Configure Cisco IOS Login Banners

Learn how to configure, verify, edit, and remove Cisco IOS MOTD, login, EXEC, incoming, and prompt banners.

A Cisco IOS banner is text presented by a network device at a defined point during access or session establishment. Banners can identify a device, display an authorized-use warning, announce maintenance, or provide other approved operational information.

Cisco IOS is the operating system and command-line interface used by many Cisco routers and switches. Banner configuration is performed in global configuration mode, the device-wide configuration context.

Why Cisco IOS Uses Banners

Banners display text to users at defined stages of the access process. Common uses include:

Displaying an organization-approved authorized-access warning.
Communicating security policy or monitoring notices.
Announcing maintenance windows or temporary service conditions.
Identifying the device, site, or management environment without exposing sensitive details.

On a protected system, use clear authorized-use wording rather than a friendly welcome message. The final wording may need approval from your organization’s security and legal teams.

Cisco IOS Banner Types

The exact behavior and availability of some banner types varies by IOS platform and release. Always test on the target device or simulator. The following comparison describes common behavior.

Banner type	Command keyword	When displayed	Typical purpose	Platform or release considerations
MOTD	`motd`	Generally shown to users connecting to the device, often before the login prompt.	General legal warning or broad device notice.	Commonly supported; exact ordering relative to other banners can vary.
Login	`login`	Shown before login authentication.	Pre-authentication authorized-use and security warning.	Commonly supported on Cisco IOS devices.
EXEC	`exec`	Shown after successful authentication as the EXEC session begins.	Post-login maintenance, operational, or device-status information.	Commonly supported; displayed only when an EXEC session is established.
Incoming	`incoming`	Intended for inbound connections.	Message for supported incoming connection types.	Supported only on some platforms and releases.
Prompt	`prompt`	Displays confirmation text before login on supported systems.	Require or request acknowledgement before proceeding.	Availability and exact interaction vary by platform and release.

A typical connection may show an MOTD and login warning before credentials are entered, followed by an EXEC banner after successful authentication. This is a useful planning model, not a guarantee of identical ordering on every IOS implementation. Incoming and prompt banners have specialized behavior and should be tested on the target platform.

Banner Command Syntax

The general syntax is:

banner <type> <delimiter> <text> <delimiter>

A delimiter is a character selected by the administrator to mark the beginning and end of the banner text. The device reads the text until it encounters the same delimiter again.

The delimiter must not unintentionally appear in the banner body. For example, if # is the delimiter, avoid using an unintended standalone # where IOS could interpret it as the end of the message. A character such as !, %, or ^ can be used when it does not conflict with the message.

Single-Line Entry

A concise message can be entered on one command line. The opening and closing delimiters surround the text:

Router(config)# banner motd #Authorized access only. Disconnect immediately if you are not authorized.#

Multiline Entry

For a longer message, enter the command with the opening delimiter, type one or more lines, and enter the delimiter alone on a line to finish:

Router> enable
Router# configure terminal
Router(config)# banner motd #
Enter TEXT message.  End with the character '#'.
Authorized access only.
Activity may be monitored and recorded.
Disconnect immediately if you are not authorized.
#
Router(config)#

The device’s prompt and instructional text may differ slightly by IOS version. The important steps are entering global configuration mode, choosing a delimiter, writing the message, and entering the matching delimiter to terminate it.

Configure an MOTD Banner

The Message of the Day (MOTD) banner is commonly used as a general notice for users connecting to a device. It is a practical location for an organization-approved legal warning.

Router> enable
Router# configure terminal
Router(config)# banner motd #
Authorized access only.
Activity may be monitored and recorded.
Disconnect immediately if you are not authorized.
#
Router(config)#

Keep the message concise and avoid placing operational secrets in it. A warning should accurately describe the organization’s policy; do not claim monitoring or recording unless that claim is true and approved.

Configure Login and EXEC Banners

Login Banner

A login banner is intended for display before authentication. Use it for the legal and authorized-use notice that users should see before entering credentials.

Router(config)# banner login #
This system is restricted to authorized users.
Unauthorized access is prohibited.
#

EXEC Banner

An EXEC banner is displayed after successful authentication as the user enters an EXEC session. It is suitable for information intended for authenticated administrators, such as an approved maintenance notice.

Router(config)# banner exec #
Maintenance window: Sunday 02:00-04:00 UTC.
#

A practical division is to place the legal warning in the MOTD or login banner and place post-login operational information in the EXEC banner. Do not assume that an EXEC banner protects information from unauthenticated users on every platform; verify the actual behavior.

Incoming and Prompt Banners

On platforms that support them, an incoming banner is intended for inbound connections, while a prompt banner presents confirmation text before login. Use command help to confirm availability on the target device.

Router(config)# banner incoming #
Authorized remote access only.
#
Router(config)# banner prompt #
Press RETURN to continue.
#

These commands may be rejected on an IOS release, device family, or simulator that does not implement the corresponding feature. Availability does not imply that every access method will display the banner.

