---
layout: docs
page_title: Connect workloads to Consul service mesh
description: >-
  Consul's service mesh makes application and microservice networking secure and observable with identity-based authentication, mutual TLS (mTLS) encryption, and explicit service-to-service authorization enforced by sidecar proxies. Learn how to enable and configure Consul's service mesh and proxies.
---

# Connect workloads to Consul service mesh

This page provides an overview of Consul's service mesh features and their configuration. Service mesh is enabled by default on Consul server agents.

## Introduction

<VideoEmbed url="https://www.youtube.com/embed/8T8t4-hQY74"/>

In addition to the service discovery operations available to the Consul instance
that runs on the same node as your workload, you can use Consul to deploy Envoy
sidecar proxies to control traffic between each service and the rest of the
network. Consul includes a built-in certificate authority that can enforce mTLS
encryption between sidecar proxies. Use [Consul configuration entries](/consul/docs/fundamentals/config-entry) to further secure and monitor
service-to-service communication.

## Service mesh configuration

The `connect` block of a Consul server agent contains the configurations for the CA provider and locality information for the node. Refer to [Service mesh parameters](/consul/docs/reference/agent/configuration-file/service-mesh) for more information.

To learn how to turn the service mesh off or back on again, refer to [enable service mesh](/consul/docs/connect/enable).

## Envoy proxies

Consul includes built-in support for Envoy proxies to manage service mesh operations. Configure behavior for individual proxies, or configure default behavior for proxies according to service identity. For more information about proxies and their specialized operations in the service mesh, refer to [Service mesh proxy overview](/consul/docs/connect/proxy).

## Guidance

Runtime-specific guidance is also available:

- [Connect workloads to service mesh on VMs](/consul/docs/connect/vm)
- [Connect workloads to service mesh on Kubernetes](/consul/docs/connect/k8s)
- [Connect workloads to service mesh on ECS](/consul/docs/connect/ecs)
- [Connect Consul service mesh to AWS Lambda](/consul/docs/connect/lambda)
- [Connect workloads to service mesh on Nomad](/consul/docs/connect/nomad)

## Debug and troubleshoot

If you experience errors when connecting Consul's service mesh to your workloads, refer to the following resources:

- [Consul service mesh troubleshooting overview](/consul/docs/connect/troubleshoot)
- [Debug Consul service mesh](/consul/docs/connect/troubleshoot/debug)
- [Troubleshoot service-to-service
  communication](/consul/docs/connect/troubleshoot/service-to-service)
