banner motd
Display a legal warning to users before login, establishing that unauthorized access is prohibited. Required for legal liability protection.
Definition: banner motd is a Cisco IOS global config command. Configures a Message of the Day banner that is displayed to all users who connect to the device before authentication. Used for legal warnings about unauthorized access.
Overview
The 'banner motd' command is a fundamental IOS configuration tool that sets the Message of the Day (MOTD) banner displayed to users upon connecting to a Cisco router or switch via console, Telnet, or SSH. This banner appears before the login prompt, making it the first text a user sees when accessing the device. Its primary purpose is to convey legal warnings (e.g., 'Unauthorized access prohibited'), system information (e.g., maintenance notices), or welcome messages.
The MOTD banner is critical for compliance and security, as it establishes a legal notice that can be used to prosecute unauthorized access. It also serves operational needs by informing users of scheduled downtime or contact information. The command is executed in global configuration mode and supports a delimiter character (typically #) to mark the start and end of the message.
The message can span multiple lines and include spaces, but cannot contain the delimiter character. The banner is stored in the running configuration and is preserved across reboots if saved to startup-config. Unlike other banner types (e.g., login banner, exec banner), the MOTD banner appears before authentication, so it is visible to all users, even those who do not successfully log in.
This makes it ideal for legal disclaimers. The command has no parameters beyond the delimiter and message; it is simple but powerful. When troubleshooting, verifying the banner is set correctly can prevent confusion or legal issues.
The banner does not affect device performance but is an essential part of a secure configuration baseline. It is supported across all IOS platforms, including IOS-XE, NX-OS (with syntax differences), and ASA. Understanding its placement in the login sequence helps network engineers design appropriate messaging strategies.
banner motd <delimiter> <message> <delimiter>When to Use This Command
- Legal warning before login that unauthorised access is prohibited and monitored
- Compliance requirement in many organisations and government networks
- Display maintenance window information or contact details for IT staff
- Required by many security frameworks (CIS, NIST) as a minimum baseline
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| message | delimiter-character message delimiter-character | The text of the MOTD banner. The message is enclosed by a delimiter character (commonly #) that cannot appear within the message. The message can include multiple lines and spaces. Common mistakes include using a delimiter that appears in the message, causing the banner to be truncated, or forgetting to close the delimiter, which causes the command to wait for more input. |
Command Examples
Configure a legal warning banner
Router(config)# banner motd # Enter TEXT message. End with the character '#'. AUTHORISED ACCESS ONLY This system is the property of Courseiva Ltd. Unauthorised access is prohibited and will be prosecuted. All activity is monitored and logged. # Router(config)# end
Understanding the Output
The character after 'banner motd' is the delimiter — it cannot appear in the message text. The # symbol is commonly used. The banner appears on all connections (console, vty/SSH, AUX) before the login prompt. banner login appears after the MOTD but before authentication. banner exec appears after successful login.
Configuration Scenarios
Configure a legal warning MOTD banner
A company requires all network devices to display a legal warning banner before login to deter unauthorized access and establish legal grounds for prosecution.
Topology
Single router R1Steps
- 1.Step 1: Enter global configuration mode: Router> enable
- 2.Step 2: Enter global config: Router# configure terminal
- 3.Step 3: Configure the MOTD banner: Router(config)# banner motd # Unauthorized access prohibited. #
- 4.Step 4: Exit configuration mode: Router(config)# end
- 5.Step 5: Verify the banner: Router# show running-config | include banner motd
! Full IOS config block Router(config)# banner motd # Unauthorized access prohibited. #
Verify: Command: show running-config | include banner motd Expected output: banner motd ^C Unauthorized access prohibited. ^C
Watch out: If the delimiter character appears in the message, the banner will be truncated. For example, using # in the message 'Access #1 denied' will cause the banner to end at the first #.
Configure a multi-line maintenance notice MOTD banner
A network engineer needs to inform users of scheduled maintenance during a specific window. The banner should display multiple lines of text.
Topology
Single switch SW1Steps
- 1.Step 1: Enter global configuration mode: SW1> enable
- 2.Step 2: Enter global config: SW1# configure terminal
- 3.Step 3: Configure the MOTD banner with multiple lines: SW1(config)# banner motd #
- 4.Step 4: Type the first line: System maintenance scheduled
- 5.Step 5: Press Enter, type the second line: from 2:00 AM to 4:00 AM
- 6.Step 6: Type the closing delimiter: #
- 7.Step 7: Exit configuration mode: SW1(config)# end
- 8.Step 8: Verify the banner: SW1# show running-config | section banner
! Full IOS config block SW1(config)# banner motd # System maintenance scheduled from 2:00 AM to 4:00 AM #
Verify: Command: show running-config | section banner Expected output: banner motd ^C System maintenance scheduled from 2:00 AM to 4:00 AM ^C
Watch out: When entering multi-line banners, the delimiter must be the only character on the final line. If extra spaces or characters are present, the banner will not close properly.
