如需在存在多个网络的情况下集中部署安全 Web 代理，您可以使用 Network Connectivity Center。不过，在尝试使用 Network Connectivity Center 扩容时，会遇到一些限制。将安全 Web 代理添加为 Private Service Connect 服务连接可以克服此类限制。您可以按如下方式部署安全 Web 代理：
创建安全 Web 代理政策和规则。
创建使用您的政策的安全 Web 代理实例。
创建服务连接，以便将安全 Web 代理实例发布为 Private Service Connect 服务。
在需要连接到安全 Web 代理的每个 VPC 网络中创建一个 Private Service Connect 使用方端点。
将工作负载出站流量指向该区域内的集中式安全 Web 代理实例。
Private Service Connect 服务附加模式下的安全 Web 代理部署（点击可放大）
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Secure Web Proxy overview\n\nSecure Web Proxy is a cloud first service that\nhelps you secure egress web traffic (HTTP/S). You configure your clients to\nexplicitly use Secure Web Proxy as a gateway. The web requests can originate\nfrom the following sources:\n\n- Virtual machine (VM) instances\n- Containers\n- A serverless environment that uses a serverless connector\n- Workloads outside of Google Cloud connected by Cloud VPN or Cloud Interconnect\n\nSecure Web Proxy enables flexible and granular policies based on\ncloud first identities and web applications.\n\nDeployment modes\n----------------\n\nYou can deploy Secure Web Proxy in the following ways:\n\n### Explicit proxy routing mode\n\nYou can configure your workload environments and clients to explicitly use the\nproxy server. Secure Web Proxy isolates clients from the Internet by creating\nnew TCP connections on behalf of the client, while adhering to the administered\nsecurity policy.\n[](/static/secure-web-proxy/images/explicit-proxy-mode.svg) Secure Web Proxy deployment in the explicit proxy routing mode. (click to enlarge)\n\nFor detailed instructions, see\n[Deploy a Secure Web Proxy instance](/secure-web-proxy/docs/quickstart).\n\n### Private Service Connect service attachment mode\n\nTo centralize your Secure Web Proxy deployment when there are multiple\nnetworks, you can use Network Connectivity Center. But there are some\nlimitations when you try to scale up with Network Connectivity Center. Adding Secure Web Proxy\nas a Private Service Connect service attachment overcomes such\nlimitations. You can deploy Secure Web Proxy as follows:\n\n1. Create a Secure Web Proxy policy and rules.\n2. Create a Secure Web Proxy instance that uses your policy.\n3. Create a service attachment to publish the Secure Web Proxy instance as a Private Service Connect service.\n4. Create a Private Service Connect consumer endpoint in each VPC network that needs to connect to Secure Web Proxy.\n5. Point your workload egress traffic to the centralized Secure Web Proxy instance within the region.\n\n[](/static/secure-web-proxy/images/service-attachment.svg) Secure Web Proxy deployment in the Private Service Connect service attachment mode (click to enlarge)\n\nThe deployment works in a hub and spoke fashion, where the\nSecure Web Proxy is on the egress path for workloads in the various\nconnected VPC networks.\n\nFor detailed instructions, see [Deploy Secure Web Proxy as a service attachment](/secure-web-proxy/docs/deploy-service-attachment).\n\n### Secure Web Proxy as next hop\n\nYou can configure your Secure Web Proxy deployment to act as a next hop for\nrouting in your network. Configuring next hop routing to point traffic sources\nto your Secure Web Proxy instance reduces the administrative overhead of\nconfiguring an explicit proxy variable for each source workload. For more\ninformation about configuring next hop routing, see\n[Deploy Secure Web Proxy as next hop](/secure-web-proxy/docs/deploy-next-hop).\n\nSolutions that Secure Web Proxy supports\n----------------------------------------\n\nSecure Web Proxy supports the following solutions.\n\n### Migration to Google Cloud\n\nSecure Web Proxy helps you migrate to Google Cloud while keeping your\nexisting security policies and requirements for egress web traffic. You can\navoid using third-party solutions that require using another management console\nor manually editing configuration files.\n\n### Access to trusted external web services\n\nSecure Web Proxy lets you apply granular access policies to your egress web\ntraffic so that you can secure your network. You create and identify workload or\napplication identities, and then apply policies to web locations.\n\n### Monitored access to untrusted web services\n\nYou can use Secure Web Proxy to provide monitored access to untrusted web\nservices. Secure Web Proxy identifies traffic that doesn't conform to policy\nand logs it to Cloud Logging (Logging). You can then monitor\ninternet usage, discover threats to your network, and respond to threats.\n\nSecure Web Proxy benefits\n-------------------------\n\nSecure Web Proxy provides the following benefits.\n\n### Operational time savings\n\nSecure Web Proxy doesn't have VMs to set up and configure, doesn't require\nsoftware updates to maintain security, and offers elastic scaling. After initial\npolicy configuration, a regional Secure Web Proxy instance works out of the\nbox. Secure Web Proxy provides tools to simplify setup, testing, and\ndeployment so that you can focus on other tasks.\n\n### Flexible deployment\n\nSecure Web Proxy supports basic and flexible deployments. Secure Web Proxy\ninstances, Secure Web Proxy policies, and URL lists are all modular objects\nthat can be created or reused by distinct administrators. For example, you can\ndeploy multiple Secure Web Proxy instances that all use the same\nSecure Web Proxy policy.\n\n### Improved security\n\nDefault Secure Web Proxy configurations and policies are deny-all by default.\nFurthermore, Google Cloud automatically updates Secure Web Proxy\nsoftware and infrastructure, reducing the risks of security vulnerabilities.\n\nSupported features\n------------------\n\nSecure Web Proxy supports the following features:\n\n- **Autoscaling Secure Web Proxy Envoy proxies:** Supports automatically\n adjusting the Envoy proxy pool size and the pool's capacity in a region,\n which enables consistent performance during high-demand periods at the\n lowest cost.\n\n- **Modular egress access policies:** Secure Web Proxy specifically supports\n the following egress policies:\n\n - Source-identity based on secure tags, service accounts, or IP addresses.\n - Destinations based on URLs, hostnames.\n - Requests based on methods, headers, or URLs. URLs can be specified by using lists, wildcards, or patterns.\n- **End-to-end encryption:** Client-proxy tunnels might transit over TLS.\n Secure Web Proxy also supports HTTP/S `CONNECT` for client-initiated,\n end-to-end TLS connections to the destination server.\n\n- **Cloud Audit Logs and Google Cloud Observability integration:** Cloud Audit Logs and\n Google Cloud Observability record administrative activities and access requests for\n Secure Web Proxy-related resources. They also record metrics and\n transaction logs for requests handled by the proxy.\n\nAdditional Google Cloud tools to consider\n-----------------------------------------\n\nGoogle Cloud provides the following tools for your Google Cloud\ndeployments:\n\n- Use [Google Cloud Armor](/armor/docs/cloud-armor-overview) to protect\n Google Cloud deployments from multiple threats, including\n distributed denial-of-service (DDoS) attacks and application attacks like\n cross-site scripting (XSS) and SQL injection (SQLi).\n\n- Specify [VPC firewall rules](/vpc/docs/firewalls) to secure connections to\n or from your VM instances.\n\n- Implement [VPC Service Controls](/vpc-service-controls/docs/overview) to\n prevent data exfiltration from Google Cloud services, such as\n Cloud Storage and BigQuery.\n\n- Use [Cloud NAT](/nat/docs/overview) to enable unsecured outbound internet\n connectivity for certain Google Cloud resources without an external IP\n address."]]
