The requirement is strong end-to-end encryption at layer 3. Running Cloud HA VPN over Dedicated Interconnect provides IPsec encryption for all IP traffic between on-premises and the VPC while still using Interconnect for high throughput and reliability. Using BGP over the VPN tunnels enables dynamic route exchange across the encrypted layer-3 tunnels.

https://cloud.google.com/static/network-connectivity/docs/vpn/images/ha-vpn-gcp-to-on-prem-2-a.svg
https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies

To configure access to Vertex AI online prediction (via private services access) while designating a primary and backup region for interconnect VLAN attachments:
1. Custom route advertisements: Advertise the prefix 172.16.53.0/24 on the VLAN attachments in both us-west1 (primary) and us-west2 (backup) regions. This ensures that the prefix for private services access is known in your on-premises environment.
2. Set BGP route priority: The BGP priority determines the preferred path for traffic.
- Assign a lower priority value (e.g., 100) for the primary region (us-west1).
- Assign a higher priority value (e.g., 200) for the backup region (us-west2).
BGP always selects the route with the lowest priority value, ensuring that traffic flows through us- west1 as the primary path. If the us-west1 interconnect becomes unavailable, traffic will automatically fail over to us-west2.

The following resources and settings are required to achieve 99.99% availability:
At least four Dedicated Interconnect connections, two connections in one metropolitan area (metro) and two connections in another metro. Connections that are in the same metro must be placed in different edge availability domains (metro availability zones) to achieve 99.99% availability. Placing Dedicated Interconnect connections in two separate edge availability domains within the same metro is important because maintenance windows are coordinated across edge availability domains within a metro, while maintenance windows are not coordinated across metros.
https://cloud.google.com/network-connectivity/docs/interconnect/tutorials/dedicated-creating-9999-availability

When you create a Cloud NAT gateway, you can choose to have the gateway automatically allocate regional external IP addresses. Alternatively, you can manually assign a fixed number of regional external IP addresses to the gateway. For details about each method, see NAT IP addresses.