show ip http server status
Displays the operational status and configuration of the HTTP server (web server) on the Cisco IOS device, used to verify if the web-based GUI or REST API is enabled and accessible.
Definition: show ip http server status is a Cisco IOS privileged exec command. Displays the operational status and configuration of the HTTP server (web server) on the Cisco IOS device, used to verify if the web-based GUI or REST API is enabled and accessible.
Overview
The `show ip http server status` command is a vital diagnostic tool for Cisco network engineers, particularly when dealing with automation, web-based management, or REST API integration. This command reveals the operational state of the embedded HTTP/HTTPS server on a Cisco IOS device, which is responsible for hosting the web-based GUI (such as Cisco Configuration Professional or WebUI) and serving RESTCONF/NETCONF API endpoints. Understanding this command is essential for CCNA and CCNP candidates because modern networks increasingly rely on programmability and automation; the HTTP server is the gateway for these capabilities.
The command displays whether the server is enabled or disabled, the listening port (default 80 for HTTP, 443 for HTTPS), the number of active connections, and authentication settings. It also shows the timeout values and whether the server is configured to accept connections from specific IP addresses or subnets. The underlying concept is that Cisco devices can act as web servers, allowing administrators to manage the device via a browser or scripted API calls.
This is particularly useful for zero-touch provisioning, monitoring dashboards, and integrating with orchestration tools like Ansible or Cisco DNA Center. You would reach for this command when troubleshooting connectivity issues to the web interface, verifying that the HTTP server is running after a configuration change, or checking if the server is overloaded with connections. It is an alternative to checking the running configuration (`show running-config | include ip http`) but provides real-time operational data that the config alone cannot, such as active sessions and server state.
In the broader workflow, this command is often used after configuring `ip http server` or `ip http secure-server` to confirm the service is up, or when a user reports being unable to access the web GUI. Important IOS behaviors include: the command requires privileged EXEC mode (enable); the output is not buffered (it shows current state); the HTTP server can be disabled by default on some IOS versions for security; and enabling the server may impact CPU usage if many clients connect. The command also shows if the server is using local or AAA authentication, which is critical for security audits.
For CCNA/CCNP candidates, mastering this command builds foundational knowledge for network automation and device management, which are key topics in the new exam blueprints.
show ip http server statusWhen to Use This Command
- Troubleshooting why the web interface (e.g., Cisco Configuration Professional) cannot connect to the router.
- Checking if the HTTP server is enabled before configuring REST API access for automation.
- Verifying HTTP server settings after a security audit to ensure it is disabled on production devices.
- Confirming the port number and authentication method when setting up remote management via HTTPS.
Command Examples
Basic status check
show ip http server statusHTTP server status: Enabled HTTP server port: 80 HTTP server authentication method: local HTTP server access class: 10 HTTP server active session count: 2 HTTP server maximum session count: 5 HTTP server session idle timeout: 300 seconds HTTP server session life timeout: 600 seconds HTTP server secure server capability: Present HTTP server secure server status: Enabled HTTP server secure port: 443 HTTP server secure client authentication: Disabled HTTP server secure trustpoint: TP-self-signed-12345678
Line 1: Shows whether the HTTP server is enabled or disabled. Line 2: Port number for HTTP (default 80). Line 3: Authentication method (local, enable, tacacs, etc.). Line 4: Access-class ACL number if applied. Line 5: Number of currently active sessions. Line 6: Maximum allowed sessions. Line 7: Idle timeout in seconds. Line 8: Maximum session lifetime. Line 9: Indicates if HTTPS capability is present. Line 10: Whether HTTPS is enabled. Line 11: HTTPS port (default 443). Line 12: Whether client certificate authentication is required. Line 13: Trustpoint used for HTTPS certificate.
HTTP server disabled
show ip http server statusHTTP server status: Disabled HTTP server secure server capability: Present HTTP server secure server status: Disabled
This output indicates the HTTP server is disabled. The secure server capability is present but also disabled. No further details are shown because the server is not running.
Understanding the Output
The output provides a summary of the HTTP server configuration and current state. Key fields: 'HTTP server status' indicates if the server is running (Enabled/Disabled). 'HTTP server port' shows the listening port (default 80).
