FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

Can I manage the Load Balancer configuration via CLI or API? ​

Short answer

Yes. The WEB-CLI button at the bottom right corner of the panel opens the TR7 WEB-CLI terminal in the browser; users with Access CLI over SSH turned on also connect to the same CLI over SSH. The lb command branch manages the Load Balancer resources, from the vService to the certificate, with the list, show, add, update and delete commands; the field names and options come from the same definitions as the interface and are discovered using Tab and ?. WEB-CLI is a client of the REST API on the device; validation and role permissions are the same as in the interface, and every change made is written to User Logs. The endpoints of the REST API are documented in API7 Docs. The WEB-CLI button is visible only to users with Access CLI over WEB turned on.

How Does It Work? ​

  1. The WEB-CLI and SSH sessions connect to the same command engine; the command prompt is in the user@device-name> form.
  2. Every API command (lb, waf, network, settings …) goes as a request to the REST API on the device; the same field definitions and validations as in the forms of the interface are applied.
  3. Before the command runs, the role of the user is checked: seeing a branch requires the view permission in that area, and the writing commands (adding, editing, deleting) require the modify permission; for a command outside the permission, Permission denied. is returned (Permission: the role scope).
  4. Every change made from the CLI and the REST API is written to User Logs; for operations from WEB-CLI, @web-console is appended to the User-agent cell, and for those from SSH, @ssh (Can I see who made changes and when?).
  5. In a cluster setup, a change made with the CLI is synchronized like a change in the interface: with the default automatic synchronization it passes to the peer device immediately; if Manual Sync Mode is on, it is sent with Synchronize.

Access Paths ​

PathHow it is openedRequirement
WEB-CLIThe WEB-CLI button at the bottom rightAccess CLI over WEB is on for the user (on by default for a new user)
SSHThe device address is connected to over SSHAccess CLI over SSH is on for the user (off by default for a new user)
REST APIThe endpoints and authentication are described in API7 Docs; requests are made with the Bearer token obtained after logging inA user account and the permission of the role in the related area

The switches are in the user form on the Settings → User Management → Device Users screen (Channel: the CLI access switches). A user can open at most 2 CLI sessions at the same time, and the device at most 15 CLI sessions in total (Sessions and limits).

Using WEB-CLI in TR7 ​

  • Discovery: lb is typed and the subcommands are listed with Tab; when ? is typed at the end of the line and Enter is pressed, the fields that can be used at that position are listed; --info shows the description of a command without running it (Navigation and discovery).
  • Basic commands: The vServices are listed, one is shown and disabled; the vService name is selected with Tab (lb service · Command Summary):
text
lb service list
lb service show <vService>
lb service update id <vService> --active false

Common Misconceptions ​

  • "The WEB-CLI button is visible to everyone." The button is visible only to users with Access CLI over WEB turned on.
  • "The CLI bypasses the permissions in the interface." The CLI runs with the same role permissions; a read-only user runs only the read commands, and the sys-cmd system commands are open only to the Admin (superAdmin) user type.
  • "CLI changes are not recorded." Every change made from the CLI is written to User Logs.
  • "In WEB-CLI, a command can be split over multiple lines." Each line runs as a separate command; long commands are written on a single line.

How it is done in the documentation

Related questions