排查 Azure VM 间的连接问题Troubleshooting connectivity problems between Azure VMs

Azure 虚拟机 (VM) 间可能出现连接问题。You might experience connectivity problems between Azure virtual machines (VMs). 本文提供解决此问题的故障排除步骤。This article provides troubleshooting steps to help you resolve this problem.

如果本文未解决你的 Azure 问题,请访问 MSDN 和 CSDN 上的 Azure 论坛。If your Azure issue is not addressed in this article, visit the Azure forums on MSDN and CSDN. 可以在这些论坛上发布问题。You can post your issue in these forums. 还可提交 Azure 支持请求。You also can submit an Azure support request. 若要提交支持请求,请在 Azure 支持页上提交。To submit a support request, on the Azure support page.

症状Symptom

一个 Azure VM 无法连接到另一个 Azure VM。One Azure VM cannot connect to another Azure VM.

故障排除指南Troubleshooting guidance

  1. 检查 NIC 的配置是否不正确Check whether NIC is misconfigured
  2. 检查网络流量是否被 NSG 或 UDR 阻止Check whether network traffic is blocked by NSG or UDR
  3. 检查网络流量是否被 VM 防火墙阻止Check whether network traffic is blocked by VM firewall
  4. 检查 VM 应用或服务是否在侦听端口Check whether VM app or service is listening on the port
  5. 检查问题是否由 SNAT 引起Check whether the problem is caused by SNAT
  6. 检查 ACL 是否阻止了经典 VM 的流量Check whether traffic is blocked by ACLs for the classic VM
  7. 检查是否为经典 VM 创建了终结点Check whether the endpoint is created for the classic VM
  8. 尝试连接到 VM 网络共享Try to connect to a VM network share
  9. 检查 Vnet 间连接Check Inter-Vnet connectivity

疑难解答步骤Troubleshooting steps

请按照下列步骤排查问题。Follow these steps to troubleshoot the problem. 完成每个步骤后,检查问题是否得到解决。After you complete each step, check whether the problem is resolved.

步骤 1:检查 NIC 的配置是否不正确Step 1: Check whether NIC is misconfigured

按照如何为 Azure Windows VM 重置网络接口中的步骤进行操作。Follow the steps in How to reset network interface for Azure Windows VM.

如果修改网络接口 (NIC) 后出现此问题,请按照下列步骤进行操作:If the problem occurs after you modify the network interface (NIC), follow these steps:

多 NIC VMMulti-NIC VMs

  1. 添加 NIC。Add a NIC.
  2. 修复错误的 NIC 的问题或删除错误的 NIC。Fix the problems in the bad NIC or remove the bad NIC. 然后再次添加 NIC。Then add the NIC again.

有关详细信息,请参阅添加或删除虚拟机的网络接口For more information, see Add network interfaces to or remove from virtual machines.

单 NIC VMSingle-NIC VM

步骤 2:检查网络流量是否被 NSG 或 UDR 阻止Step 2: Check whether network traffic is blocked by NSG or UDR

使用网络观察程序 IP 流验证NSG 流日志记录确定是否存在干扰流量流的网络安全组 (NSG) 或用户定义的路由 (UDR)。Use Network Watcher IP Flow Verify and NSG Flow Logging to determine whether there is a Network Security Group (NSG) or User-Defined Route (UDR) that is interfering with traffic flow.

步骤 3:检查网络流量是否被 VM 防火墙阻止Step 3: Check whether network traffic is blocked by VM firewall

禁用防火墙,然后测试结果。Disable the firewall, and then test the result. 如果问题得到解决,则验证防火墙设置,然后重新启用防火墙。If the problem is resolved, verify the firewall settings, and then re-enable the firewall.

步骤 4:检查 VM 应用或服务是否在侦听端口Step 4: Check whether VM app or service is listening on the port

可使用以下方法之一来检查 VM 应用或服务是否在侦听端口。You can use one of the following methods to check whether the VM app or service is listening on the port.

  • 运行以下命令,检查服务器是否在侦听该端口。Run the following commands to check whether the server is listening on that port.

Windows VMWindows VM

netstat -ano

Linux VMLinux VM

netstat -l
  • 对虚拟机本身运行 telnet 命令,测试端口 。Run the telnet command on the virtual machine itself to test the port. 如果测试失败,则应用程序或服务未配置为侦听该端口。If the test fails, the application or service is not configured to listen on that port.

步骤 5:检查问题是否由 SNAT 引起Step 5: Check whether the problem is caused by SNAT

在某些情况下,VM 位于负载均衡解决方案之后,而该解决方案与 Azure 外部的资源具有依赖关系。In some scenarios, the VM is placed behind a load balance solution that has a dependency on resources outside of Azure. 在这些情况下,如果遇到间歇性连接问题,该问题可能因 SNAT 端口耗尽引起。In these scenarios, if you experience intermittent connection problems, the problem may be caused by SNAT port exhaustion. 要解决该问题,请为负载均衡器后的每个 VM 创建一个 VIP(或为经典 VM 创建 ILPIP),并使用 NSG 或 ACL 进行保护。To resolve the issue, create a VIP (or ILPIP for classic) for each VM that is behind the load balancer and secure with NSG or ACL.

步骤 6:检查 ACL 是否阻止了经典 VM 的流量Step 6: Check whether traffic is blocked by ACLs for the classic VM

利用访问控制列表 (ACL),可以选择允许还是拒绝虚拟机终结点的流量。An access control list (ACL) provides the ability to selectively permit or deny traffic for a virtual machine endpoint. 有关详细信息,请参阅管理终结点上的 ACLFor more information, see Manage the ACL on an endpoint.

步骤 7:检查是否为经典 VM 创建了终结点Step 7: Check whether the endpoint is created for the classic VM

在 Azure 中使用经典部署模型创建的所有 VM 都可以通过专用网络通道与同一云服务或虚拟网络中的其他虚拟机自动通信。All VMs that you create in Azure by using the classic deployment model can automatically communicate over a private network channel with other virtual machines in the same cloud service or virtual network. 但是,其他虚拟网络上的计算机需要终结点才能定向虚拟机的入站网络流量。However, computers on other virtual networks require endpoints to direct the inbound network traffic to a virtual machine. 有关详细信息,请参阅如何设置终结点For more information, see How to set up endpoints.

步骤 8:尝试连接到 VM 网络共享Step 8: Try to connect to a VM network share

如果无法连接到 VM 网络共享,问题可能由 VM 中不可用的 NIC 引起。If you cannot connect to a VM network share, the problem may be caused by unavailable NICs in the VM. 要删除不可用的 NIC,请参阅如何删除不可用的 NICTo delete the unavailable NICs, see How to delete the unavailable NICs

步骤 9:检查 Vnet 间连接Step 9: Check Inter-Vnet connectivity

使用网络观察程序 IP 流验证NSG 流日志记录确定是否存在干扰流量流的 NSG 或 UDR。Use Network Watcher IP Flow Verify and NSG Flow Logging to determine whether there is a NSG or UDR that is interfering with traffic flow. 还可在此处验证 Vnet 间配置。You can also verify your Inter-Vnet configuration here.

需要帮助?Need help? 请联系支持人员。Contact support.

如果仍需帮助,请联系支持人员以快速解决问题。If you still need help, contact support to get your issue resolved quickly.