如要使用防火牆限制公開端點的存取權，您可以將 Integration Connectors 設為使用一組靜態 IP 位址，處理來自連線的流量。設定完成後，連線的所有通話都會來自一組靜態 IP 位址，您可以在防火牆中將這些位址加入許可清單。如要允許連線通過防火牆，請完成下列高階步驟：
建立防火牆，並透過防火牆傳送輸出流量。
為連線指派靜態 IP 位址。
在防火牆中將指派的靜態 IP 位址加入許可清單。
本頁面不提供建立及設定防火牆的步驟。本頁面僅說明如何為連線指派靜態 IP 位址。
根據預設，Integration Connectors 會自動分配 IP 位址。不過，您可以設定 Integration Connectors，產生靜態 IP 位址，而非自動 IP 位址。Integration Connectors 會在區域層級指派靜態 IP 位址。舉例來說，us-east1區域的靜態 IP 位址與 us-west2 區域的靜態 IP 位址不同。
如要為連線指派靜態 IP 位址，請按照下列步驟操作：
取得要分配靜態 IP 位址的連線區域。
您可以在「連線」頁面的 Location 欄中查看連線區域。
At the bottom of the Google Cloud console, a
Cloud Shell
session starts and displays a command-line prompt. Cloud Shell is a shell environment
with the Google Cloud CLI
already installed and with values already set for
your current project. It can take a few seconds for the session to initialize.
設定 Integration Connectors，為您在步驟 1 中取得的區域指派靜態 IP 位址。在 Cloud Shell 中執行下列指令：
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eIntegration Connectors can connect directly to publicly accessible backend applications by specifying the endpoint in the \u003ccode\u003eHostname\u003c/code\u003e field, allowing direct access.\u003c/p\u003e\n"],["\u003cp\u003eFor restricted access, Integration Connectors can be configured to use static IP addresses, allowing you to allowlist these addresses in your firewall to control traffic.\u003c/p\u003e\n"],["\u003cp\u003eConfiguring static IP addresses for connections involves creating a firewall, assigning static IPs to connections, and then allowlisting these IPs in the firewall, but detailed firewall creation is not included in this page.\u003c/p\u003e\n"],["\u003cp\u003eStatic IP addresses are assigned at the region level, with different regions having distinct sets of static IP addresses, and you can change between \u003ccode\u003eSTATIC_IP\u003c/code\u003e and \u003ccode\u003eAUTO_IP\u003c/code\u003e modes, but it will generate new IP addresses.\u003c/p\u003e\n"],["\u003cp\u003eYou can use provided commands to configure Integration Connectors to use either static or automatic IP addresses for a specific region and get the IP addresses, with changes between modes causing brief downtimes.\u003c/p\u003e\n"]]],[],null,["Public network connectivity\n\nThis page describes how Integration Connectors can connect to your publicly accessible backend applications.\n\nThe following are the two ways to connect to your public backend application:\n\n- Connect to your public backend application directly.\n- Connect to your public backend application through a firewall.\n\nConnect to your public backend application directly\n\nIf you can publicly connect to your backend application, you can\nconfigure your connection to use the\npublic endpoint by specifying the endpoint in the `Hostname`\nfield. Your connections will have direct access to your backend application.\n\nConnect to your public backend application through a firewall\n\nIn cases where you want to restrict access to your public\nendpoints with a firewall, you can configure\nIntegration Connectors to use a set of static IP addresses for\nthe traffic originating from the connections. After the configuration, all calls from a connection would originate from a set of static IP address, which you can allowlist in your firewall. To allow a connection to connect through a firewall, you must do the following high-level steps:\n\n1. Create a firewall, and route your egress traffic through the firewall.\n2. Assign a static IP address to your connection.\n3. Allowlist the assigned static IP address in your firewall.\n\nSteps to create and configure a firewall are outside the scope of this page. This page only describes\nhow you can assign static IP addresses to your connections.\n\nBy default, Integration Connectors allocates IP addresses automatically. However, you can\nconfigure Integration Connectors to generate static IP addresses instead of an automatic\nIP addresses. Integration Connectors assigns the static IP addresses\nat a region level. For example, the static IP addresses for the `us-east1`\nregion will be different from the static IP addresses in the `us-west2` region.\n\nTo assign static IP addresses to your connection, do the following steps:\n\n1. Get the region of the connection for which you want to allocate the static IP address. You can view the connection region in the `Location` column of the Connections page.\n\n [Go to the Connections page](https://console.cloud.google.com/connectors/connections)\n2. In the Google Cloud console, activate Cloud Shell.\n\n [Activate Cloud Shell](https://console.cloud.google.com/?cloudshell=true)\n\n\n At the bottom of the Google Cloud console, a\n [Cloud Shell](/shell/docs/how-cloud-shell-works)\n session starts and displays a command-line prompt. Cloud Shell is a shell environment\n with the Google Cloud CLI\n already installed and with values already set for\n your current project. It can take a few seconds for the session to initialize.\n | **Tip:**Even though this step mentions to open a Cloud Shell, you can run the commands even on your regular terminal, because you will be calling the Integration Connectors public APIs.\n3. Configure the Integration Connectors to assign static IP address for the region that you got from step 1. Run the following command in your Cloud Shell. \n\n ```verilog\n curl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"networkConfig\": {\"egressMode\": \"static_ip\"}}' \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings?updateMask=\"networkConfig\"\n ```\n\n Set the \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e to the region that you got in step 1.\n\n Running this command, returns a response similar to the following: \n\n ```\n {\n \"name\": \"projects/test-01/locations/us-central1/operations/operation-1696840994443-6074494b6d138-8215226d-516faaf8\",\n \"metadata\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.OperationMetadata\",\n \"createTime\": \"2023-10-09T08:43:14.467058513Z\",\n \"target\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"verb\": \"update\",\n \"requestedCancellation\": false,\n \"apiVersion\": \"v1\"\n },\n \"done\": false\n }\n ```\n\n This command returns an operation ID and starts a long-running operation (LRO) which\n may take some time to complete. Wait for the LRO to complete. You can track the progress of\n the operation by using the following command: \n\n ```scdoc\n curl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/PROJECT_ID/locations/LOCATION/operations/OPERATION_ID\n ```\n\n If the static IP address allocation is successful, you will get a response similar to the following: \n\n ```\n ...\n ...\n \"response\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.RegionalSettings\",\n \"name\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"networkConfig\": {\n \"egressMode\": \"STATIC_IP\",\n \"egressIps\": [\n \"35.193.227.203\",\n \"34.133.63.9\",\n \"35.223.253.58\",\n \"34.170.27.253\"\n ]\n }\n }\n ```\n\n In this sample response, four static IP addresses are allocated for the `us-central1`\n region, and the `egressMode` for the region is set to `STATIC_IP`.\n | **Note:**By default, Integration Connectors assigns auto IP addresses for the connections, and not static IP addresses.\n4. Allowlist the static IP addresses (got in step 4) in your firewall rules.\n\nGet static IP addresses of a region\n\nIf at anytime you want to get the static IP addresses allocated to a region (location), run the following command: \n\n```verilog\ncurl -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings\n```\n\nRunning this command returns a response similar to the following: \n\n```\n \"response\": {\n \"@type\": \"type.googleapis.com/google.cloud.connectors.v1.RegionalSettings\",\n \"name\": \"projects/test-01/locations/us-central1/regionalSettings\",\n \"networkConfig\": {\n \"egressMode\": \"STATIC_IP\",\n \"egressIps\": [\n \"35.193.227.203\",\n \"34.133.63.9\",\n \"35.223.253.58\",\n \"34.170.27.253\"\n ]\n }\n }\n```\n\nAssign auto IP addresses to a region\n\nIf you want to remove the static IP address configuration for a region, and auto assign the\nIP addresses, you must run the following command in your terminal: \n\n```verilog\ncurl -X PATCH -H \"Authorization: Bearer $(gcloud auth print-access-token)\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"networkConfig\": {\"egressMode\": \"auto_ip\"}}' \\\n https://connectors.googleapis.com/v1/projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/locations/\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e/regionalSettings?updateMask=\"networkConfig\"\n```\n\nSimilar to the previous command for configuring static IP addresses, this command also\nreturns an operation ID and starts a long-running operation (LRO) which may take some time to\ncomplete. Wait for the LRO to complete.\n\nConsiderations\n\nConsider the following points when allocating static IP addresses for a region:\n\n- The reserved set of static IP addresses are different for different regions within a project.\n- When you change the egress mode for a region from `STATIC_IP` to `AUTO_IP`, the original set of static IP addresses aren't retained, and therefore, when you again change the egress mode from `AUTO_IP` to `STATIC_IP`, a new set of static IP addresses are allocated.\n- When you change the egress mode from `AUTO_IP` to `STATIC_IP` or the other way around, you can expect a downtime in the order of seconds."]]
