# Connect overview

> Connect gives your team SSH, RDP, and HTTPS access to devices from the browser. Each session runs through a probe on the device's network.

Section: Connect  
Source: https://www.itva.com/docs/connect/connect-overview  
Last updated: 2026-11-03

Connect is the privileged access management (PAM) part of ITVA. You use it to open SSH, RDP, and HTTPS sessions to your devices from the browser, without a VPN or a direct network path to the device.

## How Connect works

Your browser never connects to the device directly. When you start a session, ITVA sends the request to a probe on the device's network. The probe opens the connection to the device and relays the traffic to your browser.

If you start a session from a device, ITVA uses a probe that is assigned to that device as its primary or secondary probe. Administrators can also select a probe themselves. To set up a probe, see [Add your first probe](https://www.itva.com/docs/getting-started/adding-your-first-probe).

## Supported protocols

| Protocol | Default port | Opens as | Sign-in |
| --- | --- | --- | --- |
| SSH | 22 | A terminal in the browser | A saved credential, or a username and password |
| RDP | 3389 | A remote desktop in the browser | Username, password, and optional domain. ITVA does not store them. |
| HTTPS | 443 | The device's web interface in a new tab | You sign in on the device's own web page |

_If a device has a Connect Port, SSH uses it. For HTTPS, web-managed devices such as firewalls use their Management Port._

ITVA selects the protocol from the device vendor. Windows Server devices start with RDP. Fortigate, Palo Alto, SonicOS, and HiveMQ devices start with HTTPS. All other devices start with SSH. You can change the protocol before you connect.

## Where you can start a session

- The **Connect** page in the top navigation. Select a device from the list.
- The **Connect** button on a device's page.
- The device panel on a network diagram.
- The IP address and port buttons in subnet scan results.

## Who can use Connect

The **Connect** page shows only if your role has the **View** permission for **Connect**. To start a session, your role needs the **Manage** permission for both **Connect** and **Devices**. To change a role, see [Roles and permissions](https://www.itva.com/docs/access-management/roles-and-permissions).

Some fields on the connection form show only for administrators. Administrators can enter a username and password for SSH, and they can select a probe. Other users sign in to SSH with a saved credential, and ITVA selects the probe for them.

## Require MFA for a device

You can make users enter a one-time password before they connect to a specific device. On the device's form, select **Require MFA to manually connect to devices via SSH / RDP / HTTP**. The setting applies to all three protocols. In a device CSV import, set the `connect_mfa` column to `TRUE`.

When this setting is on, each user must set up MFA on their own account first. After the user selects connect, ITVA asks for a one-time password before it opens the session.

## Session logs and SSH replay

ITVA logs Connect sessions in **Settings** > **Logging**. Each protocol has its own tab: **SSH Logs**, **RDP Logs**, and **HTTP Logs**. Each log shows the user, the start and end time, and the duration of the session.

On the **SSH Logs** tab, select **View SSH Session** to replay a terminal session. If ITVA found configuration changes during an SSH or HTTPS session, the log also has a **Change Summary**.

ITVA records SSH sessions by default. An administrator can turn off **Record SSH** in **Settings** > **Organization**. When it is off, new SSH sessions do not show in **SSH Logs** and you cannot replay them.