Troubleshooting with This Command
Troubleshooting the 'banner motd' command typically involves verifying that the banner is correctly configured and displays as intended. A healthy configuration shows the banner in the running configuration with the correct message. To check, use 'show running-config | include banner motd' or 'show running-config | section banner'.
The output should display the banner motd command with the message enclosed in carets (^C) representing the delimiter. If the banner does not appear, the command may not have been applied, or the delimiter was not closed properly. Common symptoms include: no banner displayed upon login, a truncated banner, or an error message during configuration.
If no banner appears, check if the banner motd command is present in the running config. If missing, reapply the command. If the banner is truncated, the delimiter character likely appears in the message; edit the banner using a different delimiter (e.g., % or $) that does not conflict.
Another issue is that the banner may be overridden by a login banner if both are configured; the MOTD appears first, but if the login banner is also set, it appears after authentication. To correlate with other commands, use 'show users' to see active sessions and verify the banner appears for new connections. For debugging, 'debug banner' is not available; instead, test by initiating a new Telnet or SSH session to the device.
If the banner is not showing, ensure that the 'banner motd' command is not being removed by a configuration template or script. Also, check for any 'no banner motd' commands later in the config. In some IOS versions, the banner may be stored with a different delimiter (^C) in the running config; this is normal.
If the banner contains special characters like $ or %, they are displayed as-is. For compliance, ensure the banner text is appropriate and legally vetted. A step-by-step diagnostic flow: 1) Verify the banner is configured: 'show run | inc banner'. 2) If missing, configure it. 3) If present but not displaying, test with a new SSH session. 4) If still not showing, check for any 'exec-banner' or 'login-banner' that might interfere. 5) Use 'terminal monitor' to see if any error messages appear during configuration.
The banner command is straightforward, but attention to delimiter usage is key.
CCNA Exam Tips
CCNA exam: know three banner types — motd (before login), login (before authentication prompt, replaces motd on vty), exec (after successful login)
Security best practice: include 'authorised access only' and 'all activity is monitored' language
Avoid welcoming language like 'Welcome to...' which implies open access
Common Mistakes
Including the delimiter character in the banner text — IOS terminates the banner at the first occurrence
Using # if the banner text needs to contain # (use a different delimiter like @ or ^)
Writing a banner that says 'Welcome' — legally this could undermine unauthorised access claims
banner motd vs hostname
Both `banner motd` and `hostname` are fundamental global configuration commands, often confused because they both start with a 'b' and are set early during device setup. However, they serve entirely different purposes: one displays a pre-login message, while the other defines the device identity.
| Aspect | banner motd | hostname |
|---|---|---|
| Scope | Affects all users before authentication | Defines device identity globally |
| Configuration mode | Global configuration | Global configuration |
| Persistence | Stored in running-config and startup-config | Stored in running-config and startup-config |
| Precedence | Displayed before login prompt | Changes CLI prompt and affects host-based features |
| Typical use | Legal warnings, unauthorized access alerts | Network identification, SSH key generation, CDP advertisements |
| Effect on services | No impact on routing or protocols | Impacts SSH key generation, CDP, SNMP, and syslog messages |
Use banner motd when you need to display a legal warning or informational message to all users before they log in to the device.
Use hostname when you need to uniquely identify the device in the network, influence CLI prompts, or participate in hostname-dependent protocols like CDP and SSH.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the 'banner motd' command syntax and behavior are identical to classic IOS. The banner is stored in the running configuration and can be verified with 'show running-config | include banner'. In NX-OS (e.g., Nexus 9000), the equivalent command is 'banner motd' but the syntax differs: it uses a different delimiter approach.
For example, 'banner motd # Unauthorized access prohibited #' works similarly, but NX-OS also supports a 'banner motd' command that enters a text editor mode. To exit, type the delimiter on a line by itself. In NX-OS, the banner is also stored in the running configuration.
For ASA firewalls, the equivalent command is 'banner motd' but the syntax is 'banner motd text' where text is the message without delimiters; the message is terminated by pressing Enter. For example, 'banner motd Unauthorized access prohibited'. In ASA, the banner is stored in the running config.
In IOS-XR (e.g., ASR 9000), the command is 'banner motd' and uses a similar delimiter syntax as classic IOS. However, IOS-XR requires the banner to be configured under the 'line' configuration or globally? Actually, in IOS-XR, the banner motd is configured globally: 'banner motd delimiter message delimiter'.
The behavior is consistent across IOS versions (12.x, 15.x, 16.x) with no significant differences. The command has been stable for decades. Note that in some older IOS versions (12.x), the banner might be displayed differently over certain protocols (e.g., LAT), but for modern networks, this is irrelevant.
Always use a delimiter that does not appear in the message; common choices are #, %, or $.
Related Commands
hostname
Sets the hostname of a Cisco router or switch. The hostname appears in the CLI prompt, is used in SSH key generation (hostname.domain-name), and is advertised via CDP to neighbour devices.
login on-failure
Enables syslog logging of failed login attempts, recording the username attempted, source IP address, and timestamp. Used for security monitoring and brute-force detection.
service password-encryption
Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions