How to configure Cisco IOS Banners

Cisco IOS devices support a number of banners that are presented to users when they use the console line or when they connect remotely using telnet or SSH. They are often used to inform users about their legal rights. It might be a good idea to present a banner to users who are trying to connect to your device, here are some items you might want to think about:

• To show that only authorized users are allowed to connect.
• That all traffic will be monitored.
• That there is no expectation of privacy.
• Don’t use anything that says “welcome”.
• Don’t add any contact information or information about the router in the banner.

The “Warning Banners” section of the Cisco IOS XE Software Hardening Guide explains what a good banner should contain, such as a notice that unauthorized use is prohibited and that sessions can be monitored and logged. Before you implement any banners, make sure to check with your legal counsel first. Having said that, let’s look at the different banners…

Different Banners

Cisco IOS routers support several banners. These are the most common ones:

• MOTD banner: the “message of the day” banner is presented to everyone that connects to the router.
• Login banner: this one is displayed just before the authentication prompt.
• Exec banner: displayed before the user sees the exec prompt.
• Incoming banner: used for users that connect through reverse telnet.

We’ll take a look at how to configure these different banners now. I’m using two routers running Cisco IOS XE 17.12. R1 is the router with the banners, and I’ll connect to it with telnet and SSH, sometimes from R1 itself and sometimes from R2.

MOTD Banner

We’ll start with the message of the day banner that will be presented to anyone accessing the router:

R1(config)#banner motd #
Enter TEXT message.  End with the character '#'.
WARNING: Authorized access only. Unauthorized access is prohibited and may be prosecuted. All activity is logged and monitored. #

The # symbol is a start and stop character. You can use any other character if you want. This is what the MOTD banner looks like when I telnet from R2 to R1:

R2#telnet 1.1.1.1
Trying 1.1.1.1 ... Open

WARNING: Authorized access only. Unauthorized access is prohibited and may be prosecuted. All activity is logged and monitored. 

User Access Verification

Username: admin
Password:

This banner is shown to everyone who connects to the router…let’s move on to the login banner now.

Login banner

The login banner is presented just before the username and password prompts, for example when users connect with telnet or SSH:

R1(config)#banner login $ Authenticate yourself! $

Let’s try it out:

R1#telnet 1.1.1.1
Trying 1.1.1.1 ... Open

WARNING: Authorized access only. Unauthorized access is prohibited and may be prosecuted. All activity is logged and monitored.  Authenticate yourself! 

User Access Verification

Username: admin
Password:

Above, you see that the login banner is displayed after the MOTD banner and before the username prompt. This is the order for telnet. With SSHv2, the login banner is shown before you log in, and the MOTD banner only after you log in. Here’s what that looks like with SSH from R2:

R2#ssh -l admin 1.1.1.1
 Authenticate yourself! 
Password: 

WARNING: Authorized access only. Unauthorized access is prohibited and may be prosecuted. All activity is logged and monitored. 


R1#

With telnet, it would have been better if I added some empty lines so that the login banner would show up below the MOTD banner.

Exec banner

The exec banner is shown just before the exec prompt:

R1(config)#banner exec #
Enter TEXT message.  End with the character '#'.
You are connected to line $(line) at router $(hostname)
#

This time I added an extra line in the banner, and I also used some operators like $(line) and $(hostname). Let’s telnet from R2 to R1 to see what that looks like: