如要在有多個網路時集中部署 Secure Web Proxy，您可以使用 Network Connectivity Center。不過，如果您嘗試透過 Network Connectivity Center 擴大規模，就會遇到一些限制。只要將 Secure Web Proxy 新增為 Private Service Connect 服務連結，即可克服這類限制。您可以按照下列步驟部署 Secure Web Proxy：
建立 Secure Web Proxy 政策和規則。
建立使用政策的 Secure Web Proxy 執行個體。
建立服務連結，將 Secure Web Proxy 執行個體發布為 Private Service Connect 服務。
在需要連線至安全網頁 Proxy 的每個 VPC 網路中，建立 Private Service Connect 用戶端端點。
將工作負載輸出流量導向區域內的集中式 Secure Web Proxy 例項。
在 Private Service Connect 服務附件模式中部署 Secure Web Proxy (按一下可放大)
您可以設定 Secure Web Proxy 部署作業，讓其充當網路中路由的下一個躍點。設定下一個躍點路由，將流量來源指向安全 Web Proxy 執行個體，可減少為每個來源工作負載設定明確 Proxy 變數的管理負擔。如要進一步瞭解如何設定下一個躍點路徑，請參閱「將 Secure Web Proxy 部署為下一個躍點」。
Secure Web Proxy 支援的解決方案
Secure Web Proxy 支援下列解決方案。
遷移至 Google Cloud
Secure Web Proxy 可協助您遷移至 Google Cloud ，同時保留現有的安全政策和輸出網路流量規定。您可以避免使用需要使用其他管理主控台或手動編輯設定檔的第三方解決方案。
存取信任的外部網路服務
Secure Web Proxy 可讓您對輸出網路流量套用精細的存取權政策，方便您保護網路安全。您可以建立及識別工作負載或應用程式身分，然後將政策套用至網站位置。
監控對不受信任的網路服務的存取權
您可以使用 Secure Web Proxy，為不受信任的網路服務提供受監控的存取權。Secure Web Proxy 會識別不符合政策規定的流量，並將流量記錄在 Cloud Logging (Logging) 中。接著，您就能監控網際網路用量、找出網路威脅，並採取因應措施。
Secure Web Proxy 的優點
Secure Web Proxy 提供下列優點：
節省作業時間
Secure Web Proxy 不需要設定 VM，也不需要更新軟體就能維護安全性，而且還提供彈性調整功能。完成初始政策設定後，區域 Secure Web Proxy 執行個體即可運作。Secure Web Proxy 提供的工具可簡化設定、測試和部署作業，讓您能專注於其他工作。
彈性部署
Secure Web Proxy 支援基本和彈性部署作業。Secure Web Proxy 執行個體、Secure Web Proxy 政策和網址清單都是可由不同管理員建立或重複使用的模組物件。例如，您可以部署使用相同 Secure Web Proxy 政策的多個 Secure Web Proxy 執行個體。
強化安全防護
預設的安全網頁 Proxy 設定和政策預設為「全部拒絕」。此外， Google Cloud 會自動更新安全網路 Proxy 軟體和基礎架構，降低安全漏洞風險。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Secure Web Proxy overview\n\nSecure Web Proxy is a cloud first service that\nhelps you secure egress web traffic (HTTP/S). You configure your clients to\nexplicitly use Secure Web Proxy as a gateway. The web requests can originate\nfrom the following sources:\n\n- Virtual machine (VM) instances\n- Containers\n- A serverless environment that uses a serverless connector\n- Workloads outside of Google Cloud connected by Cloud VPN or Cloud Interconnect\n\nSecure Web Proxy enables flexible and granular policies based on\ncloud first identities and web applications.\n\nDeployment modes\n----------------\n\nYou can deploy Secure Web Proxy in the following ways:\n\n### Explicit proxy routing mode\n\nYou can configure your workload environments and clients to explicitly use the\nproxy server. Secure Web Proxy isolates clients from the Internet by creating\nnew TCP connections on behalf of the client, while adhering to the administered\nsecurity policy.\n[](/static/secure-web-proxy/images/explicit-proxy-mode.svg) Secure Web Proxy deployment in the explicit proxy routing mode. (click to enlarge)\n\nFor detailed instructions, see\n[Deploy a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart).\n\n### Private Service Connect service attachment mode\n\nTo centralize your Secure Web Proxy deployment when there are multiple\nnetworks, you can use Network Connectivity Center. But there are some\nlimitations when you try to scale up with Network Connectivity Center. Adding Secure Web Proxy\nas a Private Service Connect service attachment overcomes such\nlimitations. You can deploy Secure Web Proxy as follows:\n\n1. Create a Secure Web Proxy policy and rules.\n2. Create a Secure Web Proxy instance that uses your policy.\n3. Create a service attachment to publish the Secure Web Proxy instance as a Private Service Connect service.\n4. Create a Private Service Connect consumer endpoint in each VPC network that needs to connect to Secure Web Proxy.\n5. Point your workload egress traffic to the centralized Secure Web Proxy instance within the region.\n\n[](/static/secure-web-proxy/images/service-attachment.svg) Secure Web Proxy deployment in the Private Service Connect service attachment mode (click to enlarge)\n\nThe deployment works in a hub and spoke fashion, where the\nSecure Web Proxy is on the egress path for workloads in the various\nconnected VPC networks.\n\nFor detailed instructions, see [Deploy Secure Web Proxy as a service attachment](/secure-web-proxy/docs/deploy-service-attachment).\n\n### Secure Web Proxy as next hop\n\nYou can configure your Secure Web Proxy deployment to act as a next hop for\nrouting in your network. Configuring next hop routing to point traffic sources\nto your Secure Web Proxy instance reduces the administrative overhead of\nconfiguring an explicit proxy variable for each source workload. For more\ninformation about configuring next hop routing, see\n[Deploy Secure Web Proxy as next hop](/secure-web-proxy/docs/deploy-next-hop).