虛擬網路對等互連Virtual Network peering

虛擬網路對等互連可讓您順暢地連接 Azure Stack Hub 環境中的虛擬網路。Virtual network peering enables you to seamlessly connect virtual networks in an Azure Stack Hub environment. 虛擬網路會以一個作為連線用途。The virtual networks appear as one for connectivity purposes. 虛擬機器之間的流量會使用基礎 SDN 基礎結構。The traffic between virtual machines uses the underlying SDN infrastructure. 如同在相同網路中的虛擬機器之間的流量,流量只會透過 Azure Stack Hub 私人網路路由傳送。Like traffic between virtual machines in the same network, traffic is only routed through the Azure Stack Hub private network.

Azure Stack Hub 不支援全域對等互連,因為「區域」的概念並不適用。Azure Stack Hub does not support global peering, as the concept of "regions" does not apply.

使用虛擬網路對等互連的優點如下:The benefits of using virtual network peering are as follows:

  • 不同虛擬網路的資源之間具有低延遲、高頻寬連線。A low-latency, high-bandwidth connection between resources in different virtual networks.
  • 一個虛擬網路中的資源能夠與不同虛擬網路中的資源進行通訊的能力。The ability of resources in one virtual network to communicate with resources in a different virtual network.
  • 能夠在不同訂用帳戶和 Azure Active Directory 租使用者之間的虛擬網路之間傳輸資料。The ability to transfer data between virtual networks across different subscriptions and Azure Active Directory tenants.
  • 建立對等互連時或建立對等互連之後,虛擬網路中的資源沒有停機時間。No downtime to resources in either virtual network when creating the peering, or after the peering is created.

對等互連虛擬網路之間的網路流量為私用。Network traffic between peered virtual networks is private. 虛擬網路之間的流量會保留在基礎結構層中。Traffic between virtual networks is kept in the infrastructure layer. 虛擬網路之間的通訊不需要公用網際網路、閘道或加密。No public internet, gateways, or encryption is required in the communication between virtual networks.

連線能力Connectivity

針對對等互連虛擬網路,任一虛擬網路中的資源都可以直接連線至對等互連虛擬網路中的資源。For peered virtual networks, resources in either virtual network can directly connect with resources in the peered virtual network.

在相同區域的對等互連虛擬網路中,虛擬機器之間的網路延遲與單一虛擬網路中的網路延遲相同。The network latency between virtual machines in peered virtual networks in the same region is the same as the latency within a single virtual network. 網路輸送量為依照虛擬機器大小,按比例允許的頻寬。The network throughput is based on the bandwidth that's allowed for the virtual machine, proportionate to its size. 對等互連內的頻寬沒有其他額外限制。There isn't any additional restriction on bandwidth within the peering.

對等互連虛擬網路中虛擬機器之間的流量會直接透過 SDN 層路由傳送,而不是透過閘道或透過公用網際網路來路由傳送。The traffic between virtual machines in peered virtual networks is routed directly through the SDN layer, not through a gateway or over the public internet.

您可以在任一個虛擬網路中套用網路安全性群組,以封鎖對其他虛擬網路或子網的存取。You can apply network security groups in either virtual network to block access to other virtual networks or subnets. 設定虛擬網路對等互連時,請開啟或關閉虛擬網路之間的網路安全性群組規則。When configuring virtual network peering, either open or close the network security group rules between the virtual networks. 如果您開啟對等互連虛擬網路之間的完整連線,您可以套用網路安全性群組以封鎖或拒絕特定的存取。If you open full connectivity between peered virtual networks, you can apply network security groups to block or deny specific access. [完全連接] 是預設選項。Full connectivity is the default option. 若要深入瞭解網路安全性群組,請參閱 安全性群組To learn more about network security groups, see Security groups.

服務鏈結Service chaining

服務鏈可讓您透過使用者定義的路由,將流量從一個虛擬網路導向至對等互連網路中的虛擬裝置或閘道。Service chaining enables you to direct traffic from one virtual network to a virtual appliance or gateway in a peered network through user-defined routes.

若要啟用服務鏈,請設定使用者定義的路由,以指向對等互連虛擬網路中的虛擬機器做為 下一個躍點 IP 位址。To enable service chaining, configure user-defined routes that point to virtual machines in peered virtual networks as the next hop IP address.

您可以部署 中樞和輪輻 網路,其中中樞虛擬網路會裝載基礎結構元件,例如網路虛擬裝置或 VPN 閘道。You can deploy hub-and-spoke networks, where the hub virtual network hosts infrastructure components such as a network virtual appliance or VPN gateway. 所有輪輻虛擬網路可以接著與中樞虛擬網路對等互連。All the spoke virtual networks can then peer with the hub virtual network. 流量會流經中樞虛擬網路中的網路虛擬裝置或 VPN 閘道。Traffic flows through network virtual appliances or VPN gateways in the hub virtual network.

