什么是 Azure 虚拟网络?What is Azure Virtual Network?

Azure 虚拟网络 (VNet) 是 Azure 中专用网络的基本构建块。Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. VNet 允许许多类型的 Azure 资源(例如 Azure 虚拟机 (VM))以安全方式彼此通信、与 Internet 通信,以及与本地网络通信。VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the internet, and on-premises networks. VNet 类似于在你在自己的数据中心运营的传统网络,但附带了 Azure 基础设施的其他优势,例如可伸缩性、可用性和隔离性。VNet is similar to a traditional network that you'd operate in your own data center, but brings with it additional benefits of Azure's infrastructure such as scale, availability, and isolation.

为何要使用 Azure 虚拟网络?Why use an Azure Virtual network?

通过 Azure 虚拟网络,Azure 资源能够以安全方式彼此通信、与 Internet 通信以及与本地网络通信。Azure virtual network enables Azure resources to securely communicate with each other, the internet, and on-premises networks. 可以使用虚拟网络实现的关键方案包括:Azure 资源与 Internet 进行通信、Azure 资源彼此通信、与本地资源进行通信、筛选网络流量、路由网络流量以及与 Azure 服务集成。Key scenarios that you can accomplish with a virtual network include - communication of Azure resources with the internet, communication between Azure resources, communication with on-premises resources, filtering network traffic, routing network traffic, and integration with Azure services.

与 Internet 通信Communicate with the internet

默认情况下,VNet 中的所有资源都可以与 Internet 进行出站通信。All resources in a VNet can communicate outbound to the internet, by default. 可以通过分配公共 IP 地址或公共负载均衡器来与资源进行入站通信。You can communicate inbound to a resource by assigning a public IP address or a public Load Balancer. 还可以使用公共 IP 或公共负载均衡器来管理出站连接。You can also use public IP or public Load Balancer to manage your outbound connections. 若要详细了解 Azure 中的出站连接,请参阅出站连接公共 IP 地址负载均衡器To learn more about outbound connections in Azure, see Outbound connections, Public IP addresses, and Load Balancer.

备注

仅使用内部标准负载均衡器时,在定义出站连接如何与实例级公共 IP 或公共负载均衡器配合使用之前,出站连接不可用。When using only an internal Standard Load Balancer, outbound connectivity is not available until you define how you want outbound connections to work with an instance-level public IP or a public Load Balancer.

Azure 资源之间的通信Communicate between Azure resources

Azure 资源采用下述某种方式安全地相互通信:Azure resources communicate securely with each other in one of the following ways:

  • 通过虚拟网络:可以将 VM 和多个其他类型的 Azure 资源部署到虚拟网络,如 Azure 应用服务环境、Azure Kubernetes 服务 (AKS) 和 Azure 虚拟机规模集。Through a virtual network: You can deploy VMs, and several other types of Azure resources to a virtual network, such as Azure App Service Environments, the Azure Kubernetes Service (AKS), and Azure Virtual Machine Scale Sets. 若要查看可部署到虚拟网络的 Azure 资源的完整列表,请参阅虚拟网络服务集成To view a complete list of Azure resources that you can deploy into a virtual network, see Virtual network service integration.
  • 通过虚拟网络服务终结点:通过直接连接将虚拟网络专用地址空间和虚拟网络的标识扩展到 Azure 服务资源,例如 Azure 存储帐户和 Azure SQL 数据库。Through a virtual network service endpoint: Extend your virtual network private address space and the identity of your virtual network to Azure service resources, such as Azure Storage accounts and Azure SQL Database, over a direct connection. 使用服务终结点可以保护关键的 Azure 服务资源,只允许在客户自己的虚拟网络中对其进行访问。Service endpoints allow you to secure your critical Azure service resources to only a virtual network. 有关详细信息,请参阅虚拟网络服务终结点概述To learn more, see Virtual network service endpoints overview.
  • 通过 VNet 对等互连:可以互相连接虚拟网络,使虚拟网络中的资源能够通过虚拟网络对等互连相互进行通信。Through VNet Peering: You can connect virtual networks to each other, enabling resources in either virtual network to communicate with each other, using virtual network peering. 连接的虚拟网络可以在相同或不同的 Azure 区域中。The virtual networks you connect can be in the same, or different, Azure regions. 有关详细信息,请参阅虚拟网络对等互连To learn more, see Virtual network peering.

与本地资源通信Communicate with on-premises resources

可组合使用以下任何选项将本地计算机和网络连接到虚拟网络:You can connect your on-premises computers and networks to a virtual network using any combination of the following options:

  • 点到站点虚拟专用网络 (VPN): 在网络中的虚拟网络和单台计算机之间建立连接。Point-to-site virtual private network (VPN): Established between a virtual network and a single computer in your network. 要与虚拟网络建立连接的每台计算机必须配置其连接。Each computer that wants to establish connectivity with a virtual network must configure its connection. 这种连接类型适用于刚开始使用 Azure 的人员或开发人员,因为该连接类型仅需对现有网络作出极少更改或不做任何更改。This connection type is great if you're just getting started with Azure, or for developers, because it requires little or no changes to your existing network. 计算机与虚拟网络之间的通信经 Internet 通过加密的通道来发送。The communication between your computer and a virtual network is sent through an encrypted tunnel over the internet. 若要了解更多信息,请参阅点到站点 VPNTo learn more, see Point-to-site VPN.
  • 站点到站点 VPN: 在本地 VPN 设备和虚拟网络中部署的 Azure VPN 网关之间建立连接。Site-to-site VPN: Established between your on-premises VPN device and an Azure VPN Gateway that is deployed in a virtual network. 此连接类型可使授权的任何本地资源访问虚拟网络。This connection type enables any on-premises resource that you authorize to access a virtual network. 本地 VPN 设备和 Azure VPN 网关之间的通信经 Internet 通过加密的通道来发送。The communication between your on-premises VPN device and an Azure VPN gateway is sent through an encrypted tunnel over the internet. 若要了解更多信息,请参阅站点到站点 VPNTo learn more, see Site-to-site VPN.
  • Azure ExpressRoute: 通过 ExpressRoute 合作伙伴在网络和 Azure 之间建立连接。Azure ExpressRoute: Established between your network and Azure, through an ExpressRoute partner. 此连接是专用连接。This connection is private. 流量不经过 Internet。Traffic does not go over the internet. 若要了解详细信息,请参阅 ExpressRouteTo learn more, see ExpressRoute.

筛选网络流量Filter network traffic

可使用以下两个选项中任意一个或同时使用这两个方案筛选子网之间的网络流量:You can filter network traffic between subnets using either or both of the following options:

  • 网络安全组:网络安全组和应用程序安全组可包含多个入站和出站安全规则,通过这些规则可按源和目标 IP 地址、端口和协议筛选出入资源的流量。Network security groups: Network security groups and application security groups can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by source and destination IP address, port, and protocol. 要了解详细信息,请参阅网络安全组应用程序安全组To learn more, see Network security groups or Application security groups.
  • 网络虚拟设备: 虚拟网络设备是可执行网络功能(例如防火墙、WAN 优化等)的 VM。Network virtual appliances: A network virtual appliance is a VM that performs a network function, such as a firewall, WAN optimization, or other network function. 若要查看可在虚拟网络中部署的网络虚拟设备,请参阅 Azure 市场To view a list of available network virtual appliances that you can deploy in a virtual network, see Azure Marketplace.

路由网络流量Route network traffic

默认情况下,Azure 在子网、连接的虚拟网络、本地网络以及 Internet 之间路由流量。Azure routes traffic between subnets, connected virtual networks, on-premises networks, and the Internet, by default. 可使用以下两个选项中任意一个或同时使用二者替代 Azure 创建的默认路由:You can implement either or both of the following options to override the default routes Azure creates:

  • 路由表: 可创建自定义路由表,其中包含可对每个子网控制流量路由到位置的路由。Route tables: You can create custom route tables with routes that control where traffic is routed to for each subnet. 详细了解路由表Learn more about route tables.
  • 边界网关协议 (BGP) 路由: 如果使用 Azure VPN 网关或 ExpressRoute 连接将虚拟网络连接到本地网络,则可将本地 BGP 路由传播到虚拟网络。Border gateway protocol (BGP) routes: If you connect your virtual network to your on-premises network using an Azure VPN Gateway or ExpressRoute connection, you can propagate your on-premises BGP routes to your virtual networks. 详细了解如何将 BGP 与 Azure VPN 网关ExpressRoute 配合使用。Learn more about using BGP with Azure VPN Gateway and ExpressRoute.

Azure 服务的虚拟网络集成Virtual network integration for Azure services

通过将 Azure 服务集成到 Azure 虚拟网络,可从虚拟机或虚拟网络中的计算资源私密访问服务。Integrating Azure services to an Azure virtual network enables private access to the service from virtual machines or compute resources in the virtual network. 可通过以下选项在虚拟网络中集成 Azure 服务:You can integrate Azure services in your virtual network with the following options:

  • 服务的专用实例部署到虚拟网络中。Deploying dedicated instances of the service into a virtual network. 随后即可在虚拟网络内以及从本地网络私密访问这些服务。The services can then be privately accessed within the virtual network and from on-premises networks.

  • 使用专用链接以专用方式从你的虚拟网络和本地网络访问服务的特定实例。Using Private Link to access privately a specific instance of the service from your virtual network and from on-premises networks.

  • 也可使用公共终结点来访问服务,只需通过服务终结点将虚拟网络扩展到服务即可。You can also access the service using public endpoints by extending a virtual network to the service, through service endpoints. 服务终结点可使服务资源在虚拟网络中得到保护。Service endpoints allow service resources to be secured to the virtual network.

Azure VNet 的限制Azure VNet limits

可部署的 Azure 资源数存在一定的限制。There are certain limits around the number of Azure resources you can deploy. 大多数 Azure 网络限制设置在最大值。Most Azure networking limits are at the maximum values. 但是,你可以根据 VNet 限制页中的指定,提高某些网络限制However, you can increase certain networking limits as specified on the VNet limits page.

定价Pricing

使用 Azure VNet 不会产生费用,它是免费的。There is no charge for using Azure VNet, it is free of cost. 标准费率适用于虚拟机 (VM) 等资源和其他产品。Standard charges are applicable for resources, such as Virtual Machines (VMs) and other products. 有关详细信息,请参阅 VNet 定价和 Azure 定价计算器To learn more, see VNet pricing and the Azure pricing calculator.

后续步骤Next steps