Although requiring passwords is one way to keep unauthorized personnel out of a network, it is vital to provide a method for declaring that only authorized personnel should attempt to gain entry into the device. To do this, add a banner to the device output.
Banners can be an important part of the legal process in the event that someone is prosecuted for breaking into a device. Some legal systems do not allow prosecution, or even the monitoring of users, unless a notification is visible.
The exact content or wording of a banner depends on the local laws and corporate policies. Here are some examples of information to include in a banner:
- "Use of the device is specifically for authorized personnel."
- "Activity may be monitored."
- "Legal action will be pursued for any unauthorized use."
Because banners can be seen by anyone who attempts to log in, the message must be worded very carefully. Any wording that implies that a login is "welcome" or "invited" is not appropriate. If a person disrupts the network after gaining unauthorized entry, proving liability will be difficult if there is the appearance of an invitation.
The creation of banners is a simple process; however, banners should be used appropriately. When a banner is utilized it should never welcome someone to the device. It should detail that only authorized personnel are allowed to access the device. Further, the banner can include scheduled system shutdowns and other information that affects all network users.
The IOS provides multiple types of banners. One common banner is the message of the day (MOTD). It is often used for legal notification because it is displayed to all connected terminals.
Configure MOTD using the banner motd command from global configuration mode.
The banner motd command requires the use of delimiters to identify the content of the banner message. The banner motd command is followed by a space and a delimiting character. Then, one or more lines of text are entered to represent the banner message. A second occurrence of the delimiting character denotes the end of the message. The delimiting character can be any character as long as it does not occur in the message. For this reason, symbols such as the "#" are often used.
The syntax to configure a MOTD, from global configuration mode is:
Switch(config)# banner motd # message #
Once the command is executed, the banner will be displayed on all subsequent attempts to access the device until the banner is removed.
The example in the figure illustrates a banner configured with the delimiting "#" symbol. Notice how the banner is now displayed when accessing the switch.