you sign in to, or connect to Azure with, must be assigned to the Network contributor role role or to a Custom role that's assigned the appropriate actions listed in Permissions.

添加子网Add a subnet

  1. 转到 Azure 门户来查看虚拟网络。Go to the Azure portal to view your virtual networks. 搜索并选择“虚拟网络”。****Search for and select Virtual networks.

  2. 选择要将子网添加到的虚拟网络的名称。Select the name of the virtual network you want to add a subnet to.

  3. 在“设置”中,选择“子网” > “子网”**** **** ****。From Settings, select Subnets > Subnet.

  4. 在“添加子网”对话框中,输入以下设置的值****:In the Add subnet dialog box, enter values for the following settings:

    设置Setting 说明Description
    名称Name 名称在虚拟网络中必须唯一。The name must be unique within the virtual network. 为了最大程度地兼容其他 Azure 服务,我们建议使用字母作为名称的第一个字符。For maximum compatibility with other Azure services, we recommend using a letter as the first character of the name. 例如,Azure 应用程序网关不会部署到名称以数字开头的子网中。For example, Azure Application Gateway won't deploy into a subnet that has a name that starts with a number.
    地址范围Address range

    此范围在虚拟网络的地址空间中必须唯一。The range must be unique within the address space for the virtual network. 此范围不能与虚拟网络中的其他子网地址范围重叠。The range can't overlap with other subnet address ranges within the virtual network. 必须使用无类域间路由 (CIDR) 表示法指定地址空间。The address space must be specified by using Classless Inter-Domain Routing (CIDR) notation.

    例如,在地址空间为 10.0.0.0/16 的虚拟网络中,可将子网地址空间定义为 10.0.0.0/22** **。For example, in a virtual network with address space 10.0.0.0/16, you might define a subnet address space of 10.0.0.0/22. 可以指定的最小范围为 /29,为子网提供八个 IP 地址**。The smallest range you can specify is /29, which provides eight IP addresses for the subnet. Azure 保留每个子网中的第一个地址和最后一个地址,以确保协议一致性。Azure reserves the first and last address in each subnet for protocol conformance. 此外还会保留三个地址供 Azure 服务使用。Three additional addresses are reserved for Azure service usage. 因此,使用 /29 地址范围定义子网时,子网中会有三个可用 IP 地址**。As a result, defining a subnet with a /29 address range results in three usable IP addresses in the subnet.

    如果打算将虚拟网络连接到 VPN 网关,必须创建一个网关子网。If you plan to connect a virtual network to a VPN gateway, you must create a gateway subnet. 详细了解网关子网地址范围具体考虑事项Learn more about specific address range considerations for gateway subnets. 在特定条件下,可在添加子网后更改地址范围。You can change the address range after the subnet is added, under specific conditions. 若要了解有关如何更改子网地址范围的相关信息,请参阅更改子网设置To learn how to change a subnet address range, see Change subnet settings.

    网络安全组Network security group 要筛选子网的入站和出站网络流量,可将现有网络安全组关联到子网。To filter inbound and outbound network traffic for the subnet, you may associate an existing network security group to a subnet. 网络安全组必须与虚拟网络位于同一订阅和位置中。The network security group must exist in the same subscription and location as the virtual network. 若要详细了解网络安全组,请参阅如何创建网络安全组Learn more about network security groups and how to create a network security group.
    路由表Route table 要控制通往其他网络的网络流量路由,可以选择将现有路由表关联到子网。To control network traffic routing to other networks, you may optionally associate an existing route table to a subnet. 路由表必须与虚拟网络位于同一订阅和位置中。The route table must exist in the same subscription and location as the virtual network. 详细了解 Azure 路由如何创建路由表Learn more about Azure routing and how to create a route table.
    服务终结点Service endpoints

    子网可以选择为其启用一个或多个服务终结点。A subnet may optionally have one or more service endpoints enabled for it. 若要启用的服务的服务终结点,选择的服务或服务,想要启用服务终结点从服务列表。To enable a service endpoint for a service, select the service or services that you want to enable service endpoints for from the Services list. Azure 会自动配置终结点的位置。Azure configures the location automatically for an endpoint. 默认情况下,Azure 会为虚拟网络所在的区域配置服务终结点。By default, Azure configures the service endpoints for the virtual network's region. 为了支持区域故障转移方案,Azure 会将终结点自动配置到 Azure 存储的 Azure 配对区域。To support regional failover scenarios, Azure automatically configures endpoints to Azure paired regions for Azure Storage.

