All pages
❄ Snowflake | Openflow SQL Server Connector

Network Configuration

TCP/IP requirements for SQL Server 2022 and Snowflake Openflow connectivity.

SQL Server 2022 protocol stack

SQL Server 2022 uses the Tabular Data Stream (TDS) protocol for all client-server communication. TDS operates over TCP/IP and supports multiple encryption modes.

SQL Server
Port 1433
→TDS / TCP-IP
Openflow Runtime
SPCS Container
→HTTPS / 443
Snowflake
Destination

TCP port requirements

PortProtocolServiceDescription
1433TCPTDS (Tabular Data Stream)Primary SQL Server communication protocol
1434UDPSQL Server BrowserNamed instance discovery (optional)
443TCPHTTPSSnowflake API endpoints

TDS encryption modes

SQL Server 2022 introduces TDS 8.0 with strict encryption support. Choose the appropriate mode based on your security requirements.

⚠ Encrypt=false

ProtocolTDS 7.x
SecurityNone
Use CaseDevelopment / Testing only

✓ Encrypt=true

ProtocolTDS 7.x
SecurityTLS 1.2+
Use CaseStandard production

✓ Encrypt=strict

ProtocolTDS 8.0
SecurityTLS 1.3
Use CaseHigh-security environments

Connection string reference

The JDBC connection string format for SQL Server 2022 with Openflow:

jdbc:sqlserver://<host>:1433;encrypt=false

Point the URL at the instance (no databaseName), and the connector discovers the databases to replicate. databaseName is only used for Azure SQL Database (single-database PaaS).

Common parameters

  • encrypt: Enable TLS encryption
  • trustServerCertificate: Skip cert validation
  • loginTimeout: Connection timeout (seconds)
  • applicationIntent: ReadOnly for AG replicas

Security recommendations

  • Use encrypt=true in production
  • Avoid trustServerCertificate=true
  • Consider TDS 8.0 strict mode for sensitive data
  • Use dedicated service accounts, not SA
Learn more
SQL Server network configuration TDS 8.0 strict encryption Openflow

External Access Integration (EAI)

On Openflow for Snowflake (SPCS), the runtime runs inside Snowpark Container Services and cannot reach an external host like your SQL Server until you grant it egress with an External Access Integration. These four steps open the path to port 1433.

1 Create a Network Rule

Network Rules define which external hosts and ports the runtime can reach.

CREATE NETWORK RULE sqlserver_openflow_rule
  TYPE = HOST_PORT
  MODE = EGRESS
  VALUE_LIST = ('<your-host>:1433');

2 Create the External Access Integration

An EAI bundles one or more network rules and enables egress from SPCS containers.

CREATE EXTERNAL ACCESS INTEGRATION sqlserver_openflow_eai
  ALLOWED_NETWORK_RULES = (sqlserver_openflow_rule)
  ENABLED = TRUE;

3 Grant USAGE to the runtime role

The runtime's role needs USAGE on the integration.

GRANT USAGE ON INTEGRATION sqlserver_openflow_eai
  TO ROLE <runtime_role>;

4 Attach the EAI to the runtime

In the Openflow Control Plane, open Runtime → ... menu → External access integrations and attach sqlserver_openflow_eai. Wait for the runtime to return to RUNNING before you start the connector.

Why this is required

Without an attached EAI, the connector's controller services fail verification with connectivity errors even when the SQL Server host and credentials are correct. If a source host or port changes later, update the Network Rule's VALUE_LIST and the runtime picks it up.

Network Troubleshooting

Connectivity is the most common place a first-time setup stalls. Match the error to its cause below, then work the quick checks.

Common errors

SymptomCauseFix
UnknownHostExceptionDNS resolution failed, host not in the Network RuleAdd the host to the Network Rule VALUE_LIST
SocketTimeoutExceptionPort blocked, not in the Network Rule or a firewallEnsure port 1433 is in the VALUE_LIST and open on the source firewall
Connection RefusedHost reachable but SQL Server not listeningVerify TCP/IP is enabled in SQL Server Configuration Manager
SSL/TLS Handshake FailedCertificate mismatch or unsupported TLS versionUse encrypt=false for local testing, or configure a valid certificate

Quick checks

Work these in order

  • The EAI is attached to the runtime and the runtime is RUNNING.
  • The Network Rule VALUE_LIST contains the exact host:1433 from your connection URL.
  • The connection URL is instance-level (no databaseName): jdbc:sqlserver://<host>:1433;encrypt=false.
  • The SQL Server login can reach the databases and has VIEW CHANGE TRACKING granted.
  • If TLS is enforced on the source, use encrypt=true;trustServerCertificate=true.

Security notes

  • Use encrypt=true in production; avoid trustServerCertificate=true.
  • Consider TDS 8.0 strict mode for sensitive data.
  • Use a dedicated service account, not sa.