排查虚拟网络对等互连问题Troubleshoot virtual network peering issues

本故障排除指南提供帮助你解决大多数虚拟网络对等互连问题的步骤。This troubleshooting guide provides steps to help you resolve most virtual network peering issues.

虚拟网络对等互连示意图

在两个虚拟网络之间配置虚拟网络对等互连Configure virtual network peering between two virtual networks

虚拟网络是在同一订阅中还是在不同的订阅中?Are the virtual networks in the same subscription or in different subscriptions?

虚拟网络位于同一订阅中The virtual networks are in the same subscription

若要为同一订阅中的虚拟网络配置虚拟网络对等互连,请使用以下文章中所述的方法:To configure virtual network peering for the virtual networks that are in the same subscription, use the methods in the following articles:

备注

对于以下资源,无法通过全局虚拟网络对等互连建立连接:Connectivity doesn't work over global virtual network peering for the following resources:

  • 基本内部负载均衡器 (ILB) SKU 后面的虚拟机 (VM)Virtual machines (VMs) behind Basic internal load balancer (ILB) SKU
  • Redis 缓存(使用基本 ILB SKU)Redis cache (uses Basic ILB SKU)
  • 应用程序网关(使用基本 ILB SKU)Application gateway (uses Basic ILB SKU)
  • 虚拟机规模集(使用基本 ILB SKU)Virtual machine scale sets (uses Basic ILB SKU)
  • Azure Service Fabric 群集(使用基本 ILB SKU)Azure Service Fabric clusters (uses Basic ILB SKU)
  • SQL Server Always-on(使用基本 ILB SKU)SQL Server Always On (uses Basic ILB SKU)
  • PowerApps 的 Azure 应用服务环境(使用基本 ILB SKU)Azure App Service Environment for PowerApps (uses Basic ILB SKU)
  • Azure API 管理(使用基本 ILB SKU)Azure API Management (uses Basic ILB SKU)
  • Azure Active Directory 域服务 (Azure AD DS)(使用基本 ILB SKU)Azure Active Directory Domain Services (Azure AD DS) (uses Basic ILB SKU)

有关详细信息,请参阅全局对等互连的要求和约束For more information, see the requirements and constraints of global peering.

虚拟网络位于不同的订阅或 Active Directory 租户中The virtual networks are in different subscriptions or Active Directory tenants

若要为不同订阅或 Active Directory 租户中的虚拟网络配置虚拟网络对等互连,请参阅使用 Azure CLI 在不同的订阅中创建对等互连To configure virtual network peering for virtual networks in different subscriptions or Active Directory tenants, see Create peering in different subscriptions for Azure CLI.

备注

若要配置网络对等互连,必须在这两个订阅中拥有“网络参与者”权限。To configure network peering, you must have Network Contributor permissions in both subscriptions. 有关详细信息,请参阅对等互连权限For more information, see Peering permissions.

为使用本地资源的中心辐射型拓扑配置虚拟网络对等互连Configure virtual network peering with hub-spoke topology that uses on-premises resources

与本地辐射建立虚拟网络对等互连的示意图

对于站点到站点连接或 ExpressRoute 连接For a site-to-site connection or an ExpressRoute connection

遵循以下文章中的步骤:针对虚拟网络对等互连配置 VPN 网关传输Follow the steps in: Configure VPN gateway transit for virtual network peering.

对于点到站点连接For point-to-site connections

  1. 遵循以下文章中的步骤:针对虚拟网络对等互连配置 VPN 网关传输Follow the steps in: Configure VPN gateway transit for virtual network peering.
  2. 建立或更改虚拟网络对等互连后,下载并重新安装点到站点包,使点到站点客户端能够获取指向辐射虚拟网络的更新路由。After virtual network peering is established or changed, download and reinstall the point-to-site package so that the point-to-site clients get the updated routes to the spoke virtual network.

为中心辐射型拓扑虚拟网络配置虚拟网络对等互连Configure virtual network peering with hub-spoke topology virtual network

与辐射虚拟网络建立虚拟网络对等互连的示意图

虚拟网络位于同一区域The virtual networks are in the same region

  1. 在中心虚拟网络中配置网络虚拟设备 (NVA)。In the hub virtual network, configure a network virtual appliance (NVA).
  2. 在辐射虚拟网络中,应用下一跃点类型为“网络虚拟设备”的用户定义路由。In the spoke virtual networks, have user-defined routes with the next hop type "network virtual appliance" applied.

有关详细信息,请参阅服务链接For more information, see Service chaining.

备注

如果需要帮助设置 NVA,请联系 NVA 供应商If you require help to set up an NVA, contact the NVA vendor.

在排查 NVA 设备设置和路由问题时如需帮助,请参阅 Azure 中的网络虚拟设备问题For help with troubleshooting the NVA device setup and routing, see Network virtual appliance issues in Azure.

虚拟网络位于不同的区域The virtual networks are in different regions

现在支持通过全球虚拟网络对等互连进行传输。Transit over global virtual network peering is now supported. 对于以下资源,无法通过全球虚拟网络对等互连建立连接:Connectivity does not work over global virtual network peering for the following resources:

  • 基本 ILB SKU 后面的 VMVMs behind Basic ILB SKU
  • Redis 缓存(使用基本 ILB SKU)Redis cache (uses Basic ILB SKU)
  • 应用程序网关(使用基本 ILB SKU)Application gateway (uses Basic ILB SKU)
  • 规模集(使用基本 ILB SKU)Scale sets (uses Basic ILB SKU)
  • Service Fabric 群集(使用基本 ILB SKU)Service Fabric clusters (uses Basic ILB SKU)
  • SQL Server Always-on(使用基本 ILB SKU)SQL Server Always On (uses Basic ILB SKU)
  • 应用服务环境(使用基本 ILB SKU)App Service Environment (uses Basic ILB SKU)
  • API 管理(使用基本 ILB SKU)API Management (uses Basic ILB SKU)
  • Azure AD DS(使用基本 ILB SKU)Azure AD DS (uses Basic ILB SKU)

若要详细了解全球对等互连要求和约束,请参阅虚拟网络对等互连To learn more about global peering requirements and restraints, see Virtual network peering.

排查两个对等互连虚拟网络之间的连接问题Troubleshoot a connectivity issue between two peered virtual networks

使用具有必要角色和权限的帐户登录到 Azure 门户Sign in to the Azure portal with an account that has the necessary roles and permissions. 选择该虚拟网络,选择“对等互连”,然后检查“状态”字段。 Select the virtual network, select Peering, and then check the Status field. 状态是什么?What is the status?

对等互连状态为“已连接”The peering status is "Connected"

若要排查此问题,请执行以下操作:To troubleshoot this issue:

  1. 检查网络流量流:Check the network traffic flows:

    在源 VM 到目标 VM 之间进行连接故障排除IP 流验证,确定是否某个 NSG 或 UDR 导致流量流受到干扰。Use Connection Troubleshoot and IP flow verify from the source VM to the destination VM to determine whether there is an NSG or UDR that is causing interference in traffic flows.

    如果使用防火墙或 NVA,请执行以下操作:If you're using a firewall or NVA:

    1. 记录 UDR 参数,以便在完成此步骤后可以还原这些参数。Document the UDR parameters so that you can restore them after this step is complete.
    2. 从源 VM 子网或 NIC 中删除指向 NVA(充当下一跃点)的 UDR。Remove the UDR from the source VM subnet or NIC that points to the NVA as the next hop. 验证绕过 NVA 的从源 VM 到目标的直接连接。Verify connectivity from the source VM directly to the destination that is bypassing the NVA. 如果此步骤不起作用,请参阅 NVA 故障排除If this step doesn't work, see the NVA troubleshooter.
  2. 进行网络跟踪:Take a network trace:

    1. 在目标 VM 上启动网络跟踪。Start a network trace on the destination VM. 对于 Windows,可以使用 NetshFor Windows, you can use Netsh. 对于 Linux,请使用 TCPDumpFor Linux, use TCPDump.
    2. 运行从源到目标 IP 的 TcpPingPsPingRun TcpPing or PsPing from the source to the destination IP.

    这是 TcpPing 命令的一个示例:tcping64.exe -t <destination VM address> 3389This is an example of a TcpPing command: tcping64.exe -t <destination VM address> 3389

    1. 完成 TcpPing 后,停止目标上的网络跟踪。After the TcpPing is complete, stop the network trace on the destination.
    2. 如果从源传入的数据包抵达目标,则表示没有网络问题。If packets arrive from the source, there is no networking issue. 检查 VM 防火墙以及侦听该端口的应用程序以找出配置问题。Examine both the VM firewall and the application listening on that port to locate the configuration issue.

    备注

    无法通过全球虚拟网络对等互连(虚拟网络位于不同的区域中)连接到以下资源类型:You can't connect to the following resource types over global virtual network peering (virtual networks in different regions):

    • 基本 ILB SKU 后面的 VMVMs behind Basic ILB SKU
    • Redis 缓存(使用基本 ILB SKU)Redis cache (uses Basic ILB SKU)
    • 应用程序网关(使用基本 ILB SKU)Application gateway (uses Basic ILB SKU)
    • 规模集(使用基本 ILB SKU)Scale sets (uses Basic ILB SKU)
    • Service Fabric 群集(使用基本 ILB SKU)Service Fabric clusters (uses Basic ILB SKU)
    • SQL Server Always-on(使用基本 ILB SKU)SQL Server Always On (uses Basic ILB SKU)
    • 应用服务环境(使用基本 ILB SKU)App Service Environment (uses Basic ILB SKU)
    • API 管理(使用基本 ILB SKU)API Management (uses Basic ILB SKU)
    • Azure AD DS(使用基本 ILB SKU)Azure AD DS (uses Basic ILB SKU)

有关详细信息,请参阅全局对等互连的要求和约束For more information, see the requirements and constraints of global peering.

对等互连状态为“已断开连接”The peering status is "Disconnected"

若要解决此问题,请从两个虚拟网络中删除对等互连,然后重新创建对等互连。To resolve this issue, delete the peering from both virtual networks, and then re-create them.

排查中心辐射型虚拟网络与本地资源之间的连接问题Troubleshoot a connectivity issue between a hub-spoke virtual network and an on-premises resource

网络是否使用了第三方 NVA 或 VPN 网关?Does your network use a third-party NVA or VPN gateway?

我的网络使用了第三方 NVA 或 VPN 网关My network uses a third-party NVA or VPN gateway

若要排查影响第三方 NVA 或 VPN 网关的连接问题,请参阅以下文章:To troubleshoot connectivity issues that affect a third-party NVA or VPN gateway, see the following articles:

我的网络未使用第三方 NVA 或 VPN 网关My network does not use a third-party NVA or VPN gateway

中心虚拟网络和辐射虚拟网络是否使用了 VPN 网关?Do the hub virtual network and the spoke virtual network have a VPN gateway?

中心虚拟网络和辐射虚拟网络都使用了 VPN 网关Both the hub virtual network and the spoke virtual network have a VPN gateway

不支持使用远程网关。Using a remote gateway isn't supported.

如果辐射虚拟网络已有 VPN 网关,则辐射虚拟网络不支持“使用远程网关”选项。If the spoke virtual network already has a VPN gateway, the Use remote gateway option isn't supported on the spoke virtual network. 这是因为虚拟网络对等互连存在限制。This is because of a virtual network peering limitation.

中心虚拟网络和辐射虚拟网络都不使用 VPN 网关Both the hub virtual network and the spoke virtual network do not have a VPN gateway

对于站点到站点连接或 Azure ExpressRoute 连接,请检查以下主要原因,这些原因会导致从本地连接到远程虚拟网络时出现问题:For site-to-site or Azure ExpressRoute connections, check the following primary causes of connectivity issues to the remote virtual network from on-premises:

  • 在具有网关的虚拟网络上,验证是否选中了“允许转发的流量”复选框。On the virtual network that has a gateway, verify that the Allow forwarded traffic check box is selected.
  • 在没有网关的虚拟网络上,验证是否选中了“使用远程网关”复选框。On the virtual network that doesn't have a gateway, verify that the Use remote gateway check box is selected.
  • 让网络管理员检查你的本地设备,验证是否为所有这些设备添加了远程虚拟网络地址空间。Have your network administrator check your on-premises devices to verify that they all have the remote virtual network address space added.

对于点到站点连接:For point-to-site connections:

  • 在具有网关的虚拟网络上,验证是否选中了“允许转发的流量”复选框。On the virtual network that has a gateway, verify that the Allow forwarded traffic check box is selected.
  • 在没有网关的虚拟网络上,验证是否选中了“使用远程网关”复选框。On the virtual network that doesn't have a gateway, verify that the Use remote gateway check box is selected.
  • 下载并重新安装点到站点客户端包。Download and reinstall the point-to-site client package. 新对等互连的虚拟网络路由不会自动将路由添加到点到站点客户端。Virtual network routes that are newly peered don't automatically add routes to point-to-site clients.

