---
name: vpc-vpe-faqs
title: FAQ for virtual private endpoints
description: You might encounter the following frequently asked questions when you use IBM Cloud Virtual Private Endpoints (VPE) for VPC.
last-updated: 2026-03-17
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/vpc?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# FAQ for virtual private endpoints
{: #faqs-vpe}

You might encounter the following frequently asked questions when you use IBM Cloud Virtual Private Endpoints (VPE) for VPC.

## Can I map IBM Cloud services to a VPE from the service catalog?
{: #faq-cannot-map-services}
{: faq}
{: support}

IBM Cloud services cannot be mapped to a VPE from the service catalog during the time of purchase.

## Can I map an IBM Cloud service to a Public endpoint?
{: #faq-map-cloud-service-public-endpoint}
{: faq}
{: support}

Public endpoints of IBM Cloud services are not eligible for VPE. VPE can be mapped only to a private endpoint of IBM Cloud services.

## Is a VPE created in high-availability mode?
{: #faq-vpe-ha-mode}
{: faq}
{: support}

A VPE is not created in high-availability (HA) mode, by default. HA comes primarily from the IBM Cloud service.

## Can I access an IBM Cloud service by using a private service endpoint IP address?
{: #faq-access-using-cse-adn}
{: faq}
{: support}

When an IBM Cloud service is created, IBM Cloud DNS Services are automatically set up to resolve the IBM Cloud service FQDN to the IBM Cloud private service address.

When a VPE is created, VPE assigns a reserved IP with which you can access the IBM Cloud service. It is recommended to use the reserved IP instead of the IBM Cloud private service endpoint.

## Does mapping an IBM Cloud service to an IP address on a VPC network make the service private?
{: #faq-map-cloud-service-make-service-private}
{: faq}

Mapping an IBM Cloud service to an IP address on a VPC network does not make the service private. For example, if a service has
a public endpoint, you can still access the public endpoint after the service is mapped.

## Does controlling access to an IP on a VPC network that is mapped to a service control access to the mapped service?
{: #faq-access-mapped-service}
{: faq}

Controlling access to an IP address on a VPC network that is mapped to an IBM Cloud service does not control the access to the mapped service itself.

## Is there a limit to the total number of concurrent active connections to an endpoint gateway?
{: #faq-reserved-ips-and-number-ports}
{: faq}

Connections to a reserved IP address that is bound to the endpoint gateway are source NATed at the VPE gateway. The source IP becomes the reserved IP bound to the endpoint gateway, and a UDP/TCP source port is allocated for each connection. The total number of TCP/UDP ports is limited, and since every active TCP/UDP connection might consume a source port, the total number of active connections through a VPE gateway is limited.

To avoid port exhaustion, consider techniques such as long-running connections and connection-pooling to reduce the total number of active connections to a VPE.

## How many IP addresses can I use for NAT operations on the VPC gateway?
{: #faq-ip-nat-operations}
{: faq}

A finite pool of IP addresses is used for NAT operations on the VPC gateway. One IP address is required per VPC per zone.

## What is the maximum MTU supported by VPE?
{: #mtu-supported}

VPE supports MTU sizes up to the following limits, depending on the connection type:

* IBM services: up to 9000 bytes
* Private Path services: up to 8500 bytes

## Can you ping a VPE-hosted private IP?
{: #faq-ping-private-ip}
{: faq}

No. VPE-hosted private IPs do not respond to ping (ICMP). These IPs are internal service mappings created by a VPE, not traditional network interfaces, so ICMP isn't supported. To test connectivity, use the service’s TCP port (for example, port 443 for HTTPS services) with tools such as **traceroute**, **telnet** or **curl** to verify the connection.

## Related links
{: #vpe-faq-related-links}

[Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown)