VMware ESXi and vSphere Cluster Management

Configure MOTD, Login, and EXEC Banners in Cisco IOS

Learn how to configure, verify, test, replace, remove, and save MOTD, login, and EXEC banners on Cisco IOS devices.

A banner is a text message that Cisco IOS displays during or after access to a network device. Banners are commonly used for authorized-use warnings, legal or security notices, maintenance announcements, and short operational reminders.

Cisco IOS is the operating system and command-line environment used on many Cisco routers and switches. Banner configuration is performed from global configuration mode.

How Cisco IOS Banner Types Differ

Cisco IOS provides three commonly used banner types: Message of the Day (MOTD), login, and EXEC. Their main difference is when they appear during a connection.

Banner type: MOTD
IOS keyword: motd
Timing: Early in the connection, normally before authentication prompts
Authentication state: Not authenticated
Typical purpose: Broad notices, maintenance messages, and general authorized-use statements

Banner type: Login
IOS keyword: login
Timing: After the MOTD banner and before the login prompt in the standard sequence
Authentication state: Not authenticated
Typical purpose: Authorization warnings and policy notices immediately before credential entry

Banner type: EXEC
IOS keyword: exec
Timing: After successful authentication and session entry
Authentication state: Authenticated
Typical purpose: Change-control reminders and post-login operational instructions

Typical Access Sequence

For an interactive console, SSH, or Telnet connection, the typical sequence is:

  1. The connection begins.
  2. The MOTD banner appears.
  3. The login banner appears.
  4. The device requests a username and/or password and performs authentication.
  5. After successful authentication, the EXEC banner appears.
  6. The user enters the initial user EXEC mode, normally shown by a greater-than prompt such as Router>.

The exact output and order can vary with the access method, line configuration, AAA settings, and other authentication features. Treat the sequence above as the normal learning model, then verify behavior on the device and access path being used.

Banner Command Syntax

The general syntax is:

banner <type> <delimiter> <message> <delimiter>

The supported types in this lesson are:

banner motd <delimiter> <message> <delimiter>
banner login <delimiter> <message> <delimiter>
banner exec <delimiter> <message> <delimiter>

A delimiter is a character that marks the beginning and end of the message. When the command is entered interactively, IOS accepts multiple message lines until the matching closing delimiter is entered.

  • Choose one delimiter character, such as #.
  • Use the same character to close the message.
  • Do not place that delimiter in the message body.
  • If the message contains #, select another character, such as ^.

Configure an MOTD Banner

The MOTD banner is intended for a message visible broadly to connecting users. It appears early in the access process, before the authentication prompt in the usual sequence.

From privileged EXEC mode, enter global configuration mode with enable followed by configure terminal. Then enter a multi-line notice:

Router> enable
Router# configure terminal
Router(config)# banner motd #
AUTHORIZED ACCESS ONLY
Maintenance is scheduled for Saturday 22:00-23:00 UTC.
If this access is unexpected, contact the operations team.
#
Router(config)#

The first # begins the message and the final # ends it. The final delimiter is entered on its own line in this interactive example.

Configure a Login Banner

The login banner is a pre-authentication message. In the standard sequence, it appears after the MOTD banner and before the username or password interaction.

Router(config)# banner login ^
This system is restricted to approved users.
Activity may be monitored according to organizational policy.
Disconnect now if you are not authorized.
^

This example uses ^ rather than #. That choice is useful when the message itself contains a hash symbol.

Configure an EXEC Banner

The EXEC banner appears only after successful authentication, when the user enters an EXEC session. It is suitable for reminders that authenticated operators should see after login.

Router(config)# banner exec #
Follow approved change-control procedures before modifying this device.
Record configuration work against the appropriate approved request.
#

Keep post-login messages concise. A reminder about change control is useful, but a banner should not expose sensitive operational details.

Configure All Three Banners

The following complete example creates one message of each type:

Router# configure terminal
Router(config)# banner motd #
AUTHORIZED ACCESS ONLY
Maintenance is scheduled for Saturday 22:00-23:00 UTC.
#
Router(config)# banner login ^
This system is restricted to approved users.
Disconnect now if you are not authorized.
^
Router(config)# banner exec %
Use approved change-control procedures for configuration changes.
%
Router(config)# end
Router#

Verify the Configuration

The running configuration is the currently active configuration held in memory. Inspect it to confirm that the banner commands were accepted:

Router# show running-config | include ^banner

Depending on the IOS release and display behavior, the filtered output may show the banner command lines and delimiters. Use the complete configuration when you need to review all stored message text:

Router# show running-config

Task: Create MOTD banner
Command pattern: banner motd <delimiter>, message lines, matching delimiter
Mode: Global configuration
Expected result: A pre-authentication MOTD message is stored