排查同一区域中辐射虚拟网络之间的中心辐射型网络连接问题Troubleshoot a hub-spoke network connectivity issue between spoke virtual networks in the same region

中心网络必须包含 NVA。A hub network must include an NVA. 在已将 NVA 设置为下一跃点的辐射虚拟网络中配置 UDR,并在中心虚拟网络中启用“允许转发的流量”。Configure UDRs in spokes that have an NVA set as the next hop, and enable Allow forwarded traffic in the hub virtual network.

有关详细信息,请参阅服务链接,并与所选的 NVA 供应商讨论这些要求。For more information, see Service chaining, and discuss these requirements with the NVA vendor of your choice.

排查不同区域中辐射虚拟网络之间的中心辐射型网络连接问题Troubleshoot a hub-spoke network connectivity issue between spoke virtual networks in different regions

现在支持通过全球虚拟网络对等互连进行传输。Transit over global virtual network peering is now supported. 对于以下资源,无法通过全局虚拟网络对等互连建立连接:Connectivity doesn't work over global virtual network peering for the following resources:

  • 基本 ILB SKU 后面的 VMVMs behind Basic ILB SKU
  • Redis 缓存(使用基本 ILB SKU)Redis cache (uses Basic ILB SKU)
  • 应用程序网关(使用基本 ILB SKU)Application gateway (uses Basic ILB SKU)
  • 规模集(使用基本 ILB SKU)Scale sets (uses Basic ILB SKU)
  • Service Fabric 群集(使用基本 ILB SKU)Service Fabric clusters (uses Basic ILB SKU)
  • SQL Server Always-on(使用基本 ILB SKU)SQL Server Always On (uses Basic ILB SKU)
  • 应用服务环境(使用基本 ILB SKU)App Service Environment (uses Basic ILB SKU)
  • API 管理(使用基本 ILB SKU)API Management (uses Basic ILB SKU)
  • Azure AD DS(使用基本 ILB SKU)Azure AD DS (uses Basic ILB SKU)

有关详细信息,请参阅全球对等互连的要求和约束,以及不同的 VPN 拓扑For more information, see the requirements and constraints of global peering and Different VPN Topologies.

排查 Web 应用与辐射虚拟网络之间的中心辐射型网络连接问题Troubleshoot a hub-spoke network connectivity issue between a web app and the spoke virtual network

若要排查此问题,请执行以下操作:To troubleshoot this issue:

  1. 登录到 Azure 门户。Sign in to the Azure portal.
  2. 在 Web 应用中选择“网络”,然后选择“VNet 集成”。 In the web app, select networking, and then select VNet Integration.
  3. 检查是否可以看到远程虚拟网络。Check whether you can see the remote virtual network. 手动输入远程虚拟网络地址空间(“同步网络”和“添加路由”)。 Manually enter the remote virtual network address space (Sync Network and Add Routes).

有关详细信息,请参阅以下文章:For more information, see the following articles:

排查出现虚拟网络对等互连配置错误消息的问题Troubleshoot a virtual network peering configuration error message

当前租户 <TENANT ID> 无权访问链接的订阅Current tenant <TENANT ID> isn't authorized to access linked subscription

若要解决此问题,请参阅创建对等互连 - Azure CLITo resolve this issue, see Create peering - Azure CLI.

未连接Not connected

若要解决此问题,请从两个虚拟网络中删除对等互连,然后重新创建对等互连。To resolve this issue, delete the peering from both virtual networks, and then recreate them.

远程虚拟网络缺少网关The remote virtual network lacks a gateway

如果对等互连了不同租户中的虚拟网络,然后配置了 Use Remote Gateways,则会出现此问题。This issue occurs when you peer virtual networks from different tenants and later want to configure Use Remote Gateways. Azure 门户存在的一个限制是,它无法验证另一租户的虚拟网络中是否存在虚拟网络网关。A limitation of the Azure portal is that it can't validate the presence of a virtual network gateway in another tenant's virtual network.

可通过两种方式解决此问题:There are two ways to resolve the issue:

  • 删除对等互连,并在创建新对等互连时激活 Use Remote Gateways 选项。Delete the peerings and activate the Use Remote Gateways option when you create a new peering.
  • 使用 PowerShell 或 CLI(而不要使用 Azure 门户)启用 Use Remote GatewaysUse PowerShell or CLI, instead of the Azure portal, to enable Use Remote Gateways.

后续步骤Next steps