部分 Vertex AI 服務供應商要求您透過 Private Service Connect 端點連線至其服務。這些服務列於 Vertex AI 存取方法表格中。這些連接器支援從服務消費者的內部部署、多雲和 VPC 工作負載，傳送至 Google 管理的 Vertex AI 服務的單向通訊。用戶端會使用內部 IP 位址連線至端點。Private Service Connect 會執行網路位址轉譯 (NAT)，將要求轉送至服務。
服務消費者可以使用自己的內部 IP 位址存取這些 Vertex AI 服務，無須離開虛擬私有雲網路，也不必透過建立消費者端點使用外部 IP 位址。端點會使用 Private Service Connect 轉送規則連線至其他虛擬私有雲網路中的服務。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# About accessing Vertex AI services through Private Service Connect endpoints\n\nSome Vertex AI service producers require you to connect to their\nservices through\n[Private Service Connect endpoints](/vpc/docs/private-service-connect#endpoints).\nThese services\nare listed in the\n[Vertex AI access methods](/vertex-ai/docs/general/netsec-overview#access-methods)\ntable. They support unidirectional communication\nfrom a service consumer's on-premises, multicloud, and VPC workloads to\nGoogle-managed Vertex AI services. Clients connect to the endpoint\nby using internal IP addresses. Private Service Connect performs\nnetwork address translation (NAT) to route requests to the service.\n\nService consumers can use their own internal IP addresses to access these\nVertex AI services without leaving their VPC networks\nor using external IP addresses by creating a consumer endpoint.\nThe endpoint connects to services in another VPC network using a\nPrivate Service Connect forwarding rule.\n\nOn the service producer's side of the private connection, there is a\nVPC network where your service resources are provisioned. This\nnetwork is created exclusively for you and contains only your resources.\n\nThe following diagram shows a Vector Search architecture in which the\nVector Search API is enabled and managed in a service project\n(`serviceproject`) as part of a [Shared VPC](/vpc/docs/shared-vpc)\ndeployment. The Vector Search Compute Engine resources\nare deployed as a Google-managed Infrastructure-as-a-Service (IaaS) in the\nservice producer's VPC network.\n\nPrivate Service Connect endpoints are deployed in the service\nconsumer's VPC network (`hostproject`) for index query, in\naddition to\n[Private Service Connect endpoints for Google APIs](/vertex-ai/docs/general/googleapi-access-methods#psc)\nfor private index creation.\n\nFor more information, see\n[Private Service Connect endpoints](/vpc/docs/private-service-connect#endpoints).\n\nBefore you configure Private Service Connect endpoints, learn about\naccess\n[considerations](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#limitations).\n\nPrivate Service Connect endpoint deployment options\n---------------------------------------------------\n\nA Private Service Connect service attachment is generated from the\nproducer service (such as Vertex AI). As a consumer, you can gain\naccess to the service producer by deploying a consumer endpoint in one or more\nVPC networks.\n\nDeployment considerations\n-------------------------\n\nThe following sections discuss considerations for communication from your\non-premises, multicloud, and VPC workloads to Google-managed\nVertex AI services.\n\n### Private Service Connect backends\n\nGoogle does not support using\n[Private Service Connect backends](/vpc/docs/access-apis-managed-services-private-service-connect-backends)\nwith Vertex AI online prediction endpoints.\n\n### IP advertisement\n\n- When you use Private Service Connect to connect to services in\n another VPC network, you choose an IP address from a [regular\n subnet](/vpc/docs/subnets#purpose) in your VPC network.\n\n- By default, the Cloud Router will advertise regular VPC\n subnets unless custom advertisement mode is configured. For more\n information, see [Custom advertisement\n mode](/network-connectivity/docs/router/concepts/advertised-routes#overview-am-custom).\n\n- The IP address for the consumer endpoint must be in the same region as the\n service producer's service attachment. For more information, see [Service\n attachments](/vpc/docs/private-service-connect#service-attachments) and\n [Access published services through\n endpoints](/vpc/docs/configure-private-service-connect-services).\n\n### Firewall rules\n\nYou must update the firewall rules for the VPC\nnetwork that connects your on-premises and multicloud environments\nto Google Cloud to allow egress traffic to the\nPrivate Service Connect endpoint subnet. For more information, see\n[Firewall rules](/vpc/docs/manage-security-private-service-connect-consumers#firewall-rules)."]]
