Outbound networking / static IP for Vertex AI Agent Engine (Gemini Enterprise)

Google Cloud Build with AI Agents
1

Title: Outbound networking / static IP for Vertex AI Agent Engine (Gemini Enterprise)

Hi,

How does outbound networking work for agents built with Gemini Enterprise on Vertex AI Agent Engine?

Concretely I’d like to know:

  • Do agents run in a Google‑managed tenant VPC, and can their outbound traffic be forced through my own VPC/network instead of generic Google egress?

  • Is there a supported way to get a static outbound IP for Agent Engine traffic ?

Use case:

  • Agents with Gemini Enterprise calling Global External Load Balancer.

Any official docs or reference architectures for this setup would be very helpful.

Thanks,

2

Hey , have not tested but to answer your questions directly based on Google Cloud’s official architecture for Vertex AI Agent Engine:

  1. Tenant VPC and Egress Routing: Yes, your agents are deployed within a secure, Google-managed tenant project by default. To force the outbound traffic through your own network instead of the generic Google egress, you must configure a Private Service Connect interface (PSC-I). This creates a secure bridge by provisioning an interface in the Google-owned tenant that connects directly to a network attachment in your VPC.

  2. Static Outbound IP: Yes, there is a fully supported architecture for this. When you route the agent’s traffic into your VPC via PSC-I, it loses its default public internet access. To reach your Global External Load Balancer, you need to build an explicit egress path:

    • Deploy a dedicated Proxy VM or a Secure Web Proxy (SWP) within your VPC to receive the traffic from the PSC connection.

    • Route the outbound traffic from this Proxy through a Cloud NAT gateway.

    • In your Cloud NAT configuration, change the IP address allocation from “Automatic” to “Manual” and assign your own reserved static external IP addresses.

By using this Agent Engine → PSC-I → Proxy VM → Cloud NAT (with Manual IP) pipeline, all outbound traffic from your Gemini Enterprise agents will hit your Global External Load Balancer originating from that exact static IP ?

Hope this helps with your architecture setup !