'HTTP server authentication method' shows how users are authenticated (local, enable, tacacs, etc.). 'HTTP server access class' shows any ACL restricting access. 'HTTP server active session count' shows current connections; high numbers may indicate heavy usage or a DoS attack.
'HTTP server maximum session count' is the limit; if reached, new connections are rejected. 'HTTP server session idle timeout' and 'session life timeout' control session persistence. For HTTPS, 'HTTP server secure server status' shows if HTTPS is enabled, and 'HTTP server secure port' shows the port (default 443).
'HTTP server secure trustpoint' shows the certificate used. In a production network, HTTP should typically be disabled and only HTTPS enabled for security. If the server is unexpectedly enabled, it could be a security risk.
If disabled and you need web access, you must enable it with 'ip http server' and optionally 'ip http secure-server'.
Configuration Scenarios
Enable HTTP Server for Web-Based Management
A network administrator needs to access the web GUI of a Cisco router to configure QoS policies. The HTTP server is currently disabled, and the administrator must enable it and verify it is running.
Topology
PC(192.168.1.100)---(Gi0/0)Router(Gi0/1)---10.0.0.0/30Steps
- 1.Step 1: Enter privileged EXEC mode: Router> enable
- 2.Step 2: Enter global configuration mode: Router# configure terminal
- 3.Step 3: Enable the HTTP server: Router(config)# ip http server
- 4.Step 4: (Optional) Set authentication method: Router(config)# ip http authentication local
- 5.Step 5: Exit configuration mode: Router(config)# end
- 6.Step 6: Verify the server status: Router# show ip http server status
! Router(config)# ip http server Router(config)# ip http authentication local Router(config)# end
Verify: Run `show ip http server status`. Expected output includes: 'HTTP server enabled', 'HTTP server port: 80', 'HTTP server active clients: 0'. Also verify from PC: open browser to http://192.168.1.1 (router's IP).
Watch out: If the HTTP server does not start, check if the device has sufficient memory or if the HTTP server is already enabled. Also ensure that an ACL is not blocking access; use `ip http access-class` to restrict access if needed.
Secure the HTTP Server with HTTPS and Access Control
A security policy requires that all web management traffic be encrypted. The administrator must enable HTTPS, disable plain HTTP, and restrict access to the management subnet only.
Topology
Management PC(10.10.10.10)---(Gi0/0)Switch(Gi0/1)---10.10.10.0/24Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Enter global configuration mode: Switch# configure terminal
- 3.Step 3: Enable the HTTP secure server: Switch(config)# ip http secure-server
- 4.Step 4: Disable the plain HTTP server: Switch(config)# no ip http server
- 5.Step 5: Create an ACL to allow only management subnet: Switch(config)# access-list 10 permit 10.10.10.0 0.0.0.255
- 6.Step 6: Apply ACL to HTTP server: Switch(config)# ip http access-class 10
- 7.Step 7: Exit and verify: Switch(config)# end
- 8.Step 8: Check status: Switch# show ip http server status
! Switch(config)# ip http secure-server Switch(config)# no ip http server Switch(config)# access-list 10 permit 10.10.10.0 0.0.0.255 Switch(config)# ip http access-class 10 Switch(config)# end
Verify: Run `show ip http server status`. Expected output: 'HTTP server disabled', 'HTTP secure server enabled', 'HTTP secure server port: 443'. Also verify from PC: https://10.10.10.1 should work, http://10.10.10.1 should fail.
Watch out: When disabling HTTP, ensure HTTPS is enabled first, otherwise you may lose all web access. Also, the ACL applies to both HTTP and HTTPS; if the ACL is misconfigured, even HTTPS access will be denied.
Troubleshooting with This Command
When troubleshooting HTTP server issues, the `show ip http server status` command is your first line of defense. A healthy output shows 'HTTP server enabled' (or 'HTTP secure server enabled') and 'HTTP server port: 80' (or 443). The 'HTTP server active clients' field should be low (0-5 for typical use); if it is high, the server may be under attack or a client is stuck.
The 'HTTP server authentication method' should match your configuration (e.g., 'local', 'aaa', 'enable'). If the server is 'disabled', check the running config for `ip http server` or `ip http secure-server` commands. If the server is enabled but you cannot connect, focus on the 'HTTP server access class' field: if it shows an ACL number, verify that ACL permits your source IP.
For example, if the ACL is 10 and your IP is 192.168.1.100, run `show access-list 10` to confirm. Another key field is 'HTTP server state': it can be 'running' or 'initializing'. If it shows 'initializing' for a long time, the server may be stuck due to low memory or a configuration error.
Also check 'HTTP server timeout' – if it is too low, sessions may drop prematurely. Common symptoms this command helps diagnose include: 'Cannot access web GUI' (check if server is enabled and ACL), 'Web GUI is slow' (check active clients and timeout), 'HTTPS certificate errors' (check if secure server is enabled and certificate is configured). A step-by-step diagnostic flow: 1) Run `show ip http server status` to see if server is enabled. 2) If disabled, check config and enable it. 3) If enabled but no access, check the access-class ACL. 4) If ACL is correct, check if the port is blocked by a firewall or if the device has a route back to the client. 5) Use `debug ip http` to see incoming requests (caution: CPU intensive).
Correlate with `show tcp brief` to see if the HTTP port is listening. For HTTPS, also check `show ip http secure-server status` (some IOS versions). On IOS-XE, the output may include additional fields like 'HTTP server model' (e.g., 'NGINX') and 'HTTP server process ID'.
If the server is not responding, check `show process cpu` for high CPU caused by HTTP processes. Remember that the HTTP server can be disabled by default on newer IOS versions for security; always verify after an IOS upgrade.
CCNA Exam Tips
CCNA exam may ask which command verifies if the HTTP server is running; answer is 'show ip http server status'.
Know that 'ip http server' enables HTTP on port 80, and 'ip http secure-server' enables HTTPS on port 443.
Be aware that the default authentication method is 'local' unless changed with 'ip http authentication'.
The exam might test that HTTP is disabled by default on newer IOS versions for security.
Common Mistakes
Confusing 'show ip http server status' with 'show ip http server' (the latter does not exist; correct command includes 'status').
Assuming HTTP server is enabled by default; it is disabled on most modern IOS images.
Forgetting that HTTPS requires a trustpoint; if not configured, 'ip http secure-server' will fail.
Misinterpreting 'HTTP server status: Enabled' as meaning HTTPS is also enabled; they are separate.
show ip http server status vs ip http server
These two commands are commonly confused because one enables the HTTP server, while the other displays its operational status. Understanding the difference is crucial for troubleshooting web-based management access.
| Aspect | show ip http server status | ip http server |
|---|---|---|
| Scope | Displays current HTTP server configuration and status | Enables or disables the HTTP server feature globally |
| Configuration mode | Privileged EXEC mode | Global configuration mode |
| Persistence | Output snapshot; no effect on configuration | Modifies running config; saved to startup config |
| Typical use | Verify server state, port, and authentication settings | Allow web GUI or REST API access |
| Purpose | Diagnostic and monitoring | Enabling a management service |
Use show ip http server status when you need to verify if the HTTP server is operational and check its configuration details like port and authentication.
Use ip http server when you need to enable the HTTP server to allow web-based management or REST API access to the device.
Platform Notes
On IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the `show ip http server status` command is available but the output format differs slightly. It includes fields like 'HTTP server model' (e.g., 'NGINX' or 'IOS_HTTP') and 'HTTP server process ID'. The command `show ip http secure-server status` may be separate.
On NX-OS (e.g., Nexus 9000), the equivalent command is `show system http` or `show web-server status`. NX-OS uses a different web server (often based on nginx) and the syntax for enabling is `feature http-server` and `feature https-server`. On ASA firewalls, the equivalent is `show http server status` or `show webvpn`; ASA uses a different web server for ASDM.
For IOS-XR, the command is not directly available; instead, use `show http-server status` or `show web-server status` depending on the platform. In terms of IOS version differences: In 12.x, the output is simpler with fewer fields; in 15.x, additional fields like 'HTTP server active clients' and 'HTTP server timeout' were added; in 16.x (IOS-XE), the output is more verbose and includes process details. Always check the specific IOS documentation for your version, as field names may vary slightly.
For CCNA/CCNP, be aware that the command exists across platforms but with different names; the concept of verifying the web server status is universal.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions