Configure static IP egress for third-party connectors

Gemini Enterprise data stores send outbound requests to third-party systems from a dynamic range of Google IP addresses. If the third-party system you're connecting to requires IP allowlisting, you'll need the outbound traffic from the connector to originate from a fixed set of IP addresses. Many third-party connectors support this through a static IP egress option, that is available when creating the data store.

When enabled, the data store routes all outbound requests to your third-party instance through a fixed, Google-managed set of IP addresses. You can then add those addresses to the allowlist on the source system. If static IP egress is not enabled, the data store continues to work using Google's dynamic egress ranges.

This page describes how static IP egress works, how to enable it, and how to add the assigned IP addresses to the allowlist on your third-party system.

How static IP egress works

When you enable static IP egress on a data store:

  1. Gemini Enterprise assigns a fixed set of egress IP addresses to the data store at creation time.
  2. Post-authentication, all outbound calls from the data store to your third-party instance originate from that fixed set of IP addresses.
  3. The assigned IP addresses are visible on the data store's details page in the Google Cloud console.
  4. You add the assigned IP addresses to the allowlist on the third-party system.

If static IP egress is disabled, the connector uses Google's general dynamic egress IP ranges.

Supported data stores

Static IP egress is supported for most third-party data stores.

The Enable Static IP Addresses checkbox appears in the data store creation flow whenever the selected data store supports the feature. If the checkbox is not displayed for a data store, that data store does not support static IP egress.

Enable static IP egress

You can only enable static IP egress when you create the data store. You cannot enable or disable static IP egress on an existing data store; to change the setting you must delete and recreate the data store.

  1. In the Google Cloud console, go to the Gemini Enterprise page and start the Create data store flow. For the list of thir-party data stores, see Connect a third-party data source.
  2. Select your third-party source and complete the Authentication step.
  3. In the Advanced options step of the data source configuration, select the Enable Static IP Addresses checkbox.
  4. Complete the remaining steps of the data store creation flow.

After the data store is created, the assigned static IP addresses are surfaced on the data store's details page. See Retrieve the assigned static IP addresses for the exact location.

Retrieve the assigned static IP addresses

  1. In the Google Cloud console, go to the Gemini Enterprise page and click Data stores.
  2. Click the name of the data store that you created.
  3. On the data store details page, locate the Static IPs section. The list of assigned egress IP addresses is displayed there.
  4. Copy the complete list of IP addresses. You need to allowlist all of them on the third-party system.

Limitations

  • Static IP egress is configured per data store and cannot be modified after data store creation.

  • The assigned IP addresses are Google-managed and cannot be customer-selected.

  • Availability of the feature for a specific data store is determined by whether the Enable Static IP Addresses checkbox appears in the create data store flow.