Note: Use Private Service Connect (PSC) for Vertex AI servicesthat support it, as it's the recommended connection method. Only use privateservices access for services where PSC is not an option.

Vertex AI services that have a checkmark in thePrivate services accesscolumn of thePrivate access options for Vertex AItablerequire you to connect to their services throughprivate services access.

These Google-managed Vertex AI services support bidirectionalcommunication with a service consumer's on-premises, multicloud, andVPC workloads.

This private communication happens exclusively by using internalIP addresses. VM instances don't need internet access or external IPaddresses to reach services that are available through private services access.

Vertex AI provides services that are hosted in a Google-managedVPC network. Private services access lets you reach theinternal IP addresses of these Vertex AI and third-party servicesthrough a VPC Network Peering connection.

The following diagram shows acustom trainingarchitecture in which Vertex AI APIs for training jobs andpipeline jobs are enabled and managed in a service project(serviceproject) as part of aShared VPCdeployment.These components are deployed as a Google-managedInfrastructure-as-a-Service (IaaS) in the service producer'sVPC network.The service consumer's VPC network (hostproject) accessesthese services through a private services access connection.

Private services access deployment options

You can create a new private connection or modify an existing one.Before you configure private services access, understand theconsiderationsfor choosing a VPC network and IP address range.

To create a new private connection, you must first create anallocated IP rangeand then create aprivate connectionbetween your VPC network andGoogle-managed Vertex AI services.

Alternatively, you can modify an existing connection. For more information, seeModify a private connection.

Vertex AI subnet recommendations

The following table lists the recommended subnet ranges for Vertex AIservices.

Vertex AI feature	Recommended subnet range
Managed notebook instances	/29
Vertex AI Pipelines	/21
Custom training jobs	/19
Vector Search online queries	/16
Private services access endpoints	/21

Deployment considerations

Following are some important considerations that affect how you establishcommunication between youron-premises, multicloud, and VPC workloads and Google-managedVertex AI services.

IP advertisement

You must advertise the private services access subnet range from theCloud Router as a custom advertised route. For more information, seeAdvertise custom IP ranges.

VPC Network Peering

The service producer's network might not have the correct routes to directtraffic to your on-premises network. By default, the service producer'snetwork only learns the subnet routes from your VPC network. Therefore,any request that's not from a subnet IP range is dropped by theservice producer.

For this reason, in your VPC network, you mustupdate the peering connectionto export custom routes to the service producer's network. Exporting routes sends alleligible static and dynamic routes that are in your VPC network, such asroutes to your on-premises network, to the service producer's network.The service producer's network automatically imports them and then can sendtraffic back to your on-premises network through the VPC network.

Firewall rules

You must update the firewall rules for the VPCnetwork that connects your on-premises and multicloud environmentsto Google Cloud to allow ingress traffic from and egress traffic to privateservices access subnets.