Course contents

Chapter 1: Cisco IOSLesson 3 of 10

Banners: MOTD, login and exec

Configure banner motd, login and exec with a delimiter, know the order they appear in and write a safe legal warning.

Beginner · 6 min read

Technical definition

Banner is a text message a Cisco device shows when someone connects. The MOTD, login and exec banners appear at different moments and are typically used to warn that access is restricted.

The four banner types

When each banner appears
When each banner appearsCommand; When shown; Typical use. banner motd: First, on every connection, before login Maintenance notices and the legal warning banner login: After the MOTD, before the username or password prompt Access warning shown only to people about to log in banner exec: After login, when an EXEC session starts Messages for authenticated users, such as policy reminders banner incoming: On a reverse Telnet connection to a line Rare; terminal server setupsCommandWhen shownTypical usebanner motdFirst, on every connection, beforeloginMaintenance notices and the legalwarningbanner loginAfter the MOTD, before the usernameor password promptAccess warning shown only to peopleabout to log inbanner execAfter login, when an EXEC sessionstartsMessages for authenticated users,such as policy remindersbanner incomingOn a reverse Telnet connection to alineRare; terminal server setups

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Order seen by a user: motd, then login, then the password prompt, then exec.

Configuring a banner

Example commands and output on this page were written from Cisco IOS documentation and generally described behaviour. They were not captured from a live device, so prompts and details can differ on your platform and version.

configure terminal banner motd # AUTHORISED ACCESS ONLY. Activity on this device may be monitored. Unauthorised use may result in prosecution. # end

The first # starts the text and the last # on its own line ends it. Pick a delimiter that is not in the message.

On one line, the form is banner motd #Authorised access only#. Remove a banner with no banner motd.

What the user sees

Example output · based on Cisco documentation; exact format varies by platform and software version
PC>ssh -l admin 192.0.2.1
AUTHORISED ACCESS ONLY.
Activity on this device may be monitored.
Unauthorised use may result in prosecution.

Password:
Example output. The banner appears before the password prompt, so the warning is seen before any attempt to log in.

Good practice

  • Say access is restricted and monitored; do not say welcome.
  • Do not reveal the device type, software version or network details.
  • Use the same text on every device, and check it with your legal team where required.
  • Save the configuration so the banner survives a reload.

Test yourself

Predict · scenario 1

Which banner is shown first when someone connects to a Cisco device?

Predict · scenario 2

What does the character after banner motd do?

Predict · scenario 3

Which wording is best for a login banner?

FAQ

What is the delimiter?
A character that marks the start and end of the banner text. It can be any character that does not appear in the message, such as # or $. Everything between the two delimiters becomes the banner.
What should a banner say?
That access is for authorised users, that activity may be monitored, and that unauthorised use may be prosecuted. Avoid the word welcome: it can undermine legal action, and avoid device model or location details.
Why do my banners not appear over SSH?
Banners are shown by the VTY and console lines after the connection starts. If nothing appears, check that the banner is saved, and that the client is not hiding it. MOTD and login banners are sent before login, so some clients show them only once.