Task: Create login banner
Command pattern: banner login <delimiter>, message lines, matching delimiter
Mode: Global configuration
Expected result: A pre-authentication login message is stored

Task: Create EXEC banner
Command pattern: banner exec <delimiter>, message lines, matching delimiter
Mode: Global configuration
Expected result: A post-authentication EXEC message is stored

Task: Inspect configured banners
Command pattern: show running-config | include ^banner or show running-config
Mode: Privileged EXEC
Expected result: Active banner configuration can be reviewed

Task: Remove a banner
Command pattern: no banner motd, no banner login, or no banner exec
Mode: Global configuration
Expected result: The selected banner is deleted from the running configuration

Task: Save configuration
Command pattern: copy running-config startup-config
Mode: Privileged EXEC
Expected result: Changes are copied to the saved startup configuration

Test Banner Timing with a New Session

Testing must use a fresh connection. Disconnect from the console, SSH, or Telnet session and establish a new session through the lab's available access method.

  1. Start a new connection.
  2. Confirm that the MOTD message appears early.
  3. Confirm that the login message appears before credential entry.
  4. Enter valid credentials.
  5. Confirm that the EXEC message appears after successful authentication.
  6. Confirm that the resulting prompt is the expected user EXEC prompt, such as Switch>.

An already authenticated session cannot fully demonstrate pre-login banners because the connection-establishment and authentication stages have already occurred. Likewise, changing an EXEC banner does not necessarily make it appear in an existing session; start a new session to test the complete flow.

Replace, Remove, and Save Banners

Reissuing a banner command for the same type replaces the previous message. For example, entering another banner motd command replaces the existing MOTD text; it does not append a second MOTD message.

Router# configure terminal
Router(config)# banner motd #
AUTHORIZED ACCESS ONLY
The maintenance window has been completed.
#
Router(config)# no banner login
Router(config)# no banner exec
Router(config)# end
Router# copy running-config startup-config

The no form removes the selected banner. The startup configuration is the saved configuration loaded when the device starts. Copying the running configuration to startup configuration preserves banner changes across a reload.

Security and Policy Considerations

  • Use organization-approved legal or acceptable-use language where required.
  • State clearly that access is restricted to authorized users when that reflects organizational policy.
  • Do not place passwords, private keys, infrastructure details, topology information, or sensitive emergency contacts in a banner.
  • A warning can support an acceptable-use policy, but its legal effectiveness depends on local policy and jurisdiction.
  • Keep wording professional, concise, relevant, and understandable to all intended users.
  • Remember that a banner is not a security control. Configure authentication and authorization separately.

Troubleshooting Banner Problems

Symptom: The device reports incomplete input or keeps accepting banner text
Likely cause: The closing delimiter is missing or does not match the opening delimiter
How to verify: Compare the first and final delimiter characters
Corrective action: End the message with the exact delimiter selected at the beginning

Symptom: Only part of the intended message is stored
Likely cause: The delimiter appears inside the message body, so IOS treats it as the end
How to verify: Review the message for the selected delimiter and inspect the running configuration
Corrective action: Choose a different delimiter and configure the complete banner again

Symptom: A banner is not visible in an existing session
Likely cause: Banners display during connection establishment or after authentication, not continuously
How to verify: Disconnect completely and start a new session
Corrective action: Test through a fresh console or remote terminal connection

Symptom: The expected EXEC message never appears
Likely cause: Authentication did not complete, the wrong banner type was configured, or the session did not reach normal user EXEC context
How to verify: Confirm banner exec in the running configuration and perform a successful new login
Corrective action: Correct the banner type or authentication test and reconnect

Symptom: Banner configuration disappears after a reload
Likely cause: Changes existed only in the running configuration
How to verify: Compare the running and startup configurations
Corrective action: Run copy running-config startup-config

Symptom: The message order seems confusing
Likely cause: An active session, a different access method, or multiple configured features are affecting the observed output
How to verify: Review all banner entries, disconnect fully, and record output from a new connection
Corrective action: Test one complete access sequence and account for the access method and authentication configuration

Exam-Relevant Notes

  • banner motd, banner login, and banner exec are entered in global configuration mode.
  • The delimiter is not a fixed IOS keyword; it is a character selected by the administrator.
  • The opening and closing delimiters must match.
  • MOTD and login banners are normally seen before authentication; the EXEC banner is seen after successful authentication.
  • Use a new connection to test banner timing.
  • Use the no banner ... form to remove a banner.
  • Save the running configuration to startup configuration to retain changes after a reload.

For related practice, review Cisco IOS banner configuration while working through a console or remote-access lab.