虛擬網路對等互連可讓使用者定義路由中的下一個躍點成為對等互連虛擬網路中虛擬機器的 IP 位址。Virtual network peering enables the next hop in a user-defined route to be the IP address of a virtual machine in the peered virtual network. 若要深入了解使用者定義的路由,請參閱使用者定義的路由概觀To learn more about user-defined routes, see User-defined routes overview. 若要瞭解如何建立中樞和輪輻網路拓撲,請參閱 Azure 中的中樞輪輻網路拓撲To learn how to create a hub and spoke network topology, see Hub-spoke network topology in Azure.

閘道及內部部署連線能力Gateways and on-premises connectivity

每個虛擬網路(包括對等互連虛擬網路)都可以有自己的閘道。Each virtual network, including a peered virtual network, can have its own gateway. 虛擬網路可以使用其閘道來連接到內部部署網路。A virtual network can use its gateway to connect to an on-premises network. 請參閱 虛擬網路閘道檔Please review the Virtual Network Gateway documentation.

您也可以將對等互連虛擬網路中的閘道設定為內部部署網路的傳輸點。You can also configure the gateway in the peered virtual network as a transit point to an on-premises network. 在此情況下,使用遠端閘道的虛擬網路不能有自己的閘道。In this case, the virtual network that is using a remote gateway can't have its own gateway. 虛擬網路只有一個閘道。A virtual network has only one gateway. 閘道可以是對等互連虛擬網路中的本機或遠端閘道,如下圖所示:The gateway is either a local or remote gateway in the peered virtual network, as shown in the following figure:

VPN 閘道拓撲

請注意,在對等互連中啟用 >useremotegateways 選項之前,必須先在 VPN 閘道中建立 連接 物件。Note that a Connection object must be created in the VPN gateway prior to enabling the UseRemoteGateways options in the peering.

虛擬網路對等互連設定Virtual network peering configuration

允許虛擬網路存取: 啟用虛擬網路之間的通訊,可讓連線至任一虛擬網路的資源彼此通訊,其頻寬和延遲就如同連線到相同的虛擬網路一樣。Allow virtual network access: Enabling communication between virtual networks allows resources connected to either virtual network to communicate with each other with the same bandwidth and latency as if they were connected to the same virtual network. 這兩個虛擬網路中資源之間的所有通訊都會透過內部 SDN 層來路由傳送。All communication between resources in the two virtual networks is routed through the internal SDN layer.

未啟用網路存取的其中一個原因可能是您已使用另一個虛擬網路對等互連虛擬網路,但偶爾想要停用兩個虛擬網路之間的流量流程。One reason to not enable network access might be a scenario where you've peered a virtual network with another virtual network, but occasionally want to disable traffic flow between the two virtual networks. 您可能會發現啟用/停用比刪除和重新建立對等互連更方便。You might find enabling/disabling is more convenient than deleting and re-creating peerings. 停用此設定時,流量不會在對等互連的虛擬網路之間流動。When this setting is disabled, traffic does not flow between the peered virtual networks.

允許轉寄的流量: 若要允許虛擬網路中網路虛擬設備 (不是源自虛擬網路)「所轉送的」流量透過對等互連流向此虛擬網路,請選取此方塊。Allow forwarded traffic: Check this box to allow traffic forwarded by a network virtual appliance in a virtual network (that didn't originate from the virtual network) to flow to this virtual network through a peering. 例如,假設有三個虛擬網路,分別名為 Spoke1、Spoke2 及 Hub。For example, consider three virtual networks named Spoke1, Spoke2, and Hub. 每個支點 (Spoke) 虛擬網路與中樞 (Hub) 虛擬網路之間都有對等互連,但支點虛擬網路之間並沒有對等互連。A peering exists between each spoke virtual network and the Hub virtual network, but peerings don't exist between the spoke virtual networks. 在中樞虛擬網路中已部署一個網路虛擬設備,並且在每個支點虛擬網路都套用了使用者定義的路由,可透過該網路虛擬設備來路由傳送子網路之間的流量。A network virtual appliance is deployed in the Hub virtual network, and user-defined routes are applied to each spoke virtual network that route traffic between the subnets through the network virtual appliance. 如果未核取此核取方塊以進行每個輪輻虛擬網路和中樞虛擬網路之間的對等互連,流量就不會在輪輻虛擬網路之間流動,因為中樞不會轉送虛擬網路之間的流量。If this checkbox is not checked for the peering between each spoke virtual network and the hub virtual network, traffic doesn't flow between the spoke virtual networks because the hub is not forwarding the traffic between the virtual networks. 啟用這項功能雖能允許轉送的流量通過對等互連,卻不會建立任何使用者定義的路由或網路虛擬設備。While enabling this capability allows the forwarded traffic through the peering, it does not create any user-defined routes or network virtual appliances. 使用者定義的路由和網路虛擬設備是另外建立的。User-defined routes and network virtual appliances are created separately. 了解使用者定義的路由Learn about user-defined routes. 如果透過 VPN 閘道在虛擬網路之間轉送流量,則不需要檢查此設定。You do not need to check this setting if traffic is forwarded between virtual networks through a VPN Gateway.

