Citrix Secure Private Access™

Configure egress hub regions

Secure Private Access enables administrators to choose the egress regions that Chrome Enterprise Premium uses for SaaS application traffic. Each selected region provides a dedicated set of egress IP addresses, which administrators can add to their SaaS application allow lists to permit traffic routed through Google Secure Gateway. This feature is available for both cloud and hybrid deployments.

You can access the Egress regions for SaaS applications panel from one of the following paths.

  • Click the Manage egress regions button on the Chrome Enterprise Premium setup card.

    Egress regions tab

  • Click Edit in Browser Settings > Browser Configure > Egress regions for SaaS applications.

The Egress regions for SaaS applications panel

The Egress regions for SaaS applications panel displays the available egress regions and the IP addresses associated with each selected region. You can search for regions by the name or the IP address, and then copy a region’s IP addresses to add them to your SaaS application allow lists.

Egress regions panel

IP addresses become available only after you select a region, save your changes, and Google completes the deployment. Until the deployment is complete, newly selected regions do not display any IP addresses. Deployment usually takes a few minutes, although the exact time may vary.

Select a region

Select the regions where your SaaS applications are hosted or the regions closest to them. To ensure redundancy during a regional outage, select at least two regions. You can select up to 10 regions.

After Google deploys the selected regions and the associated IP addresses become available, add those IP addresses to your SaaS applications’ ingress allow lists.

De-select a region

De-selecting a region displays a warning message.

Deselect egress region

You must update your SaaS application allow lists before saving changes. If you select Cancel, all changes are discarded.

If you later de-select and re-select the same region, Google assigns a new set of egress IP addresses. These IP addresses typically differ from the ones previously assigned, so you must update your SaaS application allow lists accordingly.

Configure egress hub regions