You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Become familiar with SQL Server network configuration tasks. View information on enabling protocols, configuring encryption, registering SPNs, and other actions.
Server network configuration tasks include enabling protocols, modifying the port or pipe used by a protocol, configuring encryption, configuring the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser service, exposing or hiding the [!INCLUDE[ssDEnoversion](../../includes/ssdenoversion-md.md)] on the network, and registering the Server Principal Name. Most of the time, you do not have to change the server network configuration. Only reconfigure the server network protocols if special network requirements.
22
-
23
-
Network configuration for [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] is done using [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager. For earlier versions of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], use the Server Network Utility that ships with those products.
24
-
25
-
## Protocols
26
-
Use [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager to enable or disable the protocols used by [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], and to configure the options available for the protocols. More than one protocol can be enabled. You must enable all protocols that you want clients to use. All protocols have equal access to the server. For information about which protocols you should use, see [Enable or Disable a Server Network Protocol](../../database-engine/configure-windows/enable-or-disable-a-server-network-protocol.md) and [Default SQL Server Network Protocol Configuration](../../database-engine/configure-windows/default-sql-server-network-protocol-configuration.md).
27
-
28
-
### Changing a Port
29
-
You can configure the TCP/IP protocol to listen on a designated port. By default, the default instance of the [!INCLUDE[ssDE](../../includes/ssde-md.md)] listens on TCP port 1433. Named instances of the [!INCLUDE[ssDE](../../includes/ssde-md.md)] and [!INCLUDE[ssEW](../../includes/ssew-md.md)] are configured for dynamic ports. This means they select an available port when the [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] service is started. The [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser service helps clients identify the port when they connect.
30
-
31
-
When configured for dynamic ports, the port used by [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] may change each time it is started. When connecting to [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] through a firewall, you must open the port used by [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. Configure [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] to use a specific port, so you can configure the firewall to allow communication to the server. For more information, see [Configure a Server to Listen on a Specific TCP Port (SQL Server Configuration Manager)](../../database-engine/configure-windows/configure-a-server-to-listen-on-a-specific-tcp-port.md).
32
-
33
-
### Changing a Named Pipe
34
-
You can configure the named pipe protocol to listen on a designated named pipe. By default, the default instance of [!INCLUDE[ssDEnoversion](../../includes/ssdenoversion-md.md)] listens on pipe \\\\.\pipe\sql\query for the default instance and \\\\.\pipe\MSSQL$*\<instancename>*\sql\query for a named instance. The [!INCLUDE[ssDE](../../includes/ssde-md.md)] can only listen on one named pipe, but you can change the pipe to another name if you wish. The [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser service helps clients identify the pipe when they connect. For more information, see [Configure a Server to Listen on an Alternate Pipe (SQL Server Configuration Manager)](../../database-engine/configure-windows/configure-a-server-to-listen-on-an-alternate-pipe.md).
35
-
36
-
## Force Encryption
37
-
The [!INCLUDE[ssDE](../../includes/ssde-md.md)] can be configured to require encryption when communicating with client applications. For more information, see [Enable Encrypted Connections to the Database Engine (SQL Server Configuration Manager)](./configure-sql-server-encryption.md).
38
-
39
-
## Extended Protection for Authentication
40
-
Support for Extended Protection for Authentication by using channel binding and service binding is available for operating systems that support Extended Protection. For more information, see [Connect to the Database Engine Using Extended Protection](../../database-engine/configure-windows/connect-to-the-database-engine-using-extended-protection.md).
41
-
42
-
## Authenticating by Using Kerberos
43
-
[!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] supports Kerberos authentication. For more information, see [Register a Service Principal Name for Kerberos Connections](../../database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections.md) and [Microsoft Kerberos Configuration Manager for SQL Server](https://www.microsoft.com/download/details.aspx?id=39046).
44
-
45
-
### Registering a Server Principal Name (SPN)
46
-
The Kerberos authentication service uses an SPN to authenticate a service. For more information, see [Register a Service Principal Name for Kerberos Connections](../../database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections.md).
47
-
48
-
SPNs may also be used to make client authentication more secure when connecting with NTLM. For more information, see [Connect to the Database Engine Using Extended Protection](../../database-engine/configure-windows/connect-to-the-database-engine-using-extended-protection.md).
49
-
50
-
## SQL Server Browser Service
51
-
The [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser service runs on the server, and helps client computers to find instances of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. The [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser service does not need to be configured, but must be running under some connection scenarios. For more information about [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser, see [SQL Server Browser Service (Database Engine and SSAS)](../../database-engine/configure-windows/sql-server-browser-service-database-engine-and-ssas.md)
52
-
53
-
## Hiding SQL Server
54
-
When running, [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser responds to queries, with the name, version, and connection information for each installed instance. For [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)], the **HideInstance** flag, indicates that [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] Browser should not respond with information about this server instance. Client applications can still connect, but they must know the required connection information. For more information, see [Hide an Instance of SQL Server Database Engine](../../database-engine/configure-windows/hide-an-instance-of-sql-server-database-engine.md).
Server network configuration tasks include enabling protocols, modifying the port or pipe used by a protocol, configuring encryption, configuring the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser service, exposing or hiding the [!INCLUDE [ssDEnoversion](../../includes/ssdenoversion-md.md)] on the network, and registering the Server Principal Name. Most of the time, you don't have to change the server network configuration. Only reconfigure the server network protocols if special network requirements.
24
+
25
+
Network configuration for [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] is done using [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager. For earlier versions of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)], use the Server Network Utility that ships with those products.
26
+
27
+
## Protocols
28
+
29
+
Use [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Configuration Manager to enable or disable the protocols used by [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)], and to configure the options available for the protocols. More than one protocol can be enabled. You must enable all protocols that you want clients to use. All protocols have equal access to the server. For information about which protocols you should use, see [Enable or disable a server network protocol](enable-or-disable-a-server-network-protocol.md) and [Default SQL Server Network Protocol Configuration](default-sql-server-network-protocol-configuration.md).
30
+
31
+
### Change a port
32
+
33
+
You can configure the TCP/IP protocol to listen on a designated port. By default, the default instance of the [!INCLUDE [ssDE](../../includes/ssde-md.md)] listens on TCP port 1433. Named instances of the [!INCLUDE [ssDE](../../includes/ssde-md.md)] and [!INCLUDE [ssEW](../../includes/ssew-md.md)] are configured for dynamic ports. This means they select an available port when the [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] service is started. The [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser service helps clients identify the port when they connect.
34
+
35
+
When configured for dynamic ports, the port used by [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] might change each time it's started. When connecting to [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] through a firewall, you must open the port used by [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)]. Configure [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] to use a specific port, so you can configure the firewall to allow communication to the server. For more information, see [Configure SQL Server to listen on a specific TCP port](configure-a-server-to-listen-on-a-specific-tcp-port.md).
36
+
37
+
### Change a named pipe
38
+
39
+
You can configure the named pipe protocol to listen on a designated named pipe. By default, the default instance of [!INCLUDE [ssDEnoversion](../../includes/ssdenoversion-md.md)] listens on pipe \\\\.\pipe\sql\query for the default instance and \\\\.\pipe\MSSQL$*\<instancename>*\sql\query for a named instance. The [!INCLUDE [ssDE](../../includes/ssde-md.md)] can only listen on one named pipe, but you can change the pipe to another name if you wish. The [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser service helps clients identify the pipe when they connect. For more information, see [Configure a Server to Listen on an Alternate Pipe](configure-a-server-to-listen-on-an-alternate-pipe.md).
40
+
41
+
## Force encryption
42
+
43
+
The [!INCLUDE [ssDE](../../includes/ssde-md.md)] can be configured to require encryption when communicating with client applications. For more information, see [Configure SQL Server Database Engine for encrypting connections](configure-sql-server-encryption.md).
44
+
45
+
## Extended protection for authentication
46
+
47
+
Support for Extended Protection for Authentication by using channel binding and service binding is available for operating systems that support Extended Protection. For more information, see [Connect to the database engine with Extended Protection](connect-to-the-database-engine-using-extended-protection.md).
48
+
49
+
## Authenticate using Kerberos
50
+
51
+
[!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] supports Kerberos authentication. For more information, see [Register a Service Principal Name for Kerberos connections](register-a-service-principal-name-for-kerberos-connections.md) and [Microsoft Kerberos Configuration Manager for SQL Server](https://www.microsoft.com/download/details.aspx?id=39046).
52
+
53
+
### Register a Server Principal Name (SPN)
54
+
55
+
The Kerberos authentication service uses an SPN to authenticate a service. For more information, see [Register a Service Principal Name for Kerberos connections](register-a-service-principal-name-for-kerberos-connections.md).
56
+
57
+
SPNs might also be used to make client authentication more secure when connecting with NTLM. For more information, see [Connect to the database engine with Extended Protection](connect-to-the-database-engine-using-extended-protection.md).
58
+
59
+
## SQL Server Browser service
60
+
61
+
The [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser service runs on the server, and helps client computers to find instances of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)]. The [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser service doesn't need to be configured, but must be running under some connection scenarios. For more information about [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser, see [SQL Server Browser service (Database Engine and SSAS)](sql-server-browser-service-database-engine-and-ssas.md).
62
+
63
+
## Hide SQL Server
64
+
65
+
When running, [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser responds to queries, with the name, version, and connection information for each installed instance. For [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)], the **HideInstance** flag, indicates that [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] Browser shouldn't respond with information about this server instance. Client applications can still connect, but they must know the required connection information. For more information, see [Hide an Instance of SQL Server Database Engine](hide-an-instance-of-sql-server-database-engine.md).
0 commit comments