2018-05-29 21:07:40 +00:00
---
2020-04-07 18:55:19 +00:00
layout: docs
2022-09-13 20:58:57 +00:00
page_title: Service Mesh Proxy Overview
2020-04-07 18:55:19 +00:00
description: >-
2022-09-15 19:29:34 +00:00
In Consul service mesh, each service has a sidecar proxy that secures connections with other services in the mesh without modifying the underlying application code. You can use the built-in proxy, Envoy, or a custom proxy to handle communication and verify TLS connections.
2018-05-29 21:07:40 +00:00
---
2022-09-13 20:58:57 +00:00
# Service Mesh Proxy Overview
2018-05-29 21:07:40 +00:00
2019-06-14 05:52:50 +00:00
A Connect-aware proxy enables unmodified applications to use Connect. A
per-service proxy sidecar transparently handles inbound and outbound service
connections, automatically wrapping and verifying TLS connections. Consul
includes its own built-in L4 proxy and has first class support for Envoy. You
2019-07-19 22:29:42 +00:00
can choose other proxies to plug in as well. This section describes how to
2019-06-14 05:52:50 +00:00
configure Envoy or the built-in proxy using Connect, and how to integrate the
proxy of your choice.
2018-05-29 21:07:40 +00:00
2019-06-21 17:01:00 +00:00
To ensure that services only allow external connections established via
the Connect protocol, you should configure all services to only accept connections on a loopback address.
2018-05-29 21:07:40 +00:00
2019-06-14 05:52:50 +00:00
~> **Deprecation Note:** Managed Proxies are a deprecated method for deploying
2019-08-09 19:19:30 +00:00
sidecar proxies, and have been removed in Consul 1.6. See [managed proxy
2020-04-09 23:46:54 +00:00
deprecation](/docs/connect/proxies/managed-deprecated) for more
2019-06-14 05:52:50 +00:00
information. If you are using managed proxies we strongly recommend that you
switch service definitions for registering proxies.
2018-05-29 21:07:40 +00:00
2019-06-14 05:52:50 +00:00
## Dynamic Upstreams Require Native Integration
2018-10-11 09:44:42 +00:00
If an application requires dynamic dependencies that are only available
2020-04-09 23:46:54 +00:00
at runtime, it must [natively integrate](/docs/connect/native)
2018-10-11 09:44:42 +00:00
with Connect. After natively integrating, the HTTP API or
2020-11-17 15:03:00 +00:00
[DNS interface](/docs/discovery/dns#connect-capable-service-lookups)
2019-03-18 18:48:56 +00:00
can be used.
2019-06-14 05:52:50 +00:00
!> Connect proxies do not currently support dynamic upstreams.