\n\nSolutions that Secure Web Proxy supports\n----------------------------------------\n\nSecure Web Proxy supports the following solutions.\n\n### Migration to Google Cloud\n\nSecure Web Proxy helps you migrate to Google Cloud while keeping your\nexisting security policies and requirements for egress web traffic. You can\navoid using third-party solutions that require using another management console\nor manually editing configuration files.\n\n### Access to trusted external web services\n\nSecure Web Proxy lets you apply granular access policies to your egress web\ntraffic so that you can secure your network. You create and identify workload or\napplication identities, and then apply policies to web locations.\n\n### Monitored access to untrusted web services\n\nYou can use Secure Web Proxy to provide monitored access to untrusted web\nservices. Secure Web Proxy identifies traffic that doesn't conform to policy\nand logs it to Cloud Logging (Logging). You can then monitor\ninternet usage, discover threats to your network, and respond to threats.\n\nSecure Web Proxy benefits\n-------------------------\n\nSecure Web Proxy provides the following benefits.\n\n### Operational time savings\n\nSecure Web Proxy doesn't have VMs to set up and configure, doesn't require\nsoftware updates to maintain security, and offers elastic scaling. After initial\npolicy configuration, a regional Secure Web Proxy instance works out of the\nbox. Secure Web Proxy provides tools to simplify setup, testing, and\ndeployment so that you can focus on other tasks.\n\n### Flexible deployment\n\nSecure Web Proxy supports basic and flexible deployments. Secure Web Proxy\ninstances, Secure Web Proxy policies, and URL lists are all modular objects\nthat can be created or reused by distinct administrators. For example, you can\ndeploy multiple Secure Web Proxy instances that all use the same\nSecure Web Proxy policy.\n\n### Improved security\n\nDefault Secure Web Proxy configurations and policies are deny-all by default.\nFurthermore, Google Cloud automatically updates Secure Web Proxy\nsoftware and infrastructure, reducing the risks of security vulnerabilities.\n\nSupported features\n------------------\n\nSecure Web Proxy supports the following features:\n\n- **Autoscaling Secure Web Proxy Envoy proxies:** Supports automatically\n adjusting the Envoy proxy pool size and the pool's capacity in a region,\n which enables consistent performance during high-demand periods at the\n lowest cost.\n\n- **Modular egress access policies:** Secure Web Proxy specifically supports\n the following egress policies:\n\n - Source-identity based on secure tags, service accounts, or IP addresses.\n - Destinations based on URLs, hostnames.\n - Requests based on methods, headers, or URLs. URLs can be specified by using lists, wildcards, or patterns.\n- **End-to-end encryption:** Client-proxy tunnels might transit over TLS.\n Secure Web Proxy also supports HTTP/S `CONNECT` for client-initiated,\n end-to-end TLS connections to the destination server.\n\n- **Cloud Audit Logs and Google Cloud Observability integration:** Cloud Audit Logs and\n Google Cloud Observability record administrative activities and access requests for\n Secure Web Proxy-related resources. They also record metrics and\n transaction logs for requests handled by the proxy.\n\nAdditional Google Cloud tools to consider\n-----------------------------------------\n\nGoogle Cloud provides the following tools for your Google Cloud\ndeployments:\n\n- Use [Google Cloud Armor](/armor/docs/cloud-armor-overview) to protect\n Google Cloud deployments from multiple threats, including\n distributed denial-of-service (DDoS) attacks and application attacks like\n cross-site scripting (XSS) and SQL injection (SQLi).\n\n- Specify [VPC firewall rules](/vpc/docs/firewalls) to secure connections to\n or from your VM instances.\n\n- Implement [VPC Service Controls](/vpc-service-controls/docs/overview) to\n prevent data exfiltration from Google Cloud services, such as\n Cloud Storage and BigQuery.\n\n- Use [Cloud NAT](/nat/docs/overview) to enable unsecured outbound internet\n connectivity for certain Google Cloud resources without an external IP\n address."]]
