banner login # [message] #
Configures a message that displays before the username/password login prompt on a Cisco device, used for legal warnings or informational banners.
Definition: banner login # [message] # is a Cisco IOS global config command. Configures a message that displays before the username/password login prompt on a Cisco device, used for legal warnings or informational banners.
Overview
The `banner login` command in Cisco IOS is used to configure a message that appears before the username/password login prompt on a device. This banner is displayed when a user initiates a connection (e.g., via Telnet, SSH, or console) but before they are prompted for credentials. Its primary purpose is to provide legal warnings, informational notices, or access policies, which can be crucial for compliance and security.
The command is configured in global configuration mode and supports a delimiter character (typically `#`) to enclose the message text. The banner is stored in the running configuration and can be saved to startup configuration. It is important to note that the banner message is displayed only for interactive sessions; it does not appear for non-interactive connections like SNMP or HTTP.
The `banner login` command is often used in conjunction with other banners like `banner motd` (Message of the Day) and `banner exec` (displayed after login). While `banner motd` appears before the login prompt as well, `banner login` is specifically intended for legal notices that must be acknowledged before authentication, whereas `banner motd` is for general announcements. In a typical network configuration workflow, after setting hostnames, IP addresses, and enabling remote access, an engineer would configure banners to ensure users see appropriate warnings.
The command has no impact on device performance, but the banner text is stored in the configuration, so it should be concise. Privilege level 15 (privileged EXEC) is required to configure it. The banner is buffered and sent to the user upon connection initiation.
Understanding the distinction between `banner login` and `banner motd` is important: both appear before login, but `banner login` is displayed after `banner motd` if both are configured. Some organizations use `banner login` for legal disclaimers and `banner motd` for system maintenance notifications. The command syntax is `banner login delimiter message delimiter`, where the delimiter is a character that does not appear in the message.
Common delimiters are `#`, `%`, or `$`. If the delimiter appears in the message, it will cause parsing errors. The message can span multiple lines; the banner ends when the delimiter is entered again on a new line.
In Cisco IOS, the banner is stored as part of the configuration and can be viewed with `show running-config | include banner`. The command is supported in all IOS versions, including 12.x, 15.x, and 16.x. For network engineers, configuring a login banner is a best practice for legal protection and user awareness.
It is often required for compliance with corporate security policies. The banner should include contact information, authorized use policies, and consequences of unauthorized access. A typical banner might read: 'WARNING: Unauthorized access is prohibited.
All activities are monitored. By continuing, you consent to monitoring.' The command is straightforward but has nuances: if the banner contains the delimiter, use a different delimiter; if the banner is empty, it removes the existing banner. The `no banner login` command removes the banner.
In summary, `banner login` is a simple yet powerful tool for network security and policy enforcement, essential for any Cisco device exposed to external access.
banner login # [message] #When to Use This Command
- Displaying an authorized access warning to comply with legal requirements
- Informing users of maintenance windows or system status before login
- Providing contact information for help desk or network administrators
- Displaying a company policy reminder for acceptable use
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| delimiter | character (e.g., #, %, $) | A single character that marks the beginning and end of the banner message. The delimiter must not appear in the message text. Common choices are #, %, or $. If the delimiter appears in the message, the command will fail or produce unexpected results. The delimiter is entered immediately after the command keyword. |
| message | text string (multiple lines allowed) | The banner text to be displayed. It can include spaces, punctuation, and multiple lines. The message ends when the delimiter character is entered again on a new line. There is no practical length limit, but keep it concise for usability. The message is stored in the running configuration as a single line with escape sequences for line breaks. |
Command Examples
Basic legal warning banner
banner login #
Unauthorized access prohibited.
All activity is monitored.
#The delimiter '#' marks the start and end of the banner message. The message appears before the login prompt. No output is shown after entering the command; it is verified by exiting and re-entering privileged EXEC or via 'show running-config'.
Multi-line maintenance banner
banner login #
*** SYSTEM MAINTENANCE ***
Scheduled downtime: Sunday 2:00 AM - 4:00 AM
Contact noc@company.com
#Multi-line banners are entered by pressing Enter after each line. The delimiter '#' must be on its own line at the end. The banner will display exactly as typed.
Understanding the Output
The 'banner login' command does not produce immediate output. To verify the configured banner, use 'show running-config | include banner login' or exit the session and reconnect via SSH/telnet to see the banner displayed before the login prompt. The banner text appears exactly as entered, with line breaks preserved.
Ensure the delimiter character does not appear in the message to avoid premature termination.
Configuration Scenarios
Configure a legal warning banner for SSH access
A company requires all users connecting via SSH to see a legal disclaimer before login. The banner must state that unauthorized access is prohibited and that all activities are monitored.
Topology
R1 (SSH server) --- Network --- Admin PCSteps
- 1.Step 1: Enter global configuration mode: R1> enable
- 2.Step 2: R1# configure terminal
- 3.Step 3: Configure the banner with delimiter #: R1(config)# banner login #
- 4.Step 4: Type the message on the next line(s): Enter text. To end the banner, enter the delimiter # on a new line.
- 5.Step 5: Verify the configuration: R1(config)# do show running-config | include banner
! Full IOS config block R1> enable R1# configure terminal R1(config)# banner login # WARNING: Unauthorized access is prohibited. All activities are monitored. By continuing, you consent to monitoring. # R1(config)# end R1#
Verify: Connect via SSH from a client. Expected output before login prompt: WARNING: Unauthorized access is prohibited. All activities are monitored. By continuing, you consent to monitoring. User Access Verification Username:
Watch out: If the delimiter appears in the message (e.g., using # in the text), the banner will be truncated. Always choose a delimiter that does not appear in the message.
Remove an existing login banner
An existing login banner is outdated and needs to be removed. The network engineer wants to ensure no banner is displayed before login.
Topology
R1 (any Cisco device)Steps
- 1.Step 1: Enter global configuration mode: R1> enable
- 2.Step 2: R1# configure terminal
- 3.Step 3: Remove the banner: R1(config)# no banner login
- 4.Step 4: Verify removal: R1(config)# do show running-config | include banner
! Full IOS config block R1> enable R1# configure terminal R1(config)# no banner login R1(config)# end R1#
Verify: Connect via console or SSH. No banner should appear before the login prompt. The command `show running-config | include banner` should return no output.
Watch out: Using `no banner login` removes the banner entirely. If you only want to change the message, reconfigure the command with the new text instead of removing it.
Troubleshooting with This Command
When troubleshooting issues with the `banner login` command, the primary concern is whether the banner appears as expected. Healthy output means the banner displays correctly before the login prompt for all interactive sessions (console, Telnet, SSH). Problem indicators include: no banner appearing, a truncated banner, or the banner appearing after login (which would indicate using the wrong banner type).
To diagnose, first verify the configuration with `show running-config | include banner`. This shows the configured banner lines. If the banner is present but not displaying, check if the delimiter is correctly used.
A common mistake is having the delimiter in the message, causing the banner to end prematurely. For example, if the delimiter is # and the message contains #, the banner will stop at the first # in the message. To fix, use a different delimiter.
Another issue is that the banner may not appear for certain connection types. The `banner login` only applies to interactive sessions; it does not appear for HTTP, HTTPS, or SNMP access. If you need a banner for web access, use the `ip http banner` command.
Also, ensure that the banner is not overridden by other settings. For instance, if `banner motd` is also configured, it appears before `banner login`. If you see only the MOTD, check that `banner login` is configured correctly.
To test the banner, initiate a new connection (e.g., SSH from a remote host) and observe the output. If the banner is missing, check if the device is in a state where login is bypassed (e.g., if authentication is disabled). In some IOS versions, if no authentication is configured, the banner may not appear.
