Configuring a Warning Login Banner on Cisco ASA Firewall

It is a good security practice to configure a Warning login banner on your Cisco ASA firewall appliance for unauthorized access attempts. In this article we will describe how to configure such a banner for different ways available for connecting to the appliance such as using the graphical interface (ASDM), session, login etc.

The command format is:

ciscoasa(config)# banner {asdm | exec | login | motd text}

As you can see from the command format, there are four access banner types as following:

• asdm: The Firewall displays a banner after you successfully log in to ASDM.
• exec: The Firewall displays a banner before displaying the enable prompt. For SSH connections use this method.
• login: The Firewall displays a banner before the password login prompt when accessing the security appliance using Telnet or via the serial console cable.
• motd: This is the Message of the Day banner. It is displayed when you first connect.

Configuration Example for Login Banner:

ciscoasa(config)# banner login                ** W A R N I N G **
ciscoasa(config)# banner login Unauthorized access prohibited. All access is
ciscoasa(config)# banner login monitored, and trespassers shall be prosecuted
ciscoasa(config)# banner login to the fullest extent of the law.

In order to add a multi-line message such as the one above, you must enter a new banner command for each line you want in the message. For example, for the message above which has 4 lines, you must enter the command “banner login” four times (one for each line). The new lines will be appended to the end of the existing message.

If you want to remove a specific line from the message, this is not possible unfortunately. You must remove the whole message by using for example “no banner login” which will delete the entire message.

Configuration Example for Remote Access Banner:

You can also configure a message for users connecting via remote access VPN methods. This banner message is configured under the “group-policy” attributes settings of the remote access (Anyconnect, IPSEC etc).

ciscoasa(config)# group-policy remote-access-Group attributes
ciscoasa(config-group-policy)# banner value This System is Restricted for Authorized Use Only