什么是 Azure 虚拟网络?What is Azure Virtual Network?

Azure 虚拟网络 (VNet) 是 Azure 中专用网络的基本构建块。Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. VNet 允许许多类型的 Azure 资源(例如 Azure 虚拟机 (VM))以安全方式彼此通信、与 Internet 通信,以及与本地网络通信。VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the internet, and on-premises networks. VNet 类似于在你在自己的数据中心运营的传统网络,但附带了 Azure 基础设施的其他优势,例如可伸缩性、可用性和隔离性。VNet is similar to a traditional network that you'd operate in your own data center, but brings with it additional benefits of Azure's infrastructure such as scale, availability, and isolation.

VNet 概念VNet concepts

  • 地址空间: 创建 VNet 时,必须使用公共和专用 (RFC 1918) 地址指定自定义的专用 IP 地址空间。Address space: When creating a VNet, you must specify a custom private IP address space using public and private (RFC 1918) addresses. Azure 从分配的地址空间中向虚拟网络中的资源分配一个专用 IP 地址。Azure assigns resources in a virtual network a private IP address from the address space that you assign. 例如,如果在地址空间为 10.0.0.0/16 的 VNet 中部署某个 VM,将为该 VM 分配类似于 10.0.0.4 的专用 IP。For example, if you deploy a VM in a VNet with address space, 10.0.0.0/16, the VM will be assigned a private IP like 10.0.0.4.

  • 子网: 使用子网可将虚拟网络划分为一个或多个子网络,并向每个子网分配一部分虚拟网络地址空间。Subnets: Subnets enable you to segment the virtual network into one or more sub-networks and allocate a portion of the virtual network's address space to each subnet. 然后,可以在特定的子网中部署 Azure 资源。You can then deploy Azure resources in a specific subnet. 就像在传统网络中一样,使用子网可将 VNet 地址空间划分为适合组织内部网络的网段。Just like in a traditional network, subnets allow you to segment your VNet address space into segments that are appropriate for the organization's internal network. 这还会提高地址分配效率。This also improves address allocation efficiency. 可以使用网络安全组保护子网中的资源。You can secure resources within subnets using Network Security Groups. 有关详细信息,请参阅安全组For more information, see Security groups.

  • 区域:VNet 局限于一个区域/位置;但是,可以使用虚拟网络对等互连将不同区域的多个虚拟网络连接起来。Regions: VNet is scoped to a single region/location; however, multiple virtual networks from different regions can be connected together using Virtual Network Peering.

  • 订阅: VNet 的范围限定为订阅。Subscription: VNet is scoped to a subscription. 可在每个 Azure 订阅和 Azure 区域中实现多个虚拟网络。You can implement multiple virtual networks within each Azure subscription and Azure region.

最佳实践Best practices

在 Azure 中构建网络时,必须记住以下通用设计原则:As you build your network in Azure, it is important to keep in mind the following universal design principles:

  • 确保地址空间不重叠。Ensure non-overlapping address spaces. 确保 VNet 地址空间(CIDR 块)不与组织的其他网络范围重叠。Make sure your VNet address space (CIDR block) does not overlap with your organization's other network ranges.
  • 子网不应涵盖 VNet 的整个地址空间。Your subnets should not cover the entire address space of the VNet. 提前规划,为将来留出一些地址空间。Plan ahead and reserve some address space for the future.
  • 建议使用少量的大型 VNet,而不要使用多个小型 VNet。It is recommended you have fewer large VNets than multiple small VNets. 这可以防止出现管理开销。This will prevent management overhead.
  • 使用网络完全组 (NSG) 保护 VNet。Secure your VNet using Network Security Groups (NSGs).

与 Internet 通信Communicate with the internet

默认情况下,VNet 中的所有资源都可以与 Internet 进行出站通信。All resources in a VNet can communicate outbound to the internet, by default. 可以通过分配公共 IP 地址或公共负载均衡器来与资源进行入站通信。You can communicate inbound to a resource by assigning a public IP address or a public Load Balancer. 还可以使用公共 IP 或公共负载均衡器来管理出站连接。You can also use public IP or public Load Balancer to manage your outbound connections. 若要详细了解 Azure 中的出站连接,请参阅出站连接公共 IP 地址负载均衡器To learn more about outbound connections in Azure, see Outbound connections, Public IP addresses, and Load Balancer.

