Login Banner

Login banners

A login banner is a user authentication feature that

  • displays a customizable warning or informational message when you attempt to access the controller

  • uses a delimiting character to mark the start and end of the banner text, and

  • helps communicate security policies or legal notices to users before granting access.

Additional reference information

To configure a login banner, you must specify a delimiting character that signals the system to treat the enclosed text as the banner message. After entering the delimiting character, enter the message text, and then repeat the same character at the end.

The delimiter can be any single character from the extended ASCII set, but that character cannot appear inside the banner message once selected as the delimiter.

For example, to create a login banner with the delimiter #, enter: 

banner login #Unauthorized access is prohibited#

Note

When HTTP authentication is configured using TACACS+ or RADIUS, the banner message does not display on the Web UI. (Addressed CSCvr26813: C9800 - Banner not seen on GUI with TACACS authentication.)

Configure a login banner (GUI)

Set up a custom login banner to communicate important information or legal notices to users before they access the device.

Procedure

Step 1

Choose Administration > Device .

Step 2

In the General tab, in the Banner field, enter a name for the device and a message.

Step 3

Click Apply .

The customized login banner is displayed to users before they authenticate to the device.

Configure a login banner (CLI)

Set a login banner to inform users about security policies or authorized access.

Procedure

Step 1

Enable privileged EXEC mode.

Example:

Device# enable

If prompted, enter your password.

Step 2

Enter global configuration mode.

Example:

Device# configure terminal

Step 3

Specify the login message.

Example:

Device(config)# banner login c message c

Example:

Device(config)# banner login $
Access for authorized users only. 
Please enter your username and password.
$

  • c: Enter the delimiting character of your choice (for example, the pound sign), then press the Return key. The delimiting character marks the beginning and end of the banner text. Any characters after the ending delimiter are discarded.

  • Message: Enter a login message up to 255 characters. The delimiting character cannot be used in the message.

Step 4

Return to privileged EXEC mode.

Example:

Device(config)# end

Step 5

Verify your entries.

Example:

Device# show running-config

Step 6

(Optional) Save your entries to the configuration file.

Example:

Device# copy running-config startup-config

All users see the login banner when they attempt to log in.