允許閘道傳輸: 如果您有連接到此虛擬網路的虛擬網路閘道,且想要允許來自對等互連虛擬網路的流量流經閘道,請核取此方塊。Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network, and want to allow traffic from the peered virtual network to flow through the gateway. 例如,此虛擬網路可能會透過虛擬網路閘道連結到內部部署網路。For example, this virtual network may be attached to an on-premises network through a virtual network gateway. 核取此方塊可允許來自對等互連虛擬網路的流量,流經連結到此虛擬網路的閘道,再流向內部部署網路。Checking this box allows traffic from the peered virtual network to flow through the gateway attached to this virtual network to the on-premises network. 如果您核取此方塊,對等互連的虛擬網路將無法設定閘道。If you check this box, the peered virtual network cannot have a gateway configured. 設定從其他虛擬網路到這個虛擬網路的對等互連時,對等互連虛擬網路必須核取 [ 使用遠端閘道 ] 方塊。The peered virtual network must have the Use remote gateways box checked when setting up the peering from the other virtual network to this virtual network. 如果您讓此方塊保持未核取 (預設) ,來自對等互連虛擬網路的流量仍會流向此虛擬網路,但無法流經連接到此虛擬網路的虛擬網路閘道。If you leave this box unchecked (the default), traffic from the peered virtual network still flows to this virtual network, but cannot flow through a virtual network gateway attached to this virtual network.

使用遠端閘道: 核取此方塊可讓來自此虛擬網路的流量能夠流經連結到所要對等互連之虛擬網路的虛擬網路閘道。Use remote gateways: Check this box to allow traffic from this virtual network to flow through a virtual network gateway attached to the virtual network you're peering with. 例如,您要對等互連的虛擬網路已連結 VPN 閘道,而能夠與內部部署網路通訊。For example, the virtual network you're peering with has a VPN gateway attached that enables communication to an on-premises network. 核取此方塊將可讓來自此虛擬網路的流量流經連結到對等互連虛擬網路的 VPN 閘道。Checking this box allows traffic from this virtual network to flow through the VPN gateway attached to the peered virtual network. 如果您核取此方塊,對等互連虛擬網路必須有連接的虛擬網路閘道,而且必須核取 [ 允許閘道傳輸 ] 方塊。If you check this box, the peered virtual network must have a virtual network gateway attached to it and must have the Allow gateway transit box checked. 如果您讓此方塊保持未核取狀態 (預設) ,來自對等互連虛擬網路的流量仍可以流向此虛擬網路,但無法流經連接到此虛擬網路的虛擬網路閘道。If you leave this box unchecked (the default), traffic from the peered virtual network can still flow to this virtual network, but cannot flow through a virtual network gateway attached to this virtual network.

如果您已在虛擬網路中設定閘道,就無法使用遠端閘道。You can't use remote gateways if you already have a gateway configured in your virtual network.

權限Permissions

請確定在不同訂用帳戶和 Azure AD 租使用者中使用 Vnet 建立對等互連時,帳戶已獲派「 參與者 」角色。Please ensure that when creating peerings with VNETs in different subscriptions and Azure AD tenants, the accounts have the Contributor role assigned. 此外,不同 Azure AD 租使用者之間的對等互連沒有使用者介面功能。Additionally, there is no user interface capability for peering between different Azure AD tenants. 您可以使用 Azure CLI 和 PowerShell 來建立對等互連。You can use Azure CLI and PowerShell to create the peerings.

虛擬網路對等互連常見問題 (常見問題) Virtual network peering frequently asked questions (FAQ)

什麼是虛擬網路對等互連?What is Virtual network peering?

虛擬網路對等互連可讓您連接虛擬網路。Virtual network peering enables you to connect virtual networks. 虛擬網路之間的 VNet 對等互連連線可讓您私下透過 IPv4 位址在虛擬網路之間路由傳送流量。A VNet peering connection between virtual networks enables you to route traffic between them privately through IPv4 addresses. 所對等互連 VNet 中的虛擬機器可以彼此通訊,彷彿它們位於相同的網路內。Virtual machines in the peered VNets can communicate with each other as if they are within the same network. VNet 對等互連連接也可以跨多個訂用帳戶建立。VNet peering connections can also be created across multiple subscriptions.

Azure Stack Hub 是否支援全域 VNET 對等互連?Does Azure Stack Hub support Global VNET peering?

