创建、更改或删除网络接口Create, change, or delete a network interface

了解如何创建、删除网络接口及更改其设置。Learn how to create, change settings for, and delete a network interface. Azure 虚拟机可通过网络接口与 Internet、Azure 及本地资源进行通信。A network interface enables an Azure Virtual Machine to communicate with internet, Azure, and on-premises resources. 使用 Azure 门户创建虚拟机时,门户会使用默认设置创建一个网络接口。When creating a virtual machine using the Azure portal, the portal creates one network interface with default settings for you. 可改为选择使用自定义设置创建网络接口,并在创建虚拟机时向其添加一个或多个网络接口。You may instead choose to create network interfaces with custom settings and add one or more network interfaces to a virtual machine when you create it. 还可更改现有网络接口的默认网络接口设置。You may also want to change default network interface settings for an existing network interface. 本文介绍如何使用自定义设置创建网络接口、更改现有设置(例如网络筛选器(网络安全组)分配、子网分配、DNS 服务器设置和 IP 转发)以及删除网络接口。This article explains how to create a network interface with custom settings, change existing settings, such as network filter (network security group) assignment, subnet assignment, DNS server settings, and IP forwarding, and delete a network interface.

如果需要为网络接口添加、更改或删除 IP 地址,请参阅管理 IP 地址If you need to add, change, or remove IP addresses for a network interface, see Manage IP addresses. 如果需要向虚拟机添加网络接口或从中删除网络接口,请参阅添加或删除网络接口If you need to add network interfaces to, or remove network interfaces from virtual machines, see Add or remove network interfaces.

准备阶段Before you begin

Note

本文进行了更新,以便使用新的 Azure PowerShell Az 模块。This article has been updated to use the new Azure PowerShell Az module. 你仍然可以使用 AzureRM 模块,至少在 2020 年 12 月之前,它将继续接收 bug 修补程序。You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. 若要详细了解新的 Az 模块和 AzureRM 兼容性,请参阅新 Azure Powershell Az 模块简介To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. 有关 Az 模块安装说明,请参阅安装 Azure PowerShellFor Az module installation instructions, see Install Azure PowerShell.

在完成本文任何部分中的步骤之前,请完成以下任务:Complete the following tasks before completing steps in any section of this article:

  • 如果还没有 Azure 帐户,请注册试用帐户If you don't already have an Azure account, sign up for a trial account.
  • 如果使用门户,请打开 https://portal.azure.cn,并使用 Azure 帐户登录。If using the portal, open https://portal.azure.cn, and log in with your Azure account.
  • 如果使用 PowerShell 命令来完成本文中的任务,请从计算机运行 PowerShell。If using PowerShell commands to complete tasks in this article, by running PowerShell from your computer. 本教程需要 Azure PowerShell 模块 1.0.0 或更高版本。This tutorial requires the Azure PowerShell module version 1.0.0 or later. 运行 Get-Module -ListAvailable Az 查找已安装的版本。Run Get-Module -ListAvailable Az to find the installed version. 如果需要进行升级,请参阅 Install Azure PowerShell module(安装 Azure PowerShell 模块)。If you need to upgrade, see Install Azure PowerShell module. 如果在本地运行 PowerShell,则还需运行 Connect-AzAccount -Environment AzureChinaCloud 来创建与 Azure 的连接。If you are running PowerShell locally, you also need to run Connect-AzAccount -Environment AzureChinaCloud to create a connection with Azure.
  • 如果使用 Azure 命令行界面 (CLI) 命令来完成本文中的任务,请从计算机运行 CLI。If using Azure Command-line interface (CLI) commands to complete tasks in this article, by running the CLI from your computer. 本教程需要 Azure CLI 2.0.28 或更高版本。This tutorial requires the Azure CLI version 2.0.28 or later. 运行 az --version 查找已安装的版本。Run az --version to find the installed version. 如果需要进行安装或升级,请参阅安装 Azure CLIIf you need to install or upgrade, see Install Azure CLI. 如果在本地运行 Azure CLI,则还需运行 az login 以创建与 Azure 的连接。If you are running the Azure CLI locally, you also need to run az login to create a connection with Azure.

登录或连接到 Azure 所用的帐户必须分配有网络参与者角色或者分配有可执行权限中列出的适当操作的自定义角色The account you log into, or connect to Azure with, must be assigned to the network contributor role or to a custom role that is assigned the appropriate actions listed in Permissions.

Note

在 Azure China 中使用 Azure CLI 2.0 之前,请首先运行 az cloud set -n AzureChinaCloud 更改云环境。Before you can use Azure CLI 2.0 in Azure China, please run az cloud set -n AzureChinaCloud first to change the cloud environment. 如果要切换回全局 Azure,请再次运行 az cloud set -n AzureCloudIf you want to switch back to Global Azure, run az cloud set -n AzureCloud again.

创建网络接口Create a network interface

使用 Azure 门户创建虚拟机时,门户会使用默认设置创建一个网络接口。When creating a virtual machine using the Azure portal, the portal creates a network interface with default settings for you. 如果想要指定所有网络接口设置,可使用自定义设置创建网络接口并在创建虚拟机(使用 PowerShell 或 Azure CLI)时向其附加此网络接口。If you'd rather specify all your network interface settings, you can create a network interface with custom settings and attach the network interface to a virtual machine when creating the virtual machine (using PowerShell or the Azure CLI). 还可创建网络接口并将其添加到现有的虚拟机(使用 PowerShell 或 Azure CLI)。You can also create a network interface and add it to an existing virtual machine (using PowerShell or the Azure CLI). 若要了解如何创建包含现有网络接口的虚拟机,或者要在现有虚拟机中添加或删除网络接口,请参阅添加或删除网络接口To learn how to create a virtual machine with an existing network interface or to add to, or remove network interfaces from existing virtual machines, see Add or remove network interfaces. 创建网络接口之前,创建该接口时所在的同一位置和订阅中必须存在现有的虚拟网络Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network interface in.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.

  2. 在“网络接口” 下选择“+ 添加” 。Select + Add under Network interfaces.

  3. 为以下设置输入或选择值,然后选择“创建” :Enter, or select values for the following settings, then select Create:

    设置Setting 必需?Required? 详细信息Details
    NameName Yes 名称在所选资源组中必须唯一。The name must be unique within the resource group you select. 随着时间推移,Azure 订阅中可能会有多个网络接口。Over time, you'll likely have several network interfaces in your Azure subscription. 请参阅命名约定,获取有关创建命名约定来简化多个网络接口的管理的建议。For suggestions when creating a naming convention to make managing several network interfaces easier, see Naming conventions. 创建网络接口后,无法更改其名称。The name cannot be changed after the network interface is created.
    虚拟网络Virtual network Yes 为网络接口选择虚拟网络。Select the virtual network for the network interface. 只能将网络接口分配到与该接口位于相同订阅和位置的虚拟网络。You can only assign a network interface to a virtual network that exists in the same subscription and location as the network interface. 创建网络接口后,无法更改其分配到的虚拟网络。Once a network interface is created, you cannot change the virtual network it is assigned to. 将网络接口添加到的虚拟机也必须位于该接口所在的同一位置和订阅中。The virtual machine you add the network interface to must also exist in the same location and subscription as the network interface.
    子网Subnet Yes 在所选的虚拟网络中选择一个子网。Select a subnet within the virtual network you selected. 创建网络接口后,可更改它分配到的子网。You can change the subnet the network interface is assigned to after it's created.
    专用 IP 地址分配Private IP address assignment Yes 在此设置中,会为 IPv4 地址选择分配方法。In this setting, you're choosing the assignment method for the IPv4 address. 从以下分配方法中选择:动态: 选择此选项时,Azure 将从所选子网的地址空间中自动分配下一个可用地址。Choose from the following assignment methods: Dynamic: When selecting this option, Azure automatically assigns the next available address from the address space of the subnet you selected. 静态: 选择此选项时,必须手动从所选子网的地址空间中手动分配一个可用的 IP 地址。Static: When selecting this option, you must manually assign an available IP address from within the address space of the subnet you selected. 静态地址和动态地址保持不变,除非手动更改或删除网络接口。Static and dynamic addresses do not change until you change them or the network interface is deleted. 创建网络接口后,可更改分配方法。You can change the assignment method after the network interface is created. Azure DHCP 服务器将此地址分配到虚拟机操作系统中的网络接口。The Azure DHCP server assigns this address to the network interface within the operating system of the virtual machine.
    网络安全组Network security group No 保留设置为“无”,选择现有的网络安全组,或创建网络安全组Leave set to None, select an existing network security group, or create a network security group. 网络安全组可用于筛选进出网络接口的网络流量。Network security groups enable you to filter network traffic in and out of a network interface. 可向网络接口应用零个或一个网络安全组。You can apply zero or one network security group to a network interface. 也可向网络接口分配到的子网应用零个或一个网络安全组。Zero or one network security group can also be applied to the subnet the network interface is assigned to. 将网络安全组应用到网络接口以及该接口分配到的子网时,有时会产生意外结果。When a network security group is applied to a network interface and the subnet the network interface is assigned to, sometimes unexpected results occur. 若要对应用到网络接口和子网的网络安全组进行故障排除,请参阅网络安全组故障排除To troubleshoot network security groups applied to network interfaces and subnets, see Troubleshoot network security groups.
    订阅Subscription Yes 选择一个 Azure 订阅Select one of your Azure subscriptions. 网络接口附加到的虚拟机及其连接到的虚拟网络必须位于同一订阅中。The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same subscription.
    资源组Resource group Yes 选择现有的资源组或创建一个资源组。Select an existing resource group or create one. 网络接口可与它附加到的虚拟机或者连接到的虚拟网络位于相同或不同的资源组中。A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to.
    位置Location Yes 网络接口附加到的虚拟机及其连接到的虚拟网络必须位于同一位置(也称为区域)中。The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, also referred to as a region.