Banner Configuration Command Reference

Task	Command pattern	Expected result	Verification method
Enter global configuration mode	`enable` `configure terminal`	The prompt changes to privileged EXEC and then global configuration mode.	Confirm prompts such as `Router#` and `Router(config)#`.
Configure an MOTD banner	`banner motd #`, text, `#`	Creates or replaces the MOTD text.	Inspect the running configuration and open a new session.
Configure a login banner	`banner login #`, text, `#`	Creates or replaces the pre-authentication login text.	Start a new console or remote login attempt.
Configure an EXEC banner	`banner exec #`, text, `#`	Creates or replaces the post-authentication EXEC text.	Authenticate in a new session and observe the output.
Verify banner statements	`show running-config \| include ^banner`	Displays matching banner configuration lines, where supported.	Use `show running-config` for the complete banner blocks.
Save verified changes	`copy running-config startup-config`	Copies the active configuration to persistent storage.	Confirm the copy operation succeeds and inspect startup configuration if supported.

Verify and Test Banners

The running configuration is the configuration currently active in memory. Use it to confirm that the intended banner statements exist:

Router# show running-config | include ^banner
banner motd ^C
banner login ^C
banner exec ^C
Router# show running-config

The filtered output may show the command and delimiter but not make the complete multiline text easy to read. Use the full show running-config output to inspect each banner body.

Do not rely only on the current terminal window. A session that was already established before the banner was configured may not display text that belongs to session setup. Open a new console session or a new SSH session, depending on the access method being tested.

Confirm the banner commands in the running configuration.
Close the existing management session.
Start a fresh console or SSH connection.
Observe the pre-authentication text and login prompt.
Authenticate and observe whether the EXEC banner appears after successful login.
Test incoming or prompt behavior separately if the platform supports those types.
Save the verified configuration.

The startup configuration is the saved configuration loaded after a restart. If changes are not copied from running configuration to startup configuration, a reload can remove the banner configuration.

Editing and Removing Banners

Reissuing a banner command for the same type replaces the existing text for that banner type. For example, this replaces an outdated maintenance message:

Router(config)# banner exec #
Maintenance completed. Normal operations have resumed.
#

To remove a banner, use the no form for the appropriate type:

Router(config)# no banner motd
Router(config)# no banner login
Router(config)# no banner exec

After changing or removing a banner, inspect the running configuration and test a new connection. A different banner type may still contain similar or outdated text, so inspect the complete configuration when the old message continues to appear.

Banner Content and Legal Considerations

Use organization-approved wording and obtain legal review where required. A warning should clearly communicate that access is restricted and should avoid misleading language.

Include	Avoid	Reason
Authorized-use language.	Friendly “welcome” wording on a protected system.	A welcome can weaken the intended warning and may be inappropriate for an unauthorized-access notice.
Approved monitoring or recording language when accurate.	Claims that are untrue or not approved.	Messages should match actual policy and practice.
Brief maintenance or service notices where appropriate.	Passwords, shared secrets, or authentication details.	Banners are visible to connecting users and are not a secure storage location.
Minimal device or site identification.	Network topology, administrator names, sensitive contacts, addresses, or unnecessary system details.	Extra details can help reconnaissance and create avoidable privacy or security exposure.

Distinguish a security warning from friendly informational text. A post-login operational notice may be useful, but it should not disclose sensitive implementation details.

Troubleshooting Banner Problems

Invalid Input or Incomplete Command

Likely causes include omitting the opening delimiter, failing to enter the closing delimiter, choosing a delimiter that appears in the message, or issuing the command outside global configuration mode.

Return to global configuration mode.
Choose a delimiter that does not occur in the intended text.
Enter the opening delimiter, message, and matching closing delimiter carefully.
For multiline input, finish with the delimiter exactly as required by the device.

The Banner Does Not Appear in the Current Terminal

The session may have been established before the banner was configured, or the selected banner may appear at a different stage of access. Start a new console, SSH, or other applicable management session and test the expected timing.

An Old Banner Still Appears

Inspect the complete running configuration. The wrong banner type may have been changed, or a separate MOTD, login, or EXEC banner may still contain the old text. Replace or remove the specific banner and reconnect using a new session.

The Banner Disappears After Reload

The running configuration was probably not saved. Save the verified configuration:

Router# copy running-config startup-config

Where supported, inspect the startup configuration to confirm that the banner command was saved.

A Banner Type Is Unavailable

The device family, IOS version, release, or simulator may not support that banner type. Use command help and platform documentation to check availability. Use MOTD, login, or EXEC banners when they meet the requirement.

Exam-Relevant Notes

Banner configuration is performed in global configuration mode.
The command pattern is banner <type> <delimiter> <text> <delimiter>.
The delimiter marks both the start and end of the banner text and should not conflict with the message.
MOTD and login banners are generally associated with pre-session or pre-authentication access, while an EXEC banner is associated with the authenticated EXEC session.
Banners provide notices; they do not replace authentication, AAA, passwords, or ACLs.
Use a new connection to test display timing.
Save verified changes with copy running-config startup-config.
Use the no banner <type> form to remove a selected banner.

Summary

Cisco IOS banners provide controlled text at different stages of device access. Use MOTD or login banners for approved authorized-use warnings, EXEC banners for authenticated operational messages, and incoming or prompt banners only when supported and appropriate. Configure them with a safe delimiter in global configuration mode, verify the running configuration, test with fresh console and SSH sessions, remove outdated text with the appropriate no command, and save the verified configuration.