    若要删除的服务终结点,请取消选择你想要删除的服务终结点的服务。To remove a service endpoint, unselect the service you want to remove the service endpoint for. 如需详细了解服务终结点以及可为其启用的服务,请参阅虚拟网络服务终结点To learn more about service endpoints, and the services they can be enabled for, see Virtual network service endpoints. 一旦启用服务的服务终结点,还必须启用与服务创建的资源的子网的网络访问权限。Once you enable a service endpoint for a service, you must also enable network access for the subnet for a resource created with the service. 例如,如果启用的服务终结点Microsoft.Storage,还必须启用到你想要授予对网络访问权限的所有 Azure 存储帐户的网络访问权限。For example, if you enable the service endpoint for Microsoft.Storage, you must also enable network access to all Azure Storage accounts you want to grant network access to. 要启用到为启用服务终结点的子网的网络访问,请参阅各个启用的服务终结点的服务的文档。To enable network access to subnets that a service endpoint is enabled for, see the documentation for the individual service you enabled the service endpoint for.

    要验证是否为某个子网启用了服务终结点,请查看有效路由,获取该子网中的任何网络接口。To validate that a service endpoint is enabled for a subnet, view the effective routes for any network interface in the subnet. 配置终结点时,你将会看到服务地址前缀和下一跃点类型为“VirtualNetworkServiceEndpoint”的“默认”路由******。When you configure an endpoint, you see a default route with the address prefixes of the service, and a next hop type of VirtualNetworkServiceEndpoint. 若要详细了解路由,请参阅虚拟网络流量路由To learn more about routing, see Virtual network traffic routing.

    子网委派Subnet delegation 子网可以选择为其启用一个或多个委派。A subnet may optionally have one or more delegations enabled for it. 子网委派为服务提供了显式权限,以便能够在服务部署期间使用唯一标识符在子网中创建服务专属资源。Subnet delegation gives explicit permissions to the service to create service-specific resources in the subnet using a unique identifier during service deployment. 若要向服务委派,请从“服务”**** 列表中选择要委派给的服务。To delegate for a service, select the service you want to delegate to from the Services list.
  5. 单击“确定”,将子网添加到所选的虚拟网络。****To add the subnet to the virtual network that you selected, select OK.

命令Commands

工具Tool 命令Command
Azure CLIAzure CLI az network vnet subnet createaz network vnet subnet create
PowerShellPowerShell Add-AzVirtualNetworkSubnetConfigAdd-AzVirtualNetworkSubnetConfig

更改子网设置Change subnet settings

  1. 转到 Azure 门户来查看虚拟网络。Go to the Azure portal to view your virtual networks. 搜索并选择“虚拟网络”。****Search for and select Virtual networks.

  2. 选择包含要更改的子网的虚拟网络的名称。Select the name of the virtual network containing the subnet you want to change.

  3. 从“设置”中选择“子网”**** ****。From Settings, select Subnets.

  4. 在子网的列表中,选择想要更改设置的子网。In the list of subnets, select the subnet you want to change settings for.

  5. 在“子网”页中,更改以下任意设置:In the subnet page, change any of the following settings:

    设置Setting 说明Description
    地址范围Address range 如果没有资源部署在子网内,可以更改地址范围。If no resources are deployed within the subnet, you can change the address range. 如果子网中存在的任何资源,必须将资源移到另一个子网,或从子网中先删除它们。If any resources exist in the subnet, you must either move the resources to another subnet, or delete them from the subnet first. 删除资源所采取的步骤因资源而异。The steps you take to move or delete a resource vary depending on the resource. 若要了解如何删除子网中的资源,请阅读其中每个资源类型的文档。To learn how to move or delete resources that are in subnets, read the documentation for each of those resource types. 请参阅添加子网步骤 4 中的地址范围约束。See the constraints for Address range in step 4 of Add a subnet.
    用户Users 可以使用内置角色或自己的自定义角色控制对子网的访问。You can control access to the subnet by using built-in roles or your own custom roles. 若要详细了解如何分配访问子网的角色和用户,请参阅添加角色分配To learn more about assigning roles and users to access the subnet, see Add a role assignment.
    网络安全组路由表Network security group and Route table 请参阅添加子网的步骤 4。See step 4 of Add a subnet.
    服务终结点Service endpoints

    请参阅添加子网的步骤 4 中的服务终结点。See service endpoints in step 4 of Add a subnet. 如果为某个现有子网启用服务终结点,请确保该子网的任何资源上未运行任何关键任务。When enabling a service endpoint for an existing subnet, ensure that no critical tasks are running on any resource in the subnet. 服务终结点在子网中的每个网络接口上切换路由。Service endpoints switch routes on every network interface in the subnet. 服务终结点从使用地址前缀为 0.0.0.0/0 且下一跃点类型为 Internet 的默认路由,转到使用服务地址前缀且下一跃点类型为 VirtualNetworkServiceEndpoint 的新路由** ** **。The service endpoints go from using the default route with the 0.0.0.0/0 address prefix and next hop type of Internet, to using a new route with the address prefixes of the service and a next hop type of VirtualNetworkServiceEndpoint.

    切换过程中,可能会终止任何打开的 TCP 连接。During the switch, any open TCP connections may be terminated. 对于使用新路由更新的所有网络接口,除非流量流向服务,否则不会启用服务终结点。The service endpoint isn't enabled until traffic flows to the service for all network interfaces are updated with the new route. 若要详细了解路由,请参阅虚拟网络流量路由To learn more about routing, see Virtual network traffic routing.

    子网委派Subnet delegation 请参阅添加子网的步骤 4 中的服务终结点。See service endpoints in step 4 of Add a subnet. 可以将子网委派修改为,为子网启用零到多个委派。Subnet delegation can be modified to zero or multiple delegations enabled for it. 如果已在子网中部署服务的资源,只有在删除服务的所有资源后,才能添加或删除子网委派。If a resource for a service is already deployed in the subnet, subnet delegation can't be added or removed until all the resources for the service are removed. 若要向其他服务委派,请从“服务”**** 列表中选择要委派给的服务。To delegate for a different service, select the service you want to delegate to from the Services list.
  6. 选择“保存” ****。Select Save.

命令Commands

工具Tool 命令Command
Azure CLIAzure CLI az network vnet subnet updateaz network vnet subnet update
PowerShellPowerShell Set-AzVirtualNetworkSubnetConfigSet-AzVirtualNetworkSubnetConfig

删除子网Delete a subnet

仅当子网中无任何资源时,才可删除该子网。You can delete a subnet only if there are no resources in the subnet. 如果子网中存在资源,则必须先删除这些资源,才能删除该子网。If resources are in the subnet, you must delete those resources before you can delete the subnet. 删除资源所采取的步骤因资源而异。The steps you take to delete a resource vary depending on the resource. 若要了解如何删除子网中的资源,请阅读其中每个资源类型的文档。To learn how to delete resources that are in subnets, read the documentation for each of those resource types.

  1. 转到 Azure 门户来查看虚拟网络。Go to the Azure portal to view your virtual networks. 搜索并选择“虚拟网络”。****Search for and select Virtual networks.

  2. 选择包含要删除的子网的虚拟网络的名称。Select the name of the virtual network containing the subnet you want to delete.

  3. 从“设置”中选择“子网”**** ****。From Settings, select Subnets.

  4. 在子网的列表中,选择想要删除的子网。In the list of subnets, select the subnet you want to delete.

  5. 选择“删除”,然后在确认对话框中选择“是”。**** ****Select Delete, and then select Yes in the confirmation dialog box.

命令Commands

工具Tool 命令Command
Azure CLIAzure CLI az network vnet subnet deleteaz network vnet subnet delete
PowerShellPowerShell Remove-AzVirtualNetworkSubnetConfigRemove-AzVirtualNetworkSubnetConfig

权限Permissions

若要在子网中执行任务,必须将帐户分配到网络参与者角色或分配到下表中的适当操作的自定义角色:To do tasks on subnets, your account must be assigned to the Network contributor role or to a Custom role that's assigned the appropriate actions in the following table:

操作Action 名称Name
Microsoft.Network/virtualNetworks/subnets/readMicrosoft.Network/virtualNetworks/subnets/read 读取虚拟网络子网Read a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/writeMicrosoft.Network/virtualNetworks/subnets/write 创建或更新虚拟网络子网Create or update a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/deleteMicrosoft.Network/virtualNetworks/subnets/delete 删除虚拟网络子网Delete a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/join/actionMicrosoft.Network/virtualNetworks/subnets/join/action 加入虚拟网络Join a virtual network
Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/actionMicrosoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action 为子网启用服务终结点Enable a service endpoint for a subnet
Microsoft.Network/virtualNetworks/subnets/virtualMachines/readMicrosoft.Network/virtualNetworks/subnets/virtualMachines/read 获取子网中的虚拟机Get the virtual machines in a subnet

后续步骤Next steps