This narrative walks from a fresh install to a brokered SSH session with recording and audit metadata — the minimum path to prove value before a wider rollout.
Deploy
Control plane
Connector
Joins estate
Target
SSH asset
Grant
Group → asset
Verify
Record + audit
Pilot to first session in under fifteen minutes.
A Linux VM or Kubernetes cluster for the control plane, one SSH target reachable from the gateway connector, and an IdP (Okta, Azure AD, or local accounts for lab). Helm or Docker Compose handles the install; no agents on targets.
Control plane
Linux VM or Kubernetes cluster
SSH target
Reachable from the gateway connector
Identity provider
Okta · Azure AD · local accounts for lab
Authenticate
Operator uses their own identity
MFA at connect
Gateway challenge when policy requires it
SSH session
Normal client through the gateway
Evidence captured
Recording · command log · metadata
Export-ready audit from the first brokered session
An operator authenticates with their own identity, requests or uses a grant to the target, completes MFA at connect time, and works in a normal SSH client — while Ixiea records the session and writes structured metadata you can search and export.
Step by step
Install with Helm or Docker Compose following the getting-started guide. Verify the API and admin console are reachable. Create your organization and connect your IdP — or enable local admin for lab use.
Deploy a connector node in the same network as your SSH target. The connector registers with the control plane and advertises supported protocols. Health checks confirm it is ready to broker.
Add the SSH host as an asset — hostname, port, and optional account mapping. Tag it by environment (prod, staging) for policy scoping. No agent install on the target.
Bind your operator group to the asset with SSH allowed. For lab, a standing grant is fine; production should use JIT with approvers. The grant is the only path to the target — not VPN or security group membership alone.
Open your SSH client through Ixiea (CLI or web terminal). Complete MFA at gateway login if your policy requires it. Run a few commands, disconnect, then open the session audit view — confirm recording playback, command log, identity attribution, and export-ready metadata.
Operational docs
Related guides
Ixiea control plane: core API, protocol connectors, recording pipeline, and audit store.
Standalone, active/standby, horizontal scale, and multi-region gateway, when each fits.
How users, targets, accounts, protocols, and time windows combine into enforceable grants.
Graduated enforcement for commands and connections, permit, block, approve, mask, or alert at the gateway.
Ready to evaluate?
Walk through gateway brokering, recording, and audit exports in a working session — or browse the illustrated product flow first.
