---
name: transit-gateway-vpe
title: Using virtual private endpoints for VPC to privately connect to IBM Cloud Transit Gateway
description: IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to IBM Cloud Transit Gateway from your VPC network by using the IP addresses of your choosing, which is allocated from a subnet within your VPC.
last-updated: 2026-08-07
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/transit-gateway?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Using virtual private endpoints for VPC to privately connect to IBM Cloud Transit Gateway
{: #vpe-connection}

IBM Cloud® Virtual Private Endpoints (VPE) for VPC enables you to connect to IBM Cloud Transit Gateway from your VPC network by using the IP addresses of your choosing, which is allocated from a subnet within your VPC.
{: shortdesc}

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).

## Before you begin
{: #vpe-before-you-begin}

Before you target a virtual private endpoint for IBM Cloud®, you must complete the following tasks.

* Ensure that a [Virtual Private Cloud is created](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown).
* Make a plan for your [virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).
* Ensure that [correct access controls](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways&format=markdown) are set for your virtual private endpoint.
* Understand the [planning considerations and limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown) of having a virtual private endpoint.
* Understand how to [view details](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) about a virtual private endpoint.

## Setting up a VPE for IBM Cloud Transit Gateway
{: #vpe-endpoint-setup}

When you create a VPE gateway by using the CLI or API, you must specify the [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn&format=markdown) of the region in which you want to connect to IBM Cloud Transit Gateway. Review the following table for the available regions and CRNs to use to create your VPE gateway.

IBM Cloud Transit Gateway supports VPEs in all the VPC regions as shown.

| Location | Region | Cloud Resource Name (CRN) |
|---------|-------|----------------|
| Dallas | `us-south` | `crn:v1:bluemix:public:transit:us-south:::endpoint:vpe.us-south.transit.cloud.ibm.com` |
| Frankfurt | `eu-de` | `crn:v1:bluemix:public:transit:eu-de:::endpoint:vpe.eu-de.transit.cloud.ibm.com` |
| London | `eu-gb` | `crn:v1:bluemix:public:transit:eu-gb:::endpoint:vpe.eu-gb.transit.cloud.ibm.com` |
| Montreal | `ca-mon` | `crn:v1:bluemix:public:transit:ca-mon:::endpoint:vpe.ca-mon.transit.cloud.ibm.com` |
| Osaka | `jp-osa` | `crn:v1:bluemix:public:transit:jp-osa:::endpoint:vpe.jp-osa.transit.cloud.ibm.com` |
| Sao Paulo | `br-sao` | `crn:v1:bluemix:public:transit:br-sao:::endpoint:vpe.br-sao.transit.cloud.ibm.com` |
| Sydney | `au-syd` | `crn:v1:bluemix:public:transit:au-syd:::endpoint:vpe.au-syd.transit.cloud.ibm.com` |
| Tokyo | `jp-tok` | `crn:v1:bluemix:public:transit:jp-tok:::endpoint:vpe.jp-tok.transit.cloud.ibm.com` |
| Toronto  | `ca-tor` | `crn:v1:bluemix:public:transit:ca-tor:::endpoint:vpe.ca-tor.transit.cloud.ibm.com` |
| Washington DC | `us-east` | `crn:v1:bluemix:public:transit:us-east:::endpoint:vpe.us-east.transit.cloud.ibm.com` |
{: caption="Region availability and Cloud Resource Names (CRNs) for connecting IBM Cloud Transit Gateway over IBM Cloud private networks" caption-side="bottom"}

### Configuring an endpoint gateway
{: #endpoint-gateway-servicename}

To configure a virtual private endpoint gateway, follow these steps:

1. List the available services, including IBM Cloud infrastructure services available (by default) for all VPC users.
1. [Create an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&format=markdown) for IBM Cloud Transit Gateway that you want to be privately available to the VPC.
1. [Bind a reserved IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-bind-unbind-reserved-ip&format=markdown) to the endpoint gateway.
1. View the created VPE gateways associated with the IBM Cloud Transit Gateway. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).

Now, your virtual server instances in the VPC can access your IBM Cloud Transit Gateway instance privately through it.

## Using your VPE for IBM Cloud Transit Gateway
{: #using-transit-gateway-vpe}

After you create an endpoint gateway for IBM Cloud Transit Gateway, follow these steps:

### Using the VPE with the CLI
{: #vpe-cli}
{: cli}

Use the following steps to update to the latest version of the CLI and the IBM Cloud Transit Gateway plug-in.

1. Update the IBM Cloud CLI to the latest version:

   ```sh
   ibmcloud update
   ```
   {: pre}

1. Update the transit gateway CLI plug-in:

   ```sh
   ibmcloud plugin update tg
   ```
   {: pre}

### Using the VPE with the VPC API
{: #vpe-api}
{: api}

After you create an endpoint gateway for the IBM Cloud Transit Gateway service, use the service endpoint's FQDN `private.transit.cloud.ibm.com` in the URL to access the service. For example:

```sh
curl https://private.transit.cloud.ibm.com/v1/transit_gateways?version='2020-03-31' -H "Authorization: Bearer $iam_token"
```
{: pre}

### Using the VPE with the SDK
{: #vpe-sdk}
{: api}

After you create an endpoint gateway for IBM Cloud Transit Gateway, you must use the private endpoint's FQDN when you set the service's FQDN during construction of the transit gateway service object.

```sh
private.transit.cloud.ibm.com
```
{: pre}

For examples of setting the service's FQDN for the specific SDK language, see [SDK API examples](https://cloud.ibm.com/docs/apis/transit-gateway#authentication).

### Using the VPE with Terraform
{: #vpe-terraform}
{: terraform}

If you plan to access the transit gateway service by using Terraform, make sure to set the `IBMCLOUD_TG_API_ENDPOINT` environment variable to `private.transit.cloud.ibm.com`. For example:

```sh
export IBMCLOUD_TG_API_ENDPOINT=private.transit.cloud.ibm.com
```
{: pre}