适用于本地主机的专用 Google 访问通道：使用 IP 地址子网范围 199.36.153.8/30 (private.googleapis.com) 或 199.36.153.4/30 (restricted.googleapis.com) 访问 REGION-aiplatform.googleapis.com。
Google API 的 Private Service Connect 端点：使用用户定义的内部 IP 地址（例如 10.0.0.100）来访问 REGION-aiplatform.googleapis.com 或已分配的 DNS 名称（例如 aiplatform-genai1.p.googleapis.com）。
如果您的应用使用 Vertex AI 支持的访问方法表中列出的 Google 服务，则您的应用可以通过对服务端点 (REGION-aiplatform.googleapis.com) 执行 DNS 查找来访问 API，该端点会返回公共可路由的虚拟 IP 地址。只要有互联网连接，您就可以在世界任何地方使用该 API。但是，从 Google Cloud 资源发送到这些 IP 地址的流量仍保留在 Google 的网络中。
对 Vertex AI API 的专用访问
专用访问通道是通过互联网连接到 Google API 和服务的替代方案。它可提供更高的带宽、可靠性和一致的性能。 Google Cloud 支持通过混合网络服务（例如 Cloud Interconnect、Cross-Cloud Interconnect、HA VPN over Cloud Interconnect 和 SD-WAN）以专用方式访问 Google API。
通过 Private Service Connect，您可以使用 VPC 网络中的全局内部 IP 地址创建专用端点。
您可以使用有意义的名称（例如 aiplatform-genai1.p.googleapis.com 和 bigtable-adsteam.p.googleapis.com）将这些 DNS 名称分配给这些内部 IP 地址。这些名称和 IP 地址均属于 VPC 网络以及通过混合网络服务连接到该网络的任何本地网络的内部资源。您可以控制要将哪些流量引导至哪个端点，并且可以证明流量保留在 Google Cloud中。
您可以创建用户定义的全球 Private Service Connect 端点 IP 地址 (/32)。如需了解详情，请参阅 IP 地址要求。
您可以在与 Cloud Router 相同的 VPC 网络中创建 Private Service Connect 端点。
您可以使用有意义的名称（例如 aiplatform-prodpsc.p.googleapis.com）将这些 DNS 名称分配给这些内部 IP 地址。如需了解详情，请参阅关于通过端点访问 Google API。
部署考虑事项
以下是一些重要的注意事项，它们会影响您使用专用 Google 访问通道和 Private Service Connect 访问 Vertex AI API 的方式。
IP 通告
您必须将专用 Google 访问通道子网范围或 Private Service Connect 端点 IP 地址从 Cloud Router 路由器通告给本地和多云环境作为自定义通告路由。如需了解详情，请参阅通告自定义 IP 范围。
防火墙规则
您必须确保本地和多云环境的防火墙配置允许从专用 Google 访问通道或 Private Service Connect 子网的 IP 地址发出的出站流量。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# About accessing the Vertex AI API\n\nYour applications can connect to APIs in Google's production environment from\nwithin Google Cloud or from hybrid (on-premises and multicloud) networks.\nGoogle Cloud offers the following public and private access options, which offer\nglobal reachability and SSL/TLS security:\n\n1. [Public internet access](#internet): Send traffic to \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`.\n2. [Private Google Access for on-premises hosts](#pga): Use the IP address subnet range `199.36.153.8/30` (private.googleapis.com) or `199.36.153.4/30` (restricted.googleapis.com) to access \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`.\n3. [Private Service Connect endpoints for Google APIs](#psc): Use a user-defined internal IP address such as `10.0.0.100` to access \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com` or an assigned DNS name such as `aiplatform-genai1.p.googleapis.com`.\n\nThe following diagram illustrates these access options.\n\nSome Vertex AI service producers require you to connect to their\nservices through\n[private services access](/vertex-ai/docs/general/private-services-access)\nor through\n[Private Service Connect endpoints](/vertex-ai/docs/general/psc-endpoints).\nThese services are listed in the\n[Private access options for Vertex AI](/vertex-ai/docs/general/netsec-overview#private_access_options_for)\ntable.\n\nPublic internet access to the Vertex AI API\n-------------------------------------------\n\nIf your application uses a Google service listed in the [table of supported access methods for Vertex AI](/vertex-ai/docs/general/netsec-overview#access-methods), your application can access the API by performing a DNS lookup against the\n[service endpoint](/vertex-ai/docs/reference/rest#service-endpoint)\n(\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com`), which returns\npublicly routable virtual IP addresses. You can use the API from\nany location in the world as long as you have an internet connection.\nHowever, traffic that is sent from Google Cloud resources to those IP\naddresses remains within Google's network.\n\nPrivate access to the Vertex AI API\n-----------------------------------\n\nPrivate access is an alternative to connecting to Google APIs\nand services over the internet. It provides higher bandwidth, reliability and\nconsistent performance. Google Cloud supports the following options\nfor accessing Google APIs privately\nthrough hybrid networking services such as Cloud Interconnect,\nCross-Cloud Interconnect, HA VPN over Cloud Interconnect, and\nSD-WAN.