FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

I lost access to the management interface (Allowed Networks); how do I restore it from the CLI? ​

Short answer

The allowed network lists on the Management Access screen are kept separately for HTTP, HTTPS and SSH; if the HTTPS list left out the network being connected from, SSH access may have remained open. The device is connected to over SSH (Access CLI over SSH must be on for the user), and the list is corrected in the same CLI with the settings access command: the current list is seen with settings access show, and the management network is added to the first empty index with settings access update --httpsAllowedNetworks.N.ip <network-address> --httpsAllowedNetworks.N.cidr <cidr>. If the list is emptied with --httpsAllowedNetworks.delete, the network restriction is removed completely. If the interface does not open not because of the network restriction but because the service has stopped, the status is seen with sys-cmd management-access status and the service is restarted with restart.

Problem: The Allowed Network List Left Out the Management Connection ​

On the Management Access screen, the HTTPS Allowed Networks (or HTTP Allowed Networks) list was narrowed and then saved; since the network the management computer connects from is not in the list, the management interface no longer opens. The saved list allows that service to be accessed only from the networks in the list. Since the interface does not open, WEB-CLI cannot be used either; the correction is made through another access path.

Solution: Two Methods ​

First, the cause needs to be separated: if access was cut right after an allowed network change, Method 1 is applied; if the management access service is not running, Method 2. Both methods are performed in the CLI opened over SSH.

Your situationSuitable method
I cannot access the interface after changing the Allowed Networks listMethod 1: Correct the Allowed Network with settings access
The setting did not change; the interface does not open from any networkMethod 2: Check the Service with sys-cmd management-access
  • How it workssettings access is the CLI counterpart of the settings on the Management Access screen; the allowed network list of each service is written with the --<service>AllowedNetworks.N.ip and --<service>AllowedNetworks.N.cidr fields. If the list is empty, the service is open to all the networks that can reach the address it listens on.
  • Where it is opened The CLI opened by connecting to the device over SSH (the same commands as WEB-CLI)
  • Requirement The SSH listening address must be defined and the SSH Allowed Networks list must allow the network being connected from; for the user, Access CLI over SSH on and the modify permission in the Settings area.
  • Scope The management access of the device; it does not affect vService traffic.

Step-by-Step Configuration ​

1
Adım 1 Connect to the device over SSH

From the management computer, a connection is made to the SSH listening address of the device with the SSH port in Management Access (default 22); when the session is opened, the TR7 CLI comes up.

2
Adım 2 See the existing list

The access settings are displayed; the items in the HTTPS allowed network list and their indexes are noted:

text
settings access show
3
Adım 3 Add the management network to the first empty index

For example, if there are two networks with indexes 0 and 1 in the list, the management network is added with index 2; if it is written to an existing index, the network at that index changes:

text
settings access update --httpsAllowedNetworks.2.ip <network-address> --httpsAllowedNetworks.2.cidr <cidr>

<network-address> is the network of the address with which the management computer appears to TR7; if a device that translates addresses is in between, the source address that reaches TR7 is taken as the basis. The list takes at most 10 items. If access is used over HTTP, the same operation is performed with --httpAllowedNetworks (HTTP).

4
Adım 4 Remove the restriction if needed

If the management network is not known, the list is temporarily emptied; with an empty list, no network restriction is applied:

text
settings access update --httpsAllowedNetworks.delete

When access returns, the list is defined again from the interface with the correct networks.

Verification ​

1SettingTR7 side

settings access show is run again.

ExpectedThe management network is in the HTTPS allowed network list, or the list is empty
2InterfaceClient side

The management interface is opened again in the browser.

ExpectedThe login screen is displayed

Method 2: Check the Service with sys-cmd management-access ​

  • How it workssys-cmd management-access checks the service that serves the connections coming to the management interface over HTTP and HTTPS: status shows the status of the service, and restart restarts the service with confirmation. The addresses and ports the service listens on and its allowed networks do not change with this command.
  • Where it is opened The CLI opened by connecting to the device over SSH
  • Requirement A user whose User Type is Admin; system commands run only with this user type.
  • Scope The device on which the command is run; it is not affected by the selected v-device and route table. Load balancing and WAF traffic do not pass through this service.

Step-by-Step Configuration ​

1
Adım 1 See the status of the service

The Active: line shows whether the service is running (management-access status):

text
sys-cmd management-access status
Active: lineMeaning
active (running)The service is running; the problem is most likely in the allowed network or the network path (Method 1)
activatingThe service is starting
inactive (dead) · failedThe service is not running; the management interface cannot be accessed from the browser
2
Adım 2 Restart the service

If the service is not running or appears to be stuck, it is restarted:

text
sys-cmd management-access restart
3
Adım 3 Confirm

On the confirmation screen, the You are about to restart the management access service warning appears; evet is written in the Turkish interface and yes in the English interface. If anything else is written, the Invalid confirmation. Operation cancelled. message appears; Esc closes the confirmation screen.

Verification ​

1Service statusTR7 side

After the restart, the status is read again.

Command: sys-cmd management-access status | grep Active

Expectedactive (running)
The Management access service restarted. message is written without looking at the result of the operation; the result is always verified with status.

Common Mistakes ​

Alternative access path first

Before the allowed network list, listening address or port is changed, it is verified that a second access path such as SSH is open. If the HTTP, HTTPS and SSH lists all leave out the network being connected from, no correction can be made through any of these paths; in this case, the TR7 support team is contacted.

  • Writing the allowed network field with a single value. Each item consists of two fields: --httpsAllowedNetworks.N.ip is the network address, and --httpsAllowedNetworks.N.cidr is the mask length.
  • Adding a network by writing to an existing index. In the update command, a value written to an existing index replaces that item; adding is done with the first empty index (How are array / object fields (e.g. listen) entered in the CLI?).
  • Trying to recover with settings access reset. reset returns all the access settings to their defaults and can cut the management connection; update is used to correct a single list (init and reset).
  • Expecting the allowed network to open with management-access restart. The command only restarts the service; the addresses, ports and allowed networks come from the Management Access settings.
  • Correcting the HTTP list and trying to connect with HTTPS. The list of each service is separate; the list of the protocol being connected with is corrected.

How it is done in the documentation

Related questions