Overview
A tunnel gives you secure, audited remote access to a device on a site network — a switch web UI, a firewall admin page, an SSH session — brokered through the site collector. You don't need a VPN to the client site; the collector terminates the tunnel locally and Pulse brokers your session to it. Tunnels are protocol-scoped, time-bound, can require approval, and are overseen by THEO.
Steps
- Open Pulse → Tunnels (or start a tunnel from a managed device's detail page).
- Choose the device and the protocol (e.g. HTTPS to a web admin UI, SSH to a CLI).
- If the target needs authentication, select the credential to use (stored encrypted on the Credentials page).
- Open the tunnel. If your policy requires approval, the tunnel enters Awaiting approval until an authorized user approves it.
- Once Active/Ready, use the brokered session. The tunnel records who opened it, the protocol, the reason, and when it opened.
Tunnel States
- Active — session is live and in use.
- Ready — established and available.
- Awaiting approval — waiting for an authorized approver (approval-required policy).
Every tunnel row shows Protocol, Status, Reason, Opened, and Actions, and a THEO oversight indicator — THEO watches active tunnels for anomalous activity.
Approving a Tunnel
If tunnels require approval at your org, an authorized user opens the Tunnels page and approves the pending request. The requester's tunnel then moves to Active. Relax or tighten the approval requirement in Settings.
Closing a Tunnel
Use the tunnel's row action to close it when you're done. Tunnels are meant to be short-lived; closing promptly keeps the audit trail clean and reduces exposure.
Troubleshooting
Tunnel stuck "Awaiting approval." No one has approved it yet. Approve it on the Tunnels page, or adjust the approval policy in Settings.
Can't authenticate to the device through the tunnel. Confirm the right credential is attached and is still valid. The tunnel only brokers the connection — the device still enforces its own login.
No tunnel option for a device. The device must be Managed and reachable by an Active collector at its site.