Note

仅使用内部标准负载均衡器时,在定义出站连接如何与实例级公共 IP 或公共负载均衡器配合使用之前,出站连接不可用。When using only an internal Standard Load Balancer, outbound connectivity is not available until you define how you want outbound connections to work with an instance-level public IP or a public Load Balancer.

Azure 资源之间的通信Communicate between Azure resources

Azure 资源采用下述某种方式安全地相互通信:Azure resources communicate securely with each other in one of the following ways:

  • 通过虚拟网络:可以将 VM 和多个其他类型的 Azure 资源部署到虚拟网络,如 Azure 应用服务环境、Azure Kubernetes 服务 (AKS) 和 Azure 虚拟机规模集。Through a virtual network: You can deploy VMs, and several other types of Azure resources to a virtual network, such as Azure App Service Environments, the Azure Kubernetes Service (AKS), and Azure Virtual Machine Scale Sets. 若要查看可部署到虚拟网络的 Azure 资源的完整列表,请参阅虚拟网络服务集成To view a complete list of Azure resources that you can deploy into a virtual network, see Virtual network service integration.
  • 通过虚拟网络服务终结点:通过直接连接将虚拟网络专用地址空间和虚拟网络的标识扩展到 Azure 服务资源,例如 Azure 存储帐户和 Azure SQL 数据库。Through a virtual network service endpoint: Extend your virtual network private address space and the identity of your virtual network to Azure service resources, such as Azure Storage accounts and Azure SQL databases, over a direct connection. 使用服务终结点可以保护关键的 Azure 服务资源,只允许在客户自己的虚拟网络中对其进行访问。Service endpoints allow you to secure your critical Azure service resources to only a virtual network. 有关详细信息,请参阅虚拟网络服务终结点概述To learn more, see Virtual network service endpoints overview.
  • 通过 VNet 对等互连:可以互相连接虚拟网络,使虚拟网络中的资源能够通过虚拟网络对等互连相互进行通信。Through VNet Peering: You can connect virtual networks to each other, enabling resources in either virtual network to communicate with each other, using virtual network peering. 连接的虚拟网络可以在相同或不同的 Azure 区域中。The virtual networks you connect can be in the same, or different, Azure regions. 有关详细信息,请参阅虚拟网络对等互连To learn more, see Virtual network peering.

与本地资源通信Communicate with on-premises resources

可组合使用以下任何选项将本地计算机和网络连接到虚拟网络:You can connect your on-premises computers and networks to a virtual network using any combination of the following options:

  • 点到站点虚拟专用网络 (VPN): 在网络中的虚拟网络和单台计算机之间建立连接。Point-to-site virtual private network (VPN): Established between a virtual network and a single computer in your network. 要与虚拟网络建立连接的每台计算机必须配置其连接。Each computer that wants to establish connectivity with a virtual network must configure its connection. 这种连接类型适用于刚开始使用 Azure 的人员或开发人员,因为该连接类型仅需对现有网络作出极少更改或不做任何更改。This connection type is great if you're just getting started with Azure, or for developers, because it requires little or no changes to your existing network. 计算机与虚拟网络之间的通信经 Internet 通过加密的通道来发送。The communication between your computer and a virtual network is sent through an encrypted tunnel over the internet. 若要了解更多信息,请参阅点到站点 VPNTo learn more, see Point-to-site VPN.
  • 站点到站点 VPN: 在本地 VPN 设备和虚拟网络中部署的 Azure VPN 网关之间建立连接。Site-to-site VPN: Established between your on-premises VPN device and an Azure VPN Gateway that is deployed in a virtual network. 此连接类型可使授权的任何本地资源访问虚拟网络。This connection type enables any on-premises resource that you authorize to access a virtual network. 本地 VPN 设备和 Azure VPN 网关之间的通信经 Internet 通过加密的通道来发送。The communication between your on-premises VPN device and an Azure VPN gateway is sent through an encrypted tunnel over the internet. 若要了解更多信息,请参阅站点到站点 VPNTo learn more, see Site-to-site VPN.
  • Azure ExpressRoute: 通过 ExpressRoute 合作伙伴在网络和 Azure 之间建立连接。Azure ExpressRoute: Established between your network and Azure, through an ExpressRoute partner. 此连接是专用连接。This connection is private. 流量不经过 Internet。Traffic does not go over the internet. 若要了解详细信息,请参阅 ExpressRouteTo learn more, see ExpressRoute.

筛选网络流量Filter network traffic

可使用以下两个选项中任意一个或同时使用这两个方案筛选子网之间的网络流量:You can filter network traffic between subnets using either or both of the following options:

  • 安全组: 网络安全组和应用程序安全组可包含多个入站和出站安全规则,通过这些规则可按源和目标 IP 地址、端口和协议筛选出入资源的流量。Security groups: Network security groups and application security groups can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by source and destination IP address, port, and protocol. 要了解详细信息,请参阅网络安全组应用程序安全组To learn more, see Network security groups or Application security groups.
  • 网络虚拟设备: 虚拟网络设备是可执行网络功能(例如防火墙、WAN 优化等)的 VM。Network virtual appliances: A network virtual appliance is a VM that performs a network function, such as a firewall, WAN optimization, or other network function. 若要查看可在虚拟网络中部署的网络虚拟设备,请参阅 Azure 市场To view a list of available network virtual appliances that you can deploy in a virtual network, see Azure Marketplace.

路由网络流量Route network traffic

默认情况下,Azure 在子网、连接的虚拟网络、本地网络以及 Internet 之间路由流量。Azure routes traffic between subnets, connected virtual networks, on-premises networks, and the Internet, by default. 可使用以下两个选项中任意一个或同时使用二者替代 Azure 创建的默认路由:You can implement either or both of the following options to override the default routes Azure creates:

  • 路由表: 可创建自定义路由表,其中包含可对每个子网控制流量路由到位置的路由。Route tables: You can create custom route tables with routes that control where traffic is routed to for each subnet. 详细了解路由表Learn more about route tables.
  • 边界网关协议 (BGP) 路由: 如果使用 Azure VPN 网关或 ExpressRoute 连接将虚拟网络连接到本地网络,则可将本地 BGP 路由传播到虚拟网络。Border gateway protocol (BGP) routes: If you connect your virtual network to your on-premises network using an Azure VPN Gateway or ExpressRoute connection, you can propagate your on-premises BGP routes to your virtual networks. 详细了解如何将 BGP 与 Azure VPN 网关ExpressRoute 配合使用。Learn more about using BGP with Azure VPN Gateway and ExpressRoute.

Azure VNet 的限制Azure VNet limits

可部署的 Azure 资源数存在一定的限制。There are certain limits around the number of Azure resources you can deploy. 大多数 Azure 网络限制设置在最大值。Most Azure networking limits are at the maximum values. 但是,你可以根据 VNet 限制页中的指定,提高某些网络限制However, you can increase certain networking limits as specified on the VNet limits page.

定价Pricing

使用 Azure VNet 不会产生费用,它是免费的。There is no charge for using Azure VNet, it is free of cost. 标准费率适用于虚拟机 (VM) 等资源和其他产品。Standard charges are applicable for resources, such as Virtual Machines (VMs) and other products. 有关详细信息,请参阅 VNet 定价和 Azure 定价计算器To learn more, see VNet pricing and the Azure pricing calculator.

后续步骤Next steps

若要使用虚拟网络来入门,请先创建一个虚拟网络,向其部署一些 VM,然后在 VM 之间通信。To get started using a virtual network, create one, deploy a few VMs to it, and communicate between the VMs. 有关详细信息,请参阅创建虚拟网络快速入门。To learn how, see the Create a virtual network quickstart.