创建网络接口时,门户不会提供向接口分配公共 IP 地址的选项,但使用门户创建虚拟机时,门户会创建一个公共 IP 地址并将其分配到网络接口。The portal doesn't provide the option to assign a public IP address to the network interface when you create it, though the portal does create a public IP address and assign it to a network interface when you create a virtual machine using the portal. 若要了解创建网络接口后如何向其添加公共 IP 地址,请参阅管理 IP 地址To learn how to add a public IP address to the network interface after creating it, see Manage IP addresses. 若要使用公共 IP 地址创建网络接口,必须使用 CLI 或 PowerShell 创建网络接口。If you want to create a network interface with a public IP address, you must use the CLI or PowerShell to create the network interface.

创建网络接口时,门户不提供将网络接口分配给应用程序安全组的选项,但是 Azure CLI 和 PowerShell 提供。The portal doesn't provide the option to assign the network interface to application security groups when creating a network interface, but the Azure CLI and PowerShell do. 但是,只要网络接口连接到虚拟机,就可以使用门户将现有网络接口分配给应用程序安全组。You can assign an existing network interface to an application security group using the portal however, as long as the network interface is attached to a virtual machine. 要了解如何将网络接口分配给应用程序安全组,请参阅添加到应用程序安全组或从中删除To learn how to assign a network interface to an application security group, see Add to or remove from application security groups.

Note

只有在网络接口附加到虚拟机后首次启动虚拟机时,Azure 才向网络接口分配 MAC 地址。Azure assigns a MAC address to the network interface only after the network interface is attached to a virtual machine and the virtual machine is started the first time. 无法自行指定 Azure 要分配给网络接口的 MAC 地址。You cannot specify the MAC address that Azure assigns to the network interface. 除非网络接口被删除或者分配给主网络接口的主 IP 配置的专用 IP 地址发生更改,否则该 MAC 地址会始终分配给该网络接口。The MAC address remains assigned to the network interface until the network interface is deleted or the private IP address assigned to the primary IP configuration of the primary network interface is changed. 若要详细了解 IP 地址和 IP 配置,请参阅管理 IP 地址To learn more about IP addresses and IP configurations, see Manage IP addresses

命令Commands

工具Tool 命令Command
CLICLI az network nic createaz network nic create
PowerShellPowerShell New-AzNetworkInterfaceNew-AzNetworkInterface

查看网络接口设置View network interface settings

创建网络接口后,可查看和更改其大多数设置。You can view and change most settings for a network interface after it's created. 门户不显示网络接口的 DNS 后缀或应用程序安全组成员身份。The portal does not display the DNS suffix or application security group membership for the network interface. 可使用 PowerShell 或 Azure CLI 命令查看 DNS 后缀和应用程序安全组成员身份。You can use the PowerShell or Azure CLI commands to view the DNS suffix and application security group membership.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 从列表中选择要查看或更改设置的网络接口。Select the network interface you want to view or change settings for from the list.
  3. 为所选网络接口列出了以下项:The following items are listed for the network interface you selected:
    • 概述: 提供网络接口的相关信息,例如分配给它的 IP 地址、网络接口分配到的虚拟网络/子网,以及网络接口附加到的虚拟机(若已附加到某虚拟机)。Overview: Provides information about the network interface, such as the IP addresses assigned to it, the virtual network/subnet the network interface is assigned to, and the virtual machine the network interface is attached to (if it's attached to one). 下图显示名为 mywebserver256 的网络接口的概述设置 :网络接口概述可选择“资源组”或“订阅名称”旁边的“(更改)”,将网络接口移到其他资源组或订阅 。The following picture shows the overview settings for a network interface named mywebserver256: Network interface overview You can move a network interface to a different resource group or subscription by selecting (change) next to the Resource group or Subscription name. 如果移动网络接口,必须同时移动与该网络接口相关的所有资源。If you move the network interface, you must move all resources related to the network interface with it. 例如,如果网络接口已附加到虚拟机,则还必须移动该虚拟机及其相关的其他资源。If the network interface is attached to a virtual machine, for example, you must also move the virtual machine, and other virtual machine-related resources. 若要移动网络接口,请参阅将资源移到新的资源组或订阅To move a network interface, see Move resource to a new resource group or subscription. 该文章列出了先决条件,以及如何使用 Azure 门户、PowerShell 和 Azure CLI 移动资源。The article lists prerequisites, and how to move resources using the Azure portal, PowerShell, and the Azure CLI.
    • IP 配置: 此处列出分配到 IP 配置的公共和专用 IPv4 地址。IP configurations: Public and private IPv4 addresses assigned to IP configurations are listed here. 若要详细了解 IP 配置以及如何添加和删除 IP 地址,请参阅为 Azure 网络接口配置 IP 地址To learn more about IP configurations and how to add and remove IP addresses, see Configure IP addresses for an Azure network interface. 此部分还配置了 IP 转发和子网分配。IP forwarding and subnet assignment are also configured in this section. 若要详细了解这些设置,请参阅启用或禁用 IP 转发更改子网分配To learn more about these settings, see Enable or disable IP forwarding and Change subnet assignment.
    • DNS 服务器: 可指定 Azure DHCP 服务器向网络接口分配哪个 DNS 服务器。DNS servers: You can specify which DNS server a network interface is assigned by the Azure DHCP servers. 网络接口可从其连接到的虚拟网络继承设置,或使用自定义设置来替代其分配到的虚拟网络的设置。The network interface can inherit the setting from the virtual network the network interface is assigned to, or have a custom setting that overrides the setting for the virtual network it's assigned to. 若要修改显示的内容,请参阅更改 DNS 服务器To modify what's displayed, see Change DNS servers.
    • 网络安全组 (NSG) :显示与网络接口关联的 NSG(若有)。Network security group (NSG): Displays which NSG is associated to the network interface (if any). NSG 包含用于筛选网络接口网络流量的入站和出站规则。An NSG contains inbound and outbound rules to filter network traffic for the network interface. 如果网络接口关联有 NSG,会显示关联的 NSG 的名称。If an NSG is associated to the network interface, the name of the associated NSG is displayed. 若要修改显示的内容,请参阅关联或取消关联网络安全组To modify what's displayed, see Associate or dissociate a network security group.
    • 属性: 显示有关网络接口的关键设置,包括其 MAC 地址(若网络接口未附加到虚拟机,则为空)及其所在的订阅。Properties: Displays key settings about the network interface, including its MAC address (blank if the network interface isn't attached to a virtual machine), and the subscription it exists in.
    • 有效的安全规则: 如果网络接口已附加到正在运行的虚拟机,且某 NSG 已关联到该接口和/或其分配到的子网,则会列出安全规则。Effective security rules: Security rules are listed if the network interface is attached to a running virtual machine, and an NSG is associated to the network interface, the subnet it's assigned to, or both. 若要了解有关显示内容的详细信息,请参阅查看有效的安全规则To learn more about what's displayed, see View effective security rules. 若要了解有关 NSG 的详细信息,请参阅网络安全组To learn more about NSGs, see Network security groups.
    • 有效的路由: 如果网络接口已附加到正在运行的虚拟机,则会列出路由。Effective routes: Routes are listed if the network interface is attached to a running virtual machine. 路由是 Azure 默认路由、用户定义的任何路由以及网络接口分配到的子网可能存在的任何 BGP 路由的组合。The routes are a combination of the Azure default routes, any user-defined routes, and any BGP routes that may exist for the subnet the network interface is assigned to. 若要了解有关显示内容的详细信息,请参阅查看有效的路由To learn more about what's displayed, see View effective routes. 若要了解有关 Azure 默认路由和用户定义的路由的详细信息,请参阅路由概述To learn more about Azure default routes and user-defined routes, see Routing overview.
    • 常见的 Azure 资源管理器设置: 若要详细了解常见的 Azure 资源管理器设置,请参阅活动日志访问控制 (IAM)标记锁定自动化脚本Common Azure Resource Manager settings: To learn more about common Azure Resource Manager settings, see Activity log, Access control (IAM), Tags, Locks, and Automation script.

命令Commands

工具Tool 命令Command
CLICLI 使用 az network nic list 查看订阅中的网络接口;使用 az network nic show 查看网络接口的设置az network nic list to view network interfaces in the subscription; az network nic show to view settings for a network interface
PowerShellPowerShell 使用 Get-AzNetworkInterface 查看订阅中的网络接口或查看网络接口的设置Get-AzNetworkInterface to view network interfaces in the subscription or view settings for a network interface

更改 DNS 服务器Change DNS servers

DNS 服务器由 Azure DHCP 服务器分配到虚拟机操作系统中的网络接口。The DNS server is assigned by the Azure DHCP server to the network interface within the virtual machine operating system. 分配的 DNS 服务器设置就是网络接口的 DNS 服务器设置。The DNS server assigned is whatever the DNS server setting is for a network interface. 若要详细了解网络接口的名称解析设置,请参阅虚拟机的名称解析To learn more about name resolution settings for a network interface, see Name resolution for virtual machines. 网络接口可从虚拟网络继承设置,或使用自身唯一的设置替代虚拟网络的设置。The network interface can inherit the settings from the virtual network, or use its own unique settings that override the setting for the virtual network.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 从列表中选择要更改 DNS 服务器的网络接口。Select the network interface that you want to change a DNS server for from the list.
  3. 选择“设置”下的“DNS 服务器”。 Select DNS servers under SETTINGS.
  4. 选择以下任一项:Select either:
    • 从虚拟网络继承:选择此选项可继承针对网络接口分配到的虚拟网络定义的 DNS 服务器设置。Inherit from virtual network: Choose this option to inherit the DNS server setting defined for the virtual network the network interface is assigned to. 自定义 DNS 服务器或 Azure 提供的 DNS 服务器会在虚拟网络级别定义。At the virtual network level, either a custom DNS server or the Azure-provided DNS server is defined. Azure 提供的 DNS 服务器可解析分配到同一虚拟网络的资源的主机名。The Azure-provided DNS server can resolve hostnames for resources assigned to the same virtual network. 必须使用 FQDN 解析分配到不同虚拟网络的资源。FQDN must be used to resolve for resources assigned to different virtual networks.
    • 自定义:可自行配置 DNS 服务器来解析多个虚拟网络中的名称。Custom: You can configure your own DNS server to resolve names across multiple virtual networks. 输入要用作 DNS 服务器的服务器的 IP 地址。Enter the IP address of the server you want to use as a DNS server. 指定的 DNS 服务器地址仅分配到此网络接口,并会替代该网络接口分配到的虚拟网络的任何 DNS 设置。The DNS server address you specify is assigned only to this network interface and overrides any DNS setting for the virtual network the network interface is assigned to.
  5. 选择“其他安全性验证” 。Select Save.

命令Commands

工具Tool 命令Command
CLICLI az network nic updateaz network nic update
PowerShellPowerShell Set-AzNetworkInterfaceSet-AzNetworkInterface

启用/禁用 IP 转发Enable or disable IP forwarding

IP 转发使网络接口附加到的虚拟机能够:IP forwarding enables the virtual machine a network interface is attached to:

  • 接收未针对分配给任一网络接口 IP 配置的 IP 地址的网络流量。Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.
  • 使用与分配给某一网络接口 IP 配置的源 IP 地址不同的地址发送网络流量。Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.

必须为附加到虚拟机并接收虚拟机需转发的流量的每个网络接口启用该设置。The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. 无论虚拟机上附加了一个还是多个网络接口,该虚拟机都可转发流量。A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it. 尽管 IP 转发是一项 Azure 设置,但虚拟机也必须运行某个应用程序(例如防火墙、WAN 优化和负载均衡应用程序)才能转发流量。While IP forwarding is an Azure setting, the virtual machine must also run an application able to forward the traffic, such as firewall, WAN optimization, and load balancing applications. 运行网络应用程序的虚拟机通常称为网络虚拟设备。When a virtual machine is running network applications, the virtual machine is often referred to as a network virtual appliance. 可在 Azure 市场中查看可直接部署的网络虚拟设备列表。You can view a list of ready to deploy network virtual appliances in the Azure Marketplace. IP 转发通常用于用户定义的路由。IP forwarding is typically used with user-defined routes. 若要深入了解用户定义的路由,请参阅用户定义的路由To learn more about user-defined routes, see User-defined routes.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 选择要为其启用或禁用 IP 转发的网络接口。Select the network interface that you want to enable or disable IP forwarding for.
  3. 在“设置” 部分中选择“IP 配置” 。Select IP configurations in the SETTINGS section.
  4. 选择“启用”或“禁用”(默认设置)以更改设置。 Select Enabled or Disabled (default setting) to change the setting.
  5. 选择“其他安全性验证” 。Select Save.

命令Commands

工具Tool 命令Command
CLICLI az network nic updateaz network nic update
PowerShellPowerShell Set-AzNetworkInterfaceSet-AzNetworkInterface

更改子网分配Change subnet assignment

可更改网络接口分配到的子网,但无法更改它分配到的虚拟网络。You can change the subnet, but not the virtual network, that a network interface is assigned to.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 选择要更改子网分配的网络接口。Select the network interface that you want to change subnet assignment for.
  3. 在“设置” 下选择“IP 配置” 。Select IP configurations under SETTINGS. 如果所列任何 IP 配置的任何专用 IP 地址旁边出现“(静态)”,则必须完成以下步骤,将 IP 地址分配方法更改为动态。 If any private IP addresses for any IP configurations listed have (Static) next to them, you must change the IP address assignment method to dynamic by completing the steps that follow. 必须使用动态分配方法分配所有专用 IP 地址,以更改网络接口的子网分配。All private IP addresses must be assigned with the dynamic assignment method to change the subnet assignment for the network interface. 如果使用动态方法分配地址,请转到步骤 5。If the addresses are assigned with the dynamic method, continue to step five. 如果使用静态分配方法分配了任何 IPv4 地址,请完成以下步骤,将分配方法更改为动态:If any IPv4 addresses are assigned with the static assignment method, complete the following steps to change the assignment method to dynamic:
    • 从 IP 配置列表中选择要更改 IPv4 地址分配方法的 IP 配置。Select the IP configuration you want to change the IPv4 address assignment method for from the list of IP configurations.
    • 选择“动态” 作为专用 IP 地址分配方法。Select Dynamic for the private IP address Assignment method. 无法使用静态分配方法分配 IPv6 地址。You cannot assign an IPv6 address with the static assignment method.
    • 选择“其他安全性验证” 。Select Save.
  4. 从“子网”下拉列表中选择要将网络接口移到的子网。 Select the subnet you want to move the network interface to from the Subnet drop-down list.
  5. 选择“其他安全性验证” 。Select Save. 新的动态地址是从新子网的子网地址范围中分配的。New dynamic addresses are assigned from the subnet address range for the new subnet. 将网络接口分配到新子网之后,可在需要时从新子网地址范围中分配静态 IPv4 地址。After assigning the network interface to a new subnet, you can assign a static IPv4 address from the new subnet address range if you choose. 若要详细了解如何添加、更改和删除网络接口的 IP 地址,请参阅管理 IP 地址To learn more about adding, changing, and removing IP addresses for a network interface, see Manage IP addresses.

命令Commands

工具Tool 命令Command
CLICLI az network nic ip-config updateaz network nic ip-config update
PowerShellPowerShell Set-AzNetworkInterfaceIpConfigSet-AzNetworkInterfaceIpConfig

添加到应用程序安全组或从中删除Add to or remove from application security groups

只有在网络接口连接到虚拟机的情况下,才可以使用门户将网络接口添加到应用程序安全组或从中删除。You can only add a network interface to, or remove a network interface from an application security group using the portal if the network interface is attached to a virtual machine. 无论网络接口是否连接到虚拟机,都可使用 PowerShell 或 Azure CLI 将网络接口添加到应用程序安全组或从中删除。You can use PowerShell or the Azure CLI to add a network interface to, or remove a network interface from an application security group, whether the network interface is attached to a virtual machine or not. 了解应用程序安全组以及如何创建应用程序安全组Learn more about Application security groups and how to create an application security group.

  1. 在门户顶部的“搜索资源、服务和文档”框中,键入虚拟机的名称,该虚拟机具有要添加到应用程序安全组或要从应用程序安全组中删除的网络接口 。In the Search resources, services, and docs box at the top of the portal, begin typing the name of a virtual machine that has a network interface that you want to add to, or remove from, an application security group. 当 VM 名称显示在搜索结果中时,将其选中。When the name of your VM appears in the search results, select it.
  2. 在“设置”下选择“网络” 。Under SETTINGS, select Networking. 选择“配置应用程序安全组”,选中要在其中添加网络接口的应用程序安全组,或取消选中要从中删除网络接口的应用程序安全组,然后选择“保存” 。Select Configure the application security groups, select the application security groups that you want to add the network interface to, or unselect the application security groups that you want to remove the network interface from, and then select Save. 只有位于同一虚拟网络的网络接口才能添加到同一应用程序安全组。Only network interfaces that exist in the same virtual network can be added to the same application security group. 应用程序安全组必须与网络接口位于同一位置。The application security group must exist in the same location as the network interface.

命令Commands

工具Tool 命令Command
CLICLI az network nic updateaz network nic update
PowerShellPowerShell Set-AzNetworkInterfaceSet-AzNetworkInterface

关联或取消关联网络安全组Associate or dissociate a network security group

  1. 在门户顶部的搜索框中,输入“网络接口” 。In the search box at the top of the portal, enter network interfaces in the search box. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 在列表中选择要与网络安全组相关联或取消关联的网络接口。Select the network interface in the list that you want to associate a network security group to, or dissociate a network security group from.
  3. 在“设置”下选择“网络安全组” 。Select Network security group under SETTINGS.
  4. 选择“编辑” 。Select Edit.
  5. 选择“网络安全组”,然后选择要与网络接口相关联的网络安全组,或者选择“无”来取消关联网络安全组 。Select Network security group and then select the network security group you want to associate to the network interface, or select None, to dissociate a network security group.
  6. 选择“其他安全性验证” 。Select Save.

命令Commands

删除网络接口Delete a network interface

只要网络接口未附加到虚拟机,即可删除此接口。You can delete a network interface as long as it's not attached to a virtual machine. 如果已将网络接口连接到虚拟机,必须先将虚拟机置于停止(解除分配)状态,然后才能将网络接口从虚拟机中拆离。If a network interface is attached to a virtual machine, you must first place the virtual machine in the stopped (deallocated) state, then detach the network interface from the virtual machine. 若要从虚拟机中分离网络接口,请完成从虚拟机中分离网络接口中的步骤。To detach a network interface from a virtual machine, complete the steps in Detach a network interface from a virtual machine. 但是,如果这是连接到虚拟机的唯一网络接口,则无法从虚拟机中拆离网络接口。You cannot detach a network interface from a virtual machine if it's the only network interface attached to the virtual machine however. 虚拟机必须始终附加有至少一个网络接口。A virtual machine must always have at least one network interface attached to it. 删除虚拟机会分离其上附加的所有网络接口,但不会删除网络接口。Deleting a virtual machine detaches all network interfaces attached to it, but does not delete the network interfaces.

  1. 在 Azure 门户顶部包含“搜索资源”文本的框中,键入“网络接口”。 In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. 当“网络接口”出现在搜索结果中时,请选择它。 When network interfaces appear in the search results, select it.
  2. 从网络接口列表中选择要删除的网络接口右侧的“...” 。Select ... on the right side of the network interface you want to delete from the list of network interfaces.
  3. 选择“删除” 。Select Delete.
  4. 选择“是”确认删除该网络接口。 Select Yes to confirm deletion of the network interface.

删除网络接口时,会释放已分配给它的所有 MAC 或 IP 地址。When you delete a network interface, any MAC or IP addresses assigned to it are released.

命令Commands

工具Tool 命令Command
CLICLI az network nic deleteaz network nic delete
PowerShellPowerShell Remove-AzNetworkInterfaceRemove-AzNetworkInterface

解决连接问题Resolve connectivity issues

如果无法与虚拟机进行通信,则网络安全组安全规则或对网络接口有效的路由可能会导致问题。If you are unable to communicate to or from a virtual machine, network security group security rules or routes effective for a network interface, may be causing the problem. 以下选项可帮助解决问题:You have the following options to help resolve the issue:

查看有效的安全规则View effective security rules

连接到虚拟机的每个网络接口的有效安全规则是网络安全组中已创建的规则和默认安全规则的组合。The effective security rules for each network interface attached to a virtual machine are a combination of the rules you've created in a network security group and default security rules. 理解网络接口的有效安全规则有助于确定无法与虚拟机进行通信的原因。Understanding the effective security rules for a network interface may help you determine why you're unable to communicate to or from a virtual machine. 可查看连接到正在运行的虚拟机的任何网络接口的有效规则。You can view the effective rules for any network interface that is attached to a running virtual machine.

  1. 在门户顶部的搜索框中,输入要查看其有效安全规则的虚拟机的名称。In the search box at the top of the portal, enter the name of a virtual machine you want to view effective security rules for. 如果不知道虚拟机的名称,请在搜索框中输入“虚拟机”。 If you don't know the name of a virtual machine, enter virtual machines in the search box. 当“虚拟机”出现在搜索结果中时,请选择它,然后从列表中选择一个虚拟机 。When Virtual machines appear in the search results, select it, and then select a virtual machine from the list.
  2. 在“设置”下选择“网络” 。Select Networking under SETTINGS.
  3. 选择网络接口的名称。Select the name of a network interface.
  4. 在“支持 + 疑难解答”下,选择“有效安全规则” 。Select Effective security rules under SUPPORT + TROUBLESHOOTING.
  5. 查看有效安全规则列表,确定所需入站和出站通信是否存在正确的规则。Review the list of effective security rules to determine if the correct rules exist for your required inbound and outbound communication. 网络安全组概述中了解有关列表中所看到内容的详细信息。Learn more about what you see in the list in Network security group overview.

Azure 网络观察程序的 IP 流验证功能还有助于确定安全规则是否阻止虚拟机与终结点之间的通信。The IP flow verify feature of Azure Network Watcher can also help you determine if security rules are preventing communication between a virtual machine and an endpoint. 若要了解详细信息,请参阅 IP 流验证To learn more, see IP flow verify.

命令Commands

查看有效路由View effective routes

连接到虚拟机的网络接口的有效路由是默认路由、已创建的任何路由以及凭借 Azure 虚拟网络网关通过 BGP 从本地网络传播的任何路由的组合。The effective routes for the network interfaces attached to a virtual machine are a combination of default routes, any routes you've created, and any routes propagated from on-premises networks via BGP through an Azure virtual network gateway. 理解网络接口的有效路由有助于确定无法与虚拟机进行通信的原因。Understanding the effective routes for a network interface may help you determine why you're unable to communicate to or from a virtual machine. 可以查看已附加到运行中虚拟机的任何网络接口的有效路由。You can view the effective routes for any network interface that is attached to a running virtual machine.

  1. 在门户顶部的搜索框中,输入要查看其有效安全规则的虚拟机的名称。In the search box at the top of the portal, enter the name of a virtual machine you want to view effective security rules for. 如果不知道虚拟机的名称,请在搜索框中输入“虚拟机”。 If you don't know the name of a virtual machine, enter virtual machines in the search box. 当“虚拟机”出现在搜索结果中时,请选择它,然后从列表中选择一个虚拟机 。When Virtual machines appear in the search results, select it, and then select a virtual machine from the list.
  2. 在“设置”下选择“网络” 。Select Networking under SETTINGS.
  3. 选择网络接口的名称。Select the name of a network interface.
  4. 在“支持 + 故障排除”下,选择“有效路由”。 Select Effective routes under SUPPORT + TROUBLESHOOTING.
  5. 查看有效路由列表,确定所需入站和出站通信是否存在正确的路由。Review the list of effective routes to determine if the correct routes exist for your required inbound and outbound communication. 路由概述中了解有关列表中所看到内容的详细信息。Learn more about what you see in the list in Routing overview.

Azure 网络观察程序的下一个跃点功能还有助于确定路由是否阻止虚拟机与终结点之间的通信。The next hop feature of Azure Network Watcher can also help you determine if routes are preventing communication between a virtual machine and an endpoint. 若要了解详细信息,请参阅下一个跃点To learn more, see Next hop.

命令Commands

权限Permissions

若要在网络接口上执行任务,必须将你的帐户分配到网络参与者角色或分配有下表中所列适当权限的自定义角色:To perform tasks on network interfaces, your account must be assigned to the network contributor role or to a custom role that is assigned the appropriate permissions listed in the following table:

操作Action NameName
Microsoft.Network/networkInterfaces/readMicrosoft.Network/networkInterfaces/read 获取网络接口Get network interface
Microsoft.Network/networkInterfaces/writeMicrosoft.Network/networkInterfaces/write 创建或更新网络接口Create or update network interface
Microsoft.Network/networkInterfaces/join/actionMicrosoft.Network/networkInterfaces/join/action 向虚拟机添加网络接口Attach a network interface to a virtual machine
Microsoft.Network/networkInterfaces/deleteMicrosoft.Network/networkInterfaces/delete 删除网络接口Delete network interface
Microsoft.Network/networkInterfaces/joinViaPrivateIp/actionMicrosoft.Network/networkInterfaces/joinViaPrivateIp/action 通过服务将资源加入到网络接口Join a resource to a network interface via a servi...
Microsoft.Network/networkInterfaces/effectiveRouteTable/actionMicrosoft.Network/networkInterfaces/effectiveRouteTable/action 获取网络接口的有效路由表Get network interface effective route table
Microsoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/actionMicrosoft.Network/networkInterfaces/effectiveNetworkSecurityGroups/action 获取网络接口的有效安全组Get network interface effective security groups
Microsoft.Network/networkInterfaces/loadBalancers/readMicrosoft.Network/networkInterfaces/loadBalancers/read 获取网络接口负载平衡器Get network interface load balancers
Microsoft.Network/networkInterfaces/serviceAssociations/readMicrosoft.Network/networkInterfaces/serviceAssociations/read 获取服务关联Get service association
Microsoft.Network/networkInterfaces/serviceAssociations/writeMicrosoft.Network/networkInterfaces/serviceAssociations/write 创建或更新服务关联Create or update a service association
Microsoft.Network/networkInterfaces/serviceAssociations/deleteMicrosoft.Network/networkInterfaces/serviceAssociations/delete 删除设备关联Delete service association
Microsoft.Network/networkInterfaces/serviceAssociations/validate/actionMicrosoft.Network/networkInterfaces/serviceAssociations/validate/action 验证服务关联Validate service association
Microsoft.Network/networkInterfaces/ipconfigurations/readMicrosoft.Network/networkInterfaces/ipconfigurations/read 获取网络接口 IP 配置Get network interface IP configuration

后续步骤Next steps