---
title: OT/ICS Session Manager Connection
slug: kronpam-reference-guide-3-9-0/otics-session-manager-connection
docTags: 
createdAt: 2026-05-11T09:54:16.800Z
---

OT/ICS Session Manager sessions use an SSH tunnel to forward TCP traffic from the operator's local machine through Kron PAM to the target device.

**Example Command:**

ssh -N -L \[Local\_Port]:\[Target\_IP]:\[Target\_Port] \[PAM\_User]@\[PAM\_IP] -p \[PAM\_SSH\_Port]

·         **Local Port:** The port on the user's machine used to access the application.

·         **Target IP/Port:** The destination address in the OT/IT environment.

·         **PAM Gateway:** The Kron PAM server acting as the proxy.

After the tunnel is authenticated, connect the application to *localhost:\[Local\_Port].*

:::hint{type="info"}
**When a connection approval workflow covers the session, the tunnel opens as usual, but Kron PAM blocks forwarded connections until a valid approval or connection reservation allows access. See "Requiring Managerial Approval for OT/ICS Sessions".**
:::

:::hint{type="info"}
**If multitenancy is enabled, include the tenant in the user name, for example ssh -L \[Local\_Port]:\[Target\_IP]:\[Target\_Port] \[PAM\_User]@\[Tenant]@\[PAM\_IP] -p \[PAM\_SSH\_Port].**
:::

:::hint{type="info"}
**When multi-factor authentication covers the session, Kron PAM requests a one-time password before it forwards traffic to the target device. See "Using MFA for OT/ICS Sessions".**
:::



.