Defining another management interface using the CLI

Use the commands in this section on an appliance that enforces listen interface constraints to define a management interface other than ether1, and add it to the listen interface list so it can accept HTTP/HTTPS requests and SSH connections.

To define another management interface:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Assign an IP address to the other interface:
```
hostname (config) # interface <interfaceName> ip address <ipAddress> <mask>
```
where:
- <ipAddress> is the IPv4 or IPv6 address of the interface.
- <mask> is the IPv4 mask length prefixed by a slash (for example, /24) or an IPv4 netmask (for example, 255.255.255.0), or the IPv6 mask length prefixed by a slash (for example, /48).
(For IP routing) Set the static route for the interface:
```
hostname (config) # ip route <networkPrefix> <mask> <gatewayIP> <interfaceName>
```
where:
- <networkPrefix> is the IPv4 or IPv6 network prefix specifying the network.
- <mask> is the IPv4 mask length prefixed by a slash (for example, /24) or a netmask (for example, 255.255.255.0), or the IPv6 mask length preceded by a slash (for example /48)
- <gatewayIP> is the IPv4 or IPv6 address of the gateway or next-hop device.
- <interfaceName> is the name of the management interface.
(For CLI access): Add the interface to the listen interface list for SSH connections:
```
hostname (config) # ssh server listen interface <interfaceName>
```

Verify your changes:

hostname (config) # show web
hostname (config) # show ssh server

Save your changes:
```
hostname (config) # write memory
```

Note
This procedure assigns a static IPv4 or IPv6 address to the interface. SLAAC or DHCPv6 can instead automatically assign the IPv6 address.

Example

The following example configures ether2 as the management interface on the acme-1 appliance. It then adds ether2 the listen interface list.

acme-1 (config) # interface ether2 ip address 10.1.2.3 /24
acme-1 (config) # web server listen interface ether2
acme-1 (config) # ssh server listen interface ether2
acme-1 (config) # show web
Web User Interface server:
   Web interface enabled:          yes
   HTTP enabled:                   yes
   HTTP port:                      80
   HTTP redirect to HTTPS:         yes
   HTTPS enabled:                  yes
   HTTPS port:                     443
   HTTPS protocols:                TLSv1
   HTTPS minimum protocol version: TLSv1
   HTTPS cipher list:              compatible
   HTTPS certificate name:         system-self-signed
   HTTPS CA chain name:

   Listen enabled: yes
   Listen Interfaces:
      Interface: ether1
      Interface: ether2
      Interface: lo 
   ...

acme-1 (config) # show ssh server
SSH server configuration:
   SSH server enabled:          yes
   Minimum protocol version:    2
   TCP forwarding enabled:      yes
   X11 forwarding enabled:    no
   Audit log file transfers:  yes
   Cipher list:   compatible
   Minimum key length:     1024 bits
   Client Alive Interval:    0
   Client Alive Count Max   3
   SSH server ports:        22
   
   Interface listen enabled:  yes
   Listen Interfaces:
      Interface: ether1
      Interface: ether2
...

Important
Listen interface constraints are enabled on the system by default. However, if the Listen enabled line in the show web command output is no, use the web server listen enable command to enable constraints for HTTP/HTTPS requests. If the Interface listen enabled line in the show ssh server command output is no, use the ssh server listen enable command to enable constraints for SSH connections.