Azure Stack Hub 不支援全域對等互連,因為「區域」的概念並不適用。Azure Stack Hub does not support global peering, as the concept of "regions" does not apply.

虛擬網路對等互連會在哪個 Azure Stack Hub 更新?On which Azure Stack Hub update will virtual network peering be available?

從2008更新開始,Azure Stack Hub 可以使用虛擬網路對等互連。virtual network peering is available in Azure Stack Hub starting with the 2008 update.

我可以將 Azure Stack Hub 中的虛擬網路對等互連至 Azure 中的虛擬網路嗎?Can I peer my virtual network in Azure Stack Hub to a virtual network in Azure?

否,目前不支援 Azure 與 Azure Stack hub 之間的對等互連。No, peering between Azure and Azure Stack hub is not supported at this time.

我可以將 Azure Stack Hub1 中的虛擬網路對等互連至 Azure Stack Hub2 中的虛擬網路嗎?Can I peer my virtual network in Azure Stack Hub1 to a virtual network in Azure Stack Hub2?

否,只能在一個 Azure Stack Hub 系統中的虛擬網路之間建立對等互連。No, peering can only be created between virtual networks in one Azure Stack Hub system. 如需如何從不同戳記連接兩個虛擬網路的詳細資訊,請參閱 Azure Stack Hub 中的建立 vnet 對 vnet連線。For more information about how to connect two virtual networks from different stamps, see Establish a VNET to VNET connection in Azure Stack Hub.

如果我的虛擬網路屬於不同 Azure Active Directory 租使用者內的訂用帳戶,是否可以啟用對等互連?Can I enable peering if my virtual networks belong to subscriptions within different Azure Active Directory tenants?

是。Yes. 如果您的訂用帳戶屬於不同的 Azure Active Directory 租使用者,則可以建立 VNet 對等互連。It is possible to establish VNet Peering if your subscriptions belong to different Azure Active Directory tenants. 您可以透過 PowerShell 或 CLI 執行此動作。You can do this via PowerShell or CLI. 尚未支援入口網站。The portal is not yet supported.

我可以將虛擬網路與不同訂用帳戶中的虛擬網路進行對等互連嗎?Can I peer my virtual network with a virtual network in a different subscription?

是。Yes. 您可以跨訂用帳戶對等互連虛擬網路。You can peer virtual networks across subscriptions.

對等互連連線是否有任何頻寬限制?Are there any bandwidth limitations for peering connections?

否。No. 虛擬網路對等互連不會強加任何頻寬限制。Virtual network peering does not impose any bandwidth restrictions. 頻寬只受限於 VM 或計算資源。Bandwidth is only limited by the VM or the compute resource.

我的虛擬網路對等互連連線處於 起始 狀態,為什麼無法連線?My virtual network peering connection is in an Initiated state, why can't I connect?

如果您的對等互連連線處於 起始 狀態,即表示您只建立了一個連結。If your peering connection is in an Initiated state, it means you have created only one link. 必須建立雙向連結,才能建立成功的連線。A bidirectional link must be created in order to establish a successful connection. 例如,若要將 VNet A 對等互連至 VNet B,您必須從 VNet A 建立連結至 VNet B,並從 VNet B 建立連結至 VNet A。建立這兩個連結會將狀態變更為 [ 已連線 ]。For example, to peer VNet A to VNet B, a link must be created from VNet A to VNet B, and from VNet B to VNet A. Creating both links changes the state to Connected.

我的虛擬網路對等互連連線處於 中斷 線上狀態,為什麼無法建立對等互連連線?My virtual network peering connection is in a Disconnected state, why can't I create a peering connection?

如果您的虛擬網路對等互連連線處於「已 中斷 連線」狀態,則表示已刪除其中一個所建立的連結。If your virtual network peering connection is in a Disconnected state, it means one of the links created was deleted. 若要重新建立對等互連連線,請刪除該連結並重新建立。In order to re-establish a peering connection, delete the link and recreate it.

虛擬網路對等互連流量是否已加密?Is virtual network peering traffic encrypted?

否。No. 對等互連虛擬網路中資源之間的流量是私人且隔離的。Traffic between resources in peered virtual networks is private and isolated. 它會完全保留在 Azure Stack Hub 系統的 SDN 層中。It remains completely in the SDN layer of the Azure Stack Hub system.

如果我將 VNet A 對 vnet B 進行對等互連,並將 VNet B 對等互連至 VNet C,這是否表示 VNet A 和 VNet C 都是對等互連?If I peer VNet A to VNet B and I peer VNet B to VNet C, does that mean VNet A and VNet C are peered?

否。No. 目前不支援轉移的對等互連。Transitive peering is not supported. 您必須對等互連 VNet A 和 VNet C。You must peer VNet A and VNet C.

後續步驟Next steps