[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-10。"],[],[],null,["# About propagated connections\n============================\n\nThis page provides an overview of Private Service Connect propagated\nconnections.\n\nWith propagated connections, services that are accessible in one\nconsumer [VPC spoke](/network-connectivity/docs/network-connectivity-center/concepts/overview#vpc-spokes) through\n[Private Service Connect endpoints](/vpc/docs/private-service-connect#endpoints)\ncan be privately accessed by other consumer VPC spokes that are\nconnected to the same Network Connectivity Center hub. Propagated connections let consumer\nVPC spokes access managed services in producer VPC\nnetworks as if the two VPC networks were directly connected\nthrough endpoints.\n\nPropagated connections provide the following benefits:\n\n- You can use a common services VPC network to simplify the deployment of Private Service Connect endpoints.\n- You can manage which services are accessible to individual VPC spokes through the Network Connectivity Center hub.\n\nFor an overview of propagated connections from the Network Connectivity Center\nperspective, see\n[Private Service Connect propagated connections through Network Connectivity Center](/network-connectivity/docs/network-connectivity-center/concepts/psc-propagated-connection-overview).\n[](/static/vpc/images/private-service-connect-propagated-connections-overview.svg) VPC networks use propagated connections to access published services that are connected to a common services VPC network (click to enlarge).\n\nFor example, in figure 1, the VPC spoke\n`Common services VPC` contains two endpoints. Two other VPC\nspokes are attached to the same Network Connectivity Center hub as `Common services VPC`.\nBecause propagated\nconnections are enabled for the hub, there are two propagated connections in\n`Consumer VPC 2` and two propagated connections in `Consumer VPC 3`.\nThese propagated connections let workloads in `Consumer VPC 2` and\n`Consumer VPC 3` access managed services in\n`Producer VPC 1` as if they were directly connected through the endpoints.\n\nNo propagated connections are created for `Endpoint 3` because the IP range of\nthat endpoint's subnet is excluded from export and not advertised to other\nVPC spokes.\n\nConfiguring propagated connections\n----------------------------------\n\nPropagated connections are managed by\n[Network Connectivity Center](/network-connectivity/docs/network-connectivity-center/concepts/overview).\nYou can't directly manage\npropagated connections by using Private Service Connect.\n\n### Triggering connection propagation\n\nPropagated connections are automatically established when the following actions\noccur:\n\n- When a hub administrator [enables connection propagation for a hub](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#update_a_hub), Network Connectivity Center creates propagated connections for existing endpoints in the VPC spokes that are connected to the hub.\n- When a hub administrator [adds a VPC spoke to a hub](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vpc-spoke) that has connection propagation enabled, Network Connectivity Center creates propagated connections in the new spoke for existing endpoints in other VPC spokes that are connected to the same Network Connectivity Center hub. If the new spoke has existing endpoints, propagated connections are created for those endpoints in each connected spoke.\n- When a consumer service administrator [creates an endpoint](/vpc/docs/configure-private-service-connect-services#create-endpoint) in a VPC spoke that is attached to a Network Connectivity Center hub with connection propagation enabled, Network Connectivity Center creates propagated connections for that endpoint in other connected VPC spokes.\n- When a producer service administrator [increases a service attachment's propagated connection limit](/vpc/docs/manage-private-service-connect-services#update-propagated-connection-limit), Network Connectivity Center creates propagated connections that were previously blocked by this limit, as long as the new connections don't exceed the new limit.\n\nConnections are propagated asynchronously and might not be immediately\navailable.\n\n### Excluding subnets\n\nWhen you [create a VPC spoke](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#create-vpc-spoke), you can\nexclude the IP address ranges of subnets from being exported to the Network Connectivity Center hub.\nIf you exclude a subnet from export, workloads\nin that subnet can't access propagated connections, and propagated connections\naren't created for endpoints in that subnet. For example, in figure 1,\nworkloads in `Consumer VPC 2` and `Consumer VPC 3` can't access the service\nin `Producer VPC 2`, and workloads in `Subnet 5` can't access the services\nin `Producer VPC 1`.\n\n### Terminating propagated connections\n\nThe following actions indirectly control the deletion of propagated\nconnections:\n\n- [Deleting the associated endpoint](/vpc/docs/configure-private-service-connect-services#delete-endpoint).\n- [Deleting a spoke](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes#deleting-a-spoke) that contains a Private Service Connect endpoint.\n- Disabling connection propagation on a Network Connectivity Center hub.\n\nWhen any of the previous actions happen, propagated connections are terminated.\nThis process is asynchronous and might not happen immediately.\n\nSpecifications\n--------------\n\n- The following Private Service Connect endpoint types can be\n made available through connection propagation:\n\n - Endpoints that [access a published\n service](/vpc/docs/about-accessing-vpc-hosted-services-endpoints).\n - Endpoints that [access a regional Google\n API](/vpc/docs/about-accessing-regional-google-apis-endpoints).\n\n Endpoints that [access global Google APIs](/vpc/docs/about-accessing-google-apis-endpoints)\n can't be made available through connection propagation.\n- Connections are propagated only if the\n Private Service Connect endpoint has the `Accepted`\n [connection\n status](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#connection-statuses).\n\n- By default, propagated connections are accessible by workloads in the\n same region and VPC network as the propagated connection.\n\n- You can configure [global access](/vpc/docs/about-accessing-vpc-hosted-services-endpoints#global-access)\n on an endpoint to make propagated connections for that endpoint available to\n workloads in any region of the propagated connection's VPC\n spoke.\n\nQuotas and limits\n-----------------\n\nThe following quotas and limits apply to Private Service Connect\nconnection propagation:\n\n- **Consumer quota** : the [PSC propagated connections per VPC\n network](/vpc/docs/quota#psc-propagated-connections-per-vpc) quota limits the number of propagated connections that can be made available in a consumer VPC network.\n- **Producer quota** : the [PSC ILB consumer forwarding rules per producer\n VPC network](/vpc/docs/quota#psc-ilb-frs-per-producer-vpc) quota limits the number of endpoints and propagated connections that can connect to a producer VPC network.\n- **Producer connection limit** : each published service (service attachment) has a propagated connection limit, which limits how many propagated connections can be established to the service from a single consumer. For more information about this producer configuration, see [Propagated\n connections](/vpc/docs/about-vpc-hosted-services#propagation).\n\nIf you can't access a propagated connection, one of these quotas or the\nconnection limit might be affecting your access. For more information, see\n[Troubleshooting](#troubleshooting).\n\nLimitations\n-----------\n\nPropagated connections have the following limitations:\n\n- Propagated connections don't support endpoints that use IPv6 addresses.\n- Propagated connections don't support endpoints that [access global Google\n APIs](/vpc/docs/about-accessing-google-apis-endpoints).\n- Propagated connections aren't created for [Hybrid\n spokes](/network-connectivity/docs/network-connectivity-center/concepts/overview#hybrid_spokes).\n\nTroubleshooting\n---------------\n\nIf you are a service consumer who can't access a propagated endpoint, ask the\nNetwork Connectivity Center hub administrator to help troubleshoot. The hub administrator\nhas the access required to\n[troubleshoot Private Service Connect connection propagation\nerrors](/network-connectivity/docs/network-connectivity-center/support/troubleshooting#troubleshoot-psc-propagation-errors).\n\nWhat's next\n-----------\n\n- [Work with hubs and spokes](/network-connectivity/docs/network-connectivity-center/how-to/working-with-hubs-spokes).\n- [About accessing published services through endpoints](/vpc/docs/about-accessing-vpc-hosted-services-endpoints).\n- [Access published services through endpoints](/vpc/docs/configure-private-service-connect-services)."]]