Ensure that AAA or local authentication is enabled. Another troubleshooting step is to check the console line settings. The banner is displayed on all lines by default, but if a line has `no exec` or is configured for specific services, it might not show.
Use `show line` to verify line configuration. Correlate with `debug telnet` or `debug ssh` to see the exact data sent during connection setup. However, debugging should be used cautiously in production.
If the banner appears garbled or with escape characters, check for special characters in the message. The banner is stored as plain text; any control characters may cause display issues. To resolve, reconfigure the banner with clean text.
Finally, remember that the banner is stored in the running configuration; if the device reloads without saving, the banner is lost. Always save with `write memory` or `copy running-config startup-config`. In summary, troubleshooting `banner login` involves verifying configuration, testing connectivity, and ensuring no conflicts with other banners or line settings.
CCNA Exam Tips
The delimiter can be any character not appearing in the message; common choices are #, %, or $.
The 'banner login' appears before the login prompt; 'banner motd' appears after login but before the EXEC prompt.
On the exam, you may be asked to configure a banner that warns against unauthorized access.
Remember that the banner must be enclosed by the same delimiter at start and end, each on its own line.
Common Mistakes
Using a delimiter character that appears within the message, causing the banner to be truncated.
Forgetting to include the closing delimiter, which causes the CLI to wait for more input.
Confusing 'banner login' with 'banner motd' — the login banner appears before authentication, motd after.
banner login # [message] # vs banner motd
Banner login and banner motd are commonly confused because both display messages to users during the login process before authentication, but they differ in when exactly the message appears and the typical intended use. Understanding their order and precedence is important for correct configuration.
| Aspect | banner login # [message] # | banner motd |
|---|---|---|
| Scope | Global configuration | Global configuration |
| Configuration mode | Global config | Global config |
| Delimiter | Single character (e.g., #) | Single character (e.g., #) |
| Precedence | Displayed after MOTD, before login prompt | Displayed first, before any other banner |
| Typical use | Legal warning or authorization notice | Message of the day, general information |
| Persistence | Saved in running/startup config | Saved in running/startup config |
Use banner login when you need a legal warning that appears after the MOTD but before the username/password prompt to inform users of authorized use.
Use banner motd when you want a general informational message displayed to all users immediately upon connection, before any authentication banners.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the `banner login` command syntax and behavior are identical to classic IOS. The banner is stored in the running configuration and can be viewed with `show running-config | section banner`. There are no syntax differences.
In NX-OS (e.g., Nexus switches), the equivalent command is `banner login` as well, but the delimiter is not required; instead, the message is entered after the command and terminated with a line containing only `EOF`. For example: `switch(config)# banner login` then enter the message, then `EOF` on a new line. NX-OS also supports `banner motd` and `banner exec`.
In ASA (Adaptive Security Appliance), the command is `banner login` but the syntax uses a delimiter similar to IOS: `banner login delimiter message delimiter`. However, ASA also has `banner motd` and `banner asdm` for ASDM access. In IOS-XR (e.g., ASR 9000), the command is `banner login` but the configuration mode is different: it is configured under `line console` or `line default` using the `login-banner` command.
For example: `RP/0/RP0/CPU0:router(config)# line console` then `login-banner delimiter message delimiter`. IOS-XR does not have a global `banner login` command. In older IOS versions (12.x), the banner command is the same as in 15.x and 16.x.
However, in very old versions (e.g., 11.x), the syntax might differ slightly. Always check the documentation for your specific IOS version. For all platforms, the banner text should not exceed the line length limits of the terminal; typically, lines are limited to 255 characters.
If the banner is too long, it may be truncated. Use `show banner` command in some IOS versions to view the configured banners. In summary, while the core concept is consistent across Cisco platforms, the exact syntax and configuration context may vary, especially in IOS-XR and NX-OS.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions