添加、更改或删除虚拟网络子网Add, change, or delete a virtual network subnet

了解如何添加、更改或删除虚拟网络子网。Learn how to add, change, or delete a virtual network subnet. 部署到虚拟网络的所有 Azure 资源都将部署到虚拟网络内的子网中。All Azure resources deployed into a virtual network are deployed into a subnet within a virtual network. 如果不熟悉虚拟网络,可在虚拟网络概述中或通过完成教程了解相关详细信息。If you're new to virtual networks, you can learn more about them in the Virtual network overview or by completing a tutorial. 若要创建、更改或删除虚拟网络,请参阅管理虚拟网络To create, change, or delete a virtual network, see Manage a virtual network.

准备阶段Before you begin

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

在完成本文任何部分中的步骤之前,请完成以下任务:Complete the following tasks before completing steps in any section of this article:

  • 如果还没有 Azure 帐户,请注册试用帐户If you don't already have an Azure account, sign up for a trial account.
  • 如果使用门户,请打开 https://portal.azure.cn,并使用 Azure 帐户登录。If using the portal, open https://portal.azure.cn, and log in with your Azure account.
  • 如果使用 PowerShell 命令来完成本文中的任务,请从计算机运行 PowerShell。If using PowerShell commands to complete tasks in this article, by running PowerShell from your computer. 本教程需要 Azure PowerShell 模块 1.0.0 或更高版本。This tutorial requires the Azure PowerShell module version 1.0.0 or later. 运行 Get-Module -ListAvailable Az 查找已安装的版本。Run Get-Module -ListAvailable Az to find the installed version. 如果需要进行升级,请参阅 Install Azure PowerShell module(安装 Azure PowerShell 模块)。If you need to upgrade, see Install Azure PowerShell module. 如果在本地运行 PowerShell,则还需运行 Connect-AzAccount -Environment AzureChinaCloud 来创建与 Azure 的连接。If you are running PowerShell locally, you also need to run Connect-AzAccount -Environment AzureChinaCloud to create a connection with Azure.
  • 如果使用 Azure 命令行界面 (CLI) 命令来完成本文中的任务,请从计算机运行 CLI。If using Azure Command-line interface (CLI) commands to complete tasks in this article, by running the CLI from your computer. 本教程需要 Azure CLI 2.0.31 或更高版本。This tutorial requires the Azure CLI version 2.0.31 or later. 运行 az --version 查找已安装的版本。Run az --version to find the installed version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI. 如果在本地运行 Azure CLI,则还需运行 az login 以创建与 Azure 的连接。If you are running the Azure CLI locally, you also need to run az login to create a connection with Azure.

登录或连接到 Azure 所用的帐户必须分配有网络参与者角色或者分配有可执行权限中列出的适当操作的自定义角色The account you log into, or connect to Azure with, must be assigned to the network contributor role or to a custom role that is assigned the appropriate actions listed in Permissions.

Note

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

添加子网Add a subnet

  1. 在门户顶部的搜索框中,输入“虚拟网络” 。In the search box at the top of the portal, enter virtual networks in the search box. 当“虚拟网络”出现在搜索结果中时,请将其选中 。When Virtual networks appear in the search results, select it.

  2. 从虚拟网络列表中,选择要将子网添加到的虚拟网络。From the list of virtual networks, select the virtual network you want to add a subnet to.

  3. 在“设置”下选择“子网”。 Under SETTINGS, select Subnets.

  4. 选择“+子网”。 Select +Subnet.

  5. 输入以下参数的值:Enter values for the following parameters:

    • 名称:名称在虚拟网络中必须唯一。Name: The name must be unique within the virtual network. 为了最大程度地兼容其他 Azure 服务,我们建议使用字母作为名称的第一个字符。For maximum compatibility with other Azure services, we recommend using a letter as the first character of the name. 例如,Azure 应用程序网关不会部署到名称以数字开头的子网中。For example, Azure Application Gateway won't deploy into a subnet that has a name that starts with a number.

    • 地址范围:此范围在虚拟网络的地址空间中必须唯一。Address range: The range must be unique within the address space for the virtual network. 此范围不能与虚拟网络中的其他子网地址范围重叠。The range cannot overlap with other subnet address ranges within the virtual network. 必须使用无类域间路由 (CIDR) 表示法指定地址空间。The address space must be specified by using Classless Inter-Domain Routing (CIDR) notation. 例如,在地址空间为 10.0.0.0/16 的虚拟网络中,可将子网地址空间定义为 10.0.0.0/24。For example, in a virtual network with address space 10.0.0.0/16, you might define a subnet address space of 10.0.0.0/24. 可以指定的最小范围为 /29,为子网提供八个 IP 地址。The smallest range you can specify is /29, which provides eight IP addresses for the subnet. Azure 保留每个子网中的第一个地址和最后一个地址,以确保协议一致性。Azure reserves the first and last address in each subnet for protocol conformance. 此外还会保留三个地址供 Azure 服务使用。Three additional addresses are reserved for Azure service usage. 因此,使用 /29 地址范围定义子网时,子网中会有三个可用 IP 地址。As a result, defining a subnet with a /29 address range results in three usable IP addresses in the subnet. 如果你打算将虚拟网络连接到 VPN 网关,则必须创建网关子网。If you plan to connect a virtual network to a VPN gateway, you must create a gateway subnet. 详细了解网关子网地址范围具体考虑事项Learn more about specific address range considerations for gateway subnets. 在特定条件下,可在添加子网后更改地址范围。You can change the address range after the subnet is added, under specific conditions. 若要了解有关如何更改子网地址范围的相关信息,请参阅更改子网设置To learn how to change a subnet address range, see Change subnet settings.

    • 网络安全组:可将零个或一个现有的网络安全组关联到子网,以筛选子网的入站和出站网络流量。Network security group: You can associate zero, or one existing network security group to a subnet to filter inbound and outbound network traffic for the subnet. 网络安全组必须与虚拟网络位于同一订阅和位置中。The network security group must exist in the same subscription and location as the virtual network. 若要详细了解网络安全组,请参阅如何创建网络安全组Learn more about network security groups and how to create a network security group.

    • 路由表:可以选择将零个或一个现有的路由表关联到子网,控制目标为其他网络的网络流量路由。Route table: You can associate zero or one existing route table to a subnet to control network traffic routing to other networks. 路由表必须与虚拟网络位于同一订阅和位置中。The route table must exist in the same subscription and location as the virtual network. 详细了解 Azure 路由如何创建路由表Learn more about Azure routing and how to create a route table

    • 服务终结点: 子网可以有零个或多个为其启用的服务终结点。Service endpoints: A subnet can have zero or multiple service endpoints enabled for it. 若要启用的服务的服务终结点,选择的服务或服务,想要启用服务终结点从服务列表。To enable a service endpoint for a service, select the service or services that you want to enable service endpoints for from the Services list. 系统会自动为终结点配置位置。The location is configured automatically for an endpoint. 默认情况下,系统会为虚拟网络所在的区域配置服务终结点。By default, service endpoints are configured for the virtual network's region. 对于 Azure 存储,为了支持区域故障转移方案,系统会将终结点自动配置到 Azure 配对区域。For Azure Storage, to support regional failover scenarios, endpoints are automatically configured to Azure paired regions.

      若要删除的服务终结点,请取消选择你想要删除的服务终结点的服务。To remove a service endpoint, unselect the service you want to remove the service endpoint for. 如需详细了解服务终结点以及可为其启用的服务,请参阅虚拟网络服务终结点概述To learn more about service endpoints, and the services they can be enabled for, see Virtual network service endpoints overview. 一旦启用服务的服务终结点,还必须启用与服务创建的资源的子网的网络访问权限。Once you enable a service endpoint for a service, you must also enable network access for the subnet for a resource created with the service. 例如,如果启用的服务终结点Microsoft.Storage,还必须启用到你想要授予对网络访问权限的所有 Azure 存储帐户的网络访问权限。For example, if you enable the service endpoint for Microsoft.Storage, you must also enable network access to all Azure Storage accounts you want to grant network access to. 有关如何启用到为启用服务终结点的子网的网络访问的详细信息,请参阅各个启用的服务终结点的服务的文档。For details about how to enable network access to subnets that a service endpoint is enabled for, see the documentation for the individual service you enabled the service endpoint for.

    要验证是否为某个子网启用了服务终结点,请查看有效路由,获取该子网中的任何网络接口。To validate that a service endpoint is enabled for a subnet, view the effective routes for any network interface in the subnet. 如果配置了终结点,将会看到服务地址前缀和 nextHopType 为“VirtualNetworkServiceEndpoint”的“默认”路由 。When an endpoint is configured, you see a default route with the address prefixes of the service, and a nextHopType of VirtualNetworkServiceEndpoint. 若要了解有关路由的详细信息,请参阅路由概述To learn more about routing, see Routing overview.

  6. 单击“确定”,将子网添加到所选的虚拟网络。 To add the subnet to the virtual network that you selected, select OK.

命令Commands

更改子网设置Change subnet settings

  1. 在门户顶部的搜索框中,输入“虚拟网络” 。In the search box at the top of the portal, enter virtual networks in the search box. 当“虚拟网络”出现在搜索结果中时,请将其选中 。When Virtual networks appear in the search results, select it.

  2. 从虚拟网络列表中,选择要为其更改对等设置的虚拟网络。From the list of virtual networks, select the virtual network that contains the subnet you want to change settings for.

  3. 在“设置”下选择“子网”。 Under SETTINGS, select Subnets.

  4. 在子网的列表中,选择想要更改设置的子网。In the list of subnets, select the subnet you want to change settings for. 可以更改以下设置:You can change the following settings:

    • 地址范围: 如果没有资源部署在子网内,可以更改地址范围。Address range: If no resources are deployed within the subnet, you can change the address range. 如果子网中存在的任何资源,必须将资源移到另一个子网,或从子网中先删除它们。If any resources exist in the subnet, you must either move the resources to another subnet, or delete them from the subnet first. 删除资源所采取的步骤因资源而异。The steps you take to move or delete a resource vary depending on the resource. 若要了解如何删除子网中的资源,请阅读针对要删除的每种资源类型的相关文档。To learn how to move or delete resources that are in subnets, read the documentation for each resource type that you want to move or delete. 请参阅添加子网步骤 5 中的地址范围约束。See the constraints for Address range in step 5 of Add a subnet.
    • 用户:可以使用内置角色或自己的自定义角色控制对子网的访问。Users: You can control access to the subnet by using built-in roles or your own custom roles. 若要详细了解如何分配访问子网的角色和用户,请参阅使用角色分配管理对 Azure 资源的访问权限To learn more about assigning roles and users to access the subnet, see Use role assignment to manage access to your Azure resources.
    • 网络安全组路由表:请参阅添加子网的步骤 5。Network security group and Route table: See step 5 of Add a subnet.
    • 服务终结点:请参阅添加子网的步骤 5 中的服务终结点。Service endpoints: See service endpoints in step 5 of Add a subnet. 如果为某个现有子网启用服务终结点,请确保该子网的任何资源上未运行任何关键任务。When enabling a service endpoint for an existing subnet, ensure that no critical tasks are running on any resource in the subnet. 服务终结点可将子网每个网络接口上的路由,从使用地址前缀为 0.0.0.0/0 且下一跃点类型为 Internet 的默认路由,切换到使用服务地址前缀且下一跃点类型为 VirtualNetworkServiceEndpoint 的新路由 。Service endpoints switch routes on every network interface in the subnet from using the default route with the 0.0.0.0/0 address prefix and next hop type of Internet, to using a new route with the address prefixes of the service, and a next hop type of VirtualNetworkServiceEndpoint. 切换过程中,可能会终止任何打开的 TCP 连接。During the switch, any open TCP connections may be terminated. 对于使用新路由更新的所有网络接口,除非流量流向服务,否则不会启用服务终结点。The service endpoint is not enabled until traffic flows to the service for all network interfaces are updated with the new route. 若要了解有关路由的详细信息,请参阅路由概述To learn more about routing, see Routing overview.
  5. 选择“其他安全性验证” 。Select Save.

命令Commands

删除子网Delete a subnet

仅当子网中无任何资源时,才可删除该子网。You can delete a subnet only if there are no resources in the subnet. 如果子网中存在资源,则必须先删除子网中的资源,然后才能删除该子网。If there are resources in the subnet, you must delete the resources that are in the subnet before you can delete the subnet. 删除资源所采取的步骤因资源而异。The steps you take to delete a resource vary depending on the resource. 若要了解如何删除子网中的资源,请阅读针对要删除的每种资源类型的相关文档。To learn how to delete resources that are in subnets, read the documentation for each resource type that you want to delete.

  1. 在门户顶部的搜索框中,输入“虚拟网络” 。In the search box at the top of the portal, enter virtual networks in the search box. 当“虚拟网络”出现在搜索结果中时,请将其选中 。When Virtual networks appear in the search results, select it.
  2. 从虚拟网络列表中,选择要删除子网的虚拟网络。From the list of virtual networks, select the virtual network that contains the subnet you want to delete.
  3. 在“设置”下选择“子网”。 Under SETTINGS, select Subnets.
  4. 在子网的列表中,选择要删除的子网右侧的“...”。 In the list of subnets, select ..., on the right, for the subnet you want to delete
  5. 依次选择“删除”、“是”。 Select Delete, and then select Yes.

命令Commands

权限Permissions

若要在子网中执行任务,必须将帐户分配到网络参与者角色或分配到下表中所列出的适当操作的自定义角色:To perform tasks on subnets, your account must be assigned to the network contributor role or to a custom role that is assigned the appropriate actions listed in the following table:

操作Action NameName
Microsoft.Network/virtualNetworks/subnets/readMicrosoft.Network/virtualNetworks/subnets/read 读取虚拟网络子网Read a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/writeMicrosoft.Network/virtualNetworks/subnets/write 创建或更新虚拟网络子网Create or update a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/deleteMicrosoft.Network/virtualNetworks/subnets/delete 删除虚拟网络子网Delete a virtual network subnet
Microsoft.Network/virtualNetworks/subnets/join/actionMicrosoft.Network/virtualNetworks/subnets/join/action 加入虚拟网络Join a virtual network
Microsoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/actionMicrosoft.Network/virtualNetworks/subnets/joinViaServiceEndpoint/action 为子网启用服务终结点Enable a service endpoint for a subnet
Microsoft.Network/virtualNetworks/subnets/virtualMachines/readMicrosoft.Network/virtualNetworks/subnets/virtualMachines/read 获取子网中的虚拟机Get the virtual machines in a subnet

后续步骤Next steps