[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Known limitations\n\nThis guide describes the known limitations of Secure Web Proxy.\n\nCloud NAT limitations\n---------------------\n\nEach Secure Web Proxy instance requires a Cloud NAT gateway that is enabled\nonly for the Secure Web Proxy endpoints in that region. The first\nSecure Web Proxy provisioned in a Virtual Private Cloud (VPC) network region\nalso provisions a Cloud NAT gateway. The Cloud NAT gateway\nenables egress for all Secure Web Proxy instances in that virtual network and\nregion.\n\nOnly IPv4 is supported\n----------------------\n\nSecure Web Proxy only supports IPv4. IPv6 is not supported.\n\nInternal IP addresses are regional\n----------------------------------\n\nSecure Web Proxy allocates virtual IP addresses within a region. The virtual\nIP addresses are reachable only in the region that they are assigned. Also,\nSecure Web Proxy instances are provisioned in a region within a\nVPC network. As a result, IPv4 addresses must be allocated from\nwithin a subnet of the region that the Secure Web Proxy instance is located\nin.\n\nThe following describes how Secure Web Proxy allocates IP addresses:\n\n- If an unreserved IP address is specified during provisioning, then that IP address is used.\n- If an IP address isn't specified but a subnet and network are specified, then an IP address is automatically allocated within the specified subnet.\n- If an IP address, subnet, and network aren't specified, then an IP address is automatically allocated within the default subnet of the default network.\n\nIP provisioning fails if none of the preceding items are met.\n\nThe IP addresses allocated by Secure Web Proxy are virtual IPs and are\nassigned to a group of proxies distributed across multiple cells within a\nregion. Secure Web Proxy acts as an explicit proxy server, which requires\nclients to have connectivity to the virtual IP address to pass egress HTTP(S)\ntraffic. Clients that have connectivity to the virtual IP address can access\nSecure Web Proxy through the following methods:\n\n- VPC Network Peering\n- Shared VPC\n- On-premises by using Cloud VPN or Cloud Interconnect\n\nSupported HTTP versions\n-----------------------\n\nHTTP versions 0.9, 1.0, 1.1, and 2.0 are supported. HTTP 3 is not supported.\n\nSecure Web Proxy in Shared VPC\n------------------------------\n\nYou can only deploy Secure Web Proxy in a host project. You cannot deploy\nSecure Web Proxy in a service project.\n\nSecurity rule creation race condition\n-------------------------------------\n\nWhen you create a large number of Secure Web Proxy security rules in\nparallel by using Terraform, you may encounter a race condition. As a\nworkaround, use the `terraform apply` command with `--parallelism=1`.\n\nSecure Web Proxy in Private Service Connect\n-------------------------------------------\n\nSecure Web Proxy does not support `RoutingMode` set to\n`NEXT_HOP_ROUTING_MODE` with Private Service Connect service\nattachment.\n\nSupported number of frontend ports\n----------------------------------\n\nSecure Web Proxy supports a maximum of five frontend ports. You can't change\nthe selected ports after [creating a gateway](/secure-web-proxy/docs/quickstart#create-a-gateway)."]]
