---
title: Connecting with a Connection Reservation
slug: kronpam-reference-guide-3-9-0/connecting-with-a-connection-reservation
docTags: 
createdAt: 2026-10-08T08:47:18.028Z
---

:::hint{type="warning"}
**Prerequisite: An approved connection reservation must cover the user, the applicable OT device or device group, and the current time. See "Managerial Approval Connection Reservation" in the Approval Management section.**
:::

To connect with an approved reservation:

1.    Open the SSH tunnel with the command described in "OT/ICS Session Manager Connection".

2.    Connect the application to *localhost:\[Local\_Port]*.

3.    Read the messages that Kron PAM writes to the gateway shell:

KronPAM: \[SECURITY] Managerial approval required for TCP Proxy connection. Checking existing reservation...

KronPAM: \[SECURITY] Found valid reservation. You may now retry the connection.

4.    Retry the connection. Kron PAM forwards the new connection to the target device. Many clients, such as browsers, retry failed connections automatically, so you might not need to retry manually.

:::hint{type="info"}
**The SSH client can also display a generic channel-open failure when Kron PAM blocks a forwarded connection. Use the tagged Kron PAM messages in the gateway shell to identify the approval state. Kron PAM checks reservation status every 15 seconds. When it detects that a reservation is canceled or expired, it terminates all forwarded TCP channels. If kill.session.on.reservation.end is true, Kron PAM also closes the tunnel session. If the setting is false, the tunnel remains open and later forwarded connection attempts go through the approval flow again.**
:::



![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/C2FOEXHjyrCxv5BXyOPaY_image.png "Figure: Reservation Approval in an OT/ICS Session")