TCP

A TCP connection resource is unique in that the content of the TCP traffic is not recorded in our logs, only the traffic metadata (who accessed the resource, when, and how many bytes were transmitted and received). This behavior is different from what you experience with other StrongDM resources that support logging and auditing of actions taken by a user. Logs of TCP traffic are located in the Queries page in the Admin UI and are recorded after the close of the session.

The TCP connection resource may be used for a variety of types of resources that accept TCP connections, but are not currently supported by StrongDM. It provides the ability to use StrongDM to connect to unsupported resources, and have at least partial auditing support for them.

The TCP connection resource is not a valid way to connect to resource types that are distributed across more than one server (such as Kafka).

The TCP connection resource supports TLS connections only if you are able to disable hostname verification or allow invalid hostnames on the client side when attempting to connect to the resource through StrongDM. It also does not support resources which require connections over multiple ports at the same time.

Add a TCP Server

To add your TCP connection as a StrongDM resource, use the following steps.

1. Log in to the StrongDM Admin UI and go to Resources > Servers.

2. Click Add server.

3. Select TCP as the Server Type and set other resource properties to configure how the StrongDM relay connects to the server.

4. Click create to save the resource.

5. Click the resource name to view status, diagnostic information, and setting details. After the server is created, the Admin UI displays that resource as unhealthy until the health checks run successfully. When the resource is ready, the Health icon indicates a positive, green status.

The TCP Connection settings do not include stored credentials. Any credentials your connection requires need to be provided while connecting with the client.

Resource properties

Configuration properties are visible when you add a Server Type or when you click to view the resource's settings. The following table describes the settings available for your TCP resource.

Property	Requirement	Description
Display Name	Required	Meaningful name to display the resource throughout StrongDM; exclude special characters like quotes (") or angle brackets (< or >)
Server Type	Required	Select TCP
Proxy Cluster	Required	Defaults to "None (use gateways)"; if using proxy clusters, select the appropriate cluster to proxy traffic to this resource
Hostname	Optional	The IP/DNS address used to connect to the resource from your gateway or relay, such as windows-server.strongdm.com
Port	Optional	Port to connect to the resource; default port value 49150
Connectivity Mode	Required	Select either Virtual Networking Mode, which lets users connect to the resource with a software-defined, IP-based network; or Loopback Mode, which allows users to connect to the resource using the local loopback adapter in their operating system; this field is shown if Virtual Networking Mode enabled for your organization
IP Address	Optional	If Virtual Networking Mode is the selected connectivity mode, an IP address value in the configured Virtual Networking Mode subnet in the organization network settings; if Loopback Mode is the selected connectivity mode, an IP address value in the configured Loopback IP range in the organization network settings (by default, 127.0.0.1); if not specified, an available IP address in the configured IP address space for the selected connectivity mode will be automatically assigned; this field is shown if Virtual Networking Mode and/or multi-loopback mode is enabled for your organization
Port Override	Optional	If Virtual Networking Mode is the selected connectivity mode, a port value between 1 and 65535 that is not already in use by another resource with the same IP address; if Loopback Mode is the selected connectivity mode, a port value between 1024 to 64999 that is not already in use by another resource with the same IP address; when left empty with Virtual Networking Mode, the system assigns the default port to this resource; when left empty for Loopback Mode, an available port that is not already in use by another resource is assigned; preferred port also can be modified later from the Port Overrides settings
DNS	Optional	If Virtual Networking Mode is the selected connectivity mode, a unique hostname alias for this resource; when set, causes the desktop app to display this resource's human-readable DNS name (for example, k8s.my-organization-name) instead of the bind address that includes IP address and port (for example, 100.64.100.100:5432)
Resource Tags	Optional	Resource Tags consisting of key-value pairs <KEY>=<VALUE> (for example, env=dev)