\n\n### Private Google Access for on-premises hosts\n\n[Private Google Access for on-premises hosts](/vpc/docs/private-google-access-hybrid)\nprovides a way for on-premises systems to connect to Google APIs\nand services by routing traffic through hybrid networking services.\n\nPrivate Google Access requires you to advertise one of the following subnet\nIP address ranges as a custom advertised route by using Cloud Router:\n\n- `private.googleapis.com`: `199.36.153.8/30`, `2600:2d00:0002:2000::/64`\n- `restricted.googleapis.com`: `199.36.153.4/30`, `2600:2d00:0002:1000::/64`\n\nFor more information, see\n[Configure Private Google Access for on-premises hosts](/vpc/docs/configure-private-google-access-hybrid).\n\n### Private Service Connect endpoints for the Vertex AI API\n\nWith Private Service Connect, you can create private endpoints\nusing global internal IP addresses within your VPC network.\nYou can assign DNS names to these internal IP addresses with meaningful names\nlike `aiplatform-genai1.p.googleapis.com` and\n`bigtable-adsteam.p.googleapis.com`. These names and IP addresses are\ninternal to your VPC network and any on-premises networks\nthat are connected to it through hybrid networking services.\nYou can control which traffic goes to which endpoint, and can demonstrate\nthat traffic stays within Google Cloud.\n\n- You can create a user-defined global Private Service Connect endpoint IP address (/32). For more information, see [IP address requirements](/vpc/docs/about-accessing-google-apis-endpoints#ip-address-requirements).\n- You create the Private Service Connect endpoint in the same VPC network as the Cloud Router.\n- You can assign DNS names to these internal IP addresses with meaningful names like `aiplatform-prodpsc.p.googleapis.com`. For more information, see [About accessing Google APIs through endpoints](/vpc/docs/about-accessing-google-apis-endpoints).\n\nDeployment considerations\n-------------------------\n\nFollowing are some important considerations that affect how you use\nPrivate Google Access and Private Service Connect to access\nthe Vertex AI API.\n\n### Private Google Access\n\nAs a best practice, you should\n[enable Private Google Access](/vpc/docs/configure-private-google-access#config-pga)\non VPC subnets to allow compute resources (such as\nCompute Engine and GKE VM instances) that don't have external\nIP addresses to reach Google Cloud APIs and services (such as\nVertex AI, Cloud Storage, and BigQuery).\n\n### IP advertisement\n\nYou must advertise the Private Google Access subnet range or the\nPrivate Service Connect endpoint IP address to on-premises and\nmulticloud environments from the Cloud Router as a custom advertised route.\nFor more information, see\n[Advertise custom IP ranges](/network-connectivity/docs/router/how-to/advertising-custom-ip).\n\n### Firewall rules\n\nYou must ensure that the firewall configuration of on-premises and\nmulticloud environments allows outbound traffic\nfrom the IP addresses of Private Google Access or\nPrivate Service Connect subnets.\n\n### DNS configuration\n\n- Your on-premises network must have DNS zones and records configured so that a request to \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-aiplatform.googleapis.com` resolves to the [Private Google Access subnet](/vpc/docs/configure-private-google-access-hybrid#config-domain) or the [Private Service Connect endpoint](/vpc/docs/configure-private-service-connect-apis#on-premises) IP address.\n- You can create Cloud DNS managed private zones and use a Cloud DNS inbound server policy, or you can configure on-premises name servers. For example, you can use [BIND](https://wikipedia.org/wiki/BIND) or [Microsoft Active Directory DNS](https://learn.microsoft.com/windows-server/networking/dns/dns-top).\n- If your on-premises network is connected to a VPC network, you can use Private Service Connect to access Google APIs and services from on-premises hosts using the internal IP address of the endpoint. For more information, see [Access the endpoint from on-premises hosts](/vpc/docs/configure-private-service-connect-apis#on-premises)."]]
