Cisco IOS devices support a number of banners that are presented to users when they use the console line or when they connect remotely using telnet or SSH. They are often used to inform users about their legal rights. It might be a good idea to present a banner to users who are trying to connect to your device, here are some items you might want to think about:
- To show that only authorized users are allowed to connect.
- That all traffic will be monitored.
- That there is no expectation of privacy.
- Don’t use anything that says “welcome”.
- Don’t add any contact information or information about the router in the banner.
Different Banners
Cisco IOS routers support a number of banners, here they are:
- MOTD banner: the “message of the day” banner is presented to everyone that connects to the router.
- Login banner: this one is displayed just before the authentication prompt.
- Exec banner: displayed before the user sees the exec prompt.
- Incoming banner: used for users that connect through reverse telnet.
We’ll take a look at how to configure these different banners now.
MOTD Banner
We’ll start with the message of the day banner that will be presented to anyone accessing the router:
R1(config)#banner motd #
Enter TEXT message. End with the character '#'.
Authorized users only, violaters will be shot on sight! #
The # symbol is a start and stop character. You can use any other character if you want. This is what the MOTD banner looks like:
R1#exit
R1 con0 is now available
Press RETURN to get started.
Authorized users only, violaters will be shot on sight!
A nice and welcome banner that everyone will see…let’s move on to the login banner now.
Login banner
The login banner is presented to users that access the router remotely using telnet or SSH:
R1(config)#banner login $ Authenticate yourself! $
Let’s try it out:
R1#telnet 1.1.1.1
Trying 1.1.1.1 ... Open
Authorized users only, violaters will be shot on sight! Authenticate yourself!
Above you see that the login banner is displayed after the MOTD banner. It would have been better if I added some empty lines so that the login banner would show up below the MOTD banner.
Exec banner
The exec banner is shown just before the exec prompt:
R1(config)#banner exec #
Enter TEXT message. End with the character '#'.
You are connected to line $(line) at router $(hostname)
#
This time I added an extra line in the banner and I also used some operators like $(line) and $(hostname). Let’s see what that looks like:
R1#exit
R1 con0 is now available
Press RETURN to get started.
Authorized users only, violaters will be shot on sight!
You are connected to line 0 at router R1
As you can see it shows to which line I am connected (line 0 is the console) and the hostname of my router (R1). One more banner to go!
Banner incoming
The last banner is used for reverse telnet connections. Reverse telnet can be used to access the console of another device by connecting the AUX port of the router to the console port of another router. This allows you to ‘telnet’ into the console port of another router.
R1(config)#banner incoming $
Enter TEXT message. End with the character '$'.
This is a banner for Reverse Telnet
$
We’ll have to configure the AUX port in order to test it:
R1(config)#line aux 0
R1(config-line)#transport input telnet
We will enable telnet on the aux port, now we’ll have to check what line our AUX port uses:
R1#show line
*Mar 1 01:48:09.495: %SYS-5-CONFIG_I: Configured from console by console
R1#show line
Tty Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
* 0 CTY - - - - - 2 1 0/0 -
97 AUX 9600/9600 - - - - - 0 0 0/0 -
98 VTY - - - - - 2 0 0/0 -
99 VTY - - - - - 0 0 0/0 -
100 VTY - - - - - 0 0 0/0 -
101 VTY - - - - - 0 0 0/0 -
102 VTY - - - - - 0 0 0/0 -
Now we can reverse telnet to the AUX port like this:
R1#telnet 1.1.1.1 6097
Trying 1.1.1.1, 6097 ... Open
Authorized users only, violaters will be shot on sight!
This is a banner for Reverse Telnet
As you can see it presents us the “incoming banner”. I hope this has been helpful to you to understand the banners!
