Smarter by Design.Simpler for Business
Web CLI
What Is WEB-CLI?
WEB-CLI is the in-browser terminal that is opened with the WEB-CLI button at the bottom right corner of the TR7 panel. It gives command line access without connecting to the device over SSH separately and without leaving the panel; in the background TR7's own command line engine runs and it offers a Cisco-style, hierarchical command tree with automatic completion. The same engine is also reached by connecting to the device over SSH; the two ways run the same commands.
Every session is a stateful terminal that runs in the user's own context: the command history is kept specific to the user, the vDevice and route table context selected for the system commands is preserved, and the permission of the user is checked before every command is run.
The command prompt is in the user@device-name> form: the user name is shown in green and the host name of the device in blue.
3 Command Branches
API · System · Pipe
Three separate command families for resource management, system tools and output processing.
18 Network & Diagnostic Tools
ping · dig · tcpdump…
Curated network and diagnostic tools; they run in the context of the selected vDevice and route table.
14 Pipe Filters
grep · jq · to-file…
Filters and transforms the command output and writes it to a temporary file; at most 8 filters in one line.
Role-Based Access
superAdmin · readOnly · area roles
The commands are opened according to the area permissions of the user; the system commands only for superAdmin.
The Three Command Branches
WEB-CLI offers three types of command. According to the task that is sought, one passes to the related branch:
API Commands
Manages the resources (lb, waf, ags, gtm, network, settings…) from the command line; the CLI equivalent of what the panel does.
→
System Commands
Curated network/diagnostic tools with
sys-cmd: ping, dig, tcpdump, curl, ss, ip, memory, file… in the context of the selected route table. →
Pipe Commands
Filters/transforms the output (
| grep, | jq, | to-file…) and writes it to a temporary file. →
The Terminal Window
When the WEB-CLI button at the bottom right corner (with the terminal icon) is clicked, a window titled TR7 WEB-CLI opens over the panel; when the button is clicked again, the window is hidden, the session is not closed.
- The title bar. On the left side there is the name of the window, and in the middle the vDevice / Route table indicator with the gear icon. The indicator writes the context in which the system commands will run; when it is clicked, a small window with the vDevice and Route table fields opens and the selection is made (tooltip: The route table for the sys-cmd commands); the selection is stored on a user basis and can be changed only in the connected session.
- The toolbar. The buttons for decreasing and increasing the font size (between 8–48 points, 11 steps, default 12), for minimizing, for maximizing/restoring and for closing the window. The maximized window covers the whole area except the left panel.
- The terminal area. When the connection is established, the command prompt comes. When the connection is cut or cannot be established, a status message and the Connect button are shown in the terminal; the button establishes the connection again. When the window is resized, the number of columns/rows of the terminal is adapted by itself.
Access and Permissions
WEB-CLI access is determined by two separate layers: by which way the CLI can be connected to (the user-based channel switches) and, after connecting, which commands can be run (the role).
The Channel: the CLI access switches
How every device user will reach the CLI is determined by two independent switches on the Device Users screen. These switches open two different access ways to the same CLI engine and are managed separately from each other:
| Switch (Device Users) | Function | Default |
|---|---|---|
| Access CLI over WEB | Access to the in-browser WEB-CLI terminal — the feature on this page | On (including the users created automatically from an external source such as LDAP/RADIUS) |
| Access CLI over SSH | Access to the same CLI by connecting to the device over SSH | On only for the superAdmin users |
If the WEB-CLI button is not visible
The WEB-CLI button at the bottom right corner of the panel is visible only if the Access CLI over WEB switch of the user is on; if it is off, the button is not shown at all. SSH access is not needed for WEB-CLI; Access CLI over WEB alone is enough.
The Permission: the role scope
Even if the channel is open, the commands that can be run are limited by the area permissions bound to the role of the user. Every top branch of the API commands is mapped to a permission area (network → Network, waf → WAF, gtm → GTM, lb and ags → Load Balancer, users → Users, settings and hw-mgmt → Settings); seeing the branch requires the view permission in that area, and running the writing commands (adding, editing, deleting, sending a command) requires the modify permission. Since the system commands are counted as a shell access, they are open only to the superAdmin role.
| Role | CLI Permission | What It Can Do |
|---|---|---|
| superAdmin | Full | All the API commands (reading and writing), the system commands (sys-cmd) and the pipe commands |
| readOnly | Read only | The API commands intended only for reading in all the areas; the writing commands and sys-cmd are closed |
| Area roles (e.g. wafManager, networkUser, trafficManager, monitor) | Limited to the area | Only the branches that fall into the areas of the role; the "Manager" roles can write in that area, the "User" roles are limited by the modify permission, the "ReadOnly"/"monitor" roles only read; sys-cmd is closed |
The permission check is two-sided
When a command outside the permission is tried, the command does not run and the Permission denied. warning is returned (on a user whose interface language is Turkish, Yetkiniz bulunmamaktadır.). The system commands additionally pass through the permission check again at every run on the server side; the user who runs it, the client IP and the command are written to the User Logs screen.
Navigation and Discovery
The fastest way of discovering WEB-CLI is the Tab key and the ? sign added to the end of the line; memorizing is not needed in order to see what is in the command tree. The shortcuts and the helper commands below can be used at any moment.
Sessions and Limits
The WEB-CLI sessions are kept within certain limits so that they run stably and securely:
2 / user
Concurrent session
A user can open at most 2 CLI sessions; when a third session is opened, the session that has been inactive for the longest time is closed with the
Maximum user session limit reached... message. 15 / device
Total sessions
Across the device at most 15 CLI sessions stay open; when it is exceeded, the session that has been inactive for the longest time is closed with the
Maximum total session limit reached... message. 10 minutes
Inactivity timeout
A session in which for 10 minutes neither a key is pressed nor output is produced is terminated with the
Closed due to inactivity... message; the long commands that produce flowing output do not fill the time. 8 stages
Maximum pipe chain
In a single command line at most 8
| filters can be chained one after another; on exceeding, the Maximum pipe exceeded error is returned. Command history
Between sessions
The entered commands are kept in a history file specific to the user and are used in the subsequent sessions too with ↑/↓ and
history. These limits are common for the SSH and the WEB-CLI sessions; both are included in the session counter of the same engine.
