Banner MOTD

I am trying to execute a script with a fairly large banner. Everytime it is pushed to the device it ads a line in between each line of text.
so it should look like this
THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM.

but looks like this on the switch

THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED

INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM.

it is a cisco switch and I am running Cirrus V3.0

Find more posts tagged with

Accepted answers

All comments

brockn

its adding an extra carriage return does anyone know why?

duncan_922

This happened to me before, I fixed it by encasing the message in "^". As in ^THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM.^

jms11208

This doesn't seem to fix the problem for me, I've tried putting the "^" in several places and it still double spaces the banner. Anyone find a solution for this?

MaxFreedom

I also had to deploy an extremely long banner and I was having the same issue. I was able to fix the issue by using Command Script Variables. If you insert a carriage return variable instead of using separate lines in the script it should deliver the banner properly. So in your example you can use the following instead:

THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED${CRLF}INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM.

The result of which will be the string of text on two separate lines without the double spacing.

DGoodale

Something similar happened to me quite a while back while pushing configuration changes with a terminal emulator. The fix for me was choosing a different emulation (vt52 in this case). If your sending and receiving emulations aren't the same, you could be sending something to your switch that it is interpreting as 2 line feeds instead of a carriage return and a line feed.

IPv6Freely

I can't even get a login banner to work through NCM.

Okay I take that back... it only takes about 30 seconds per line... so 150 devices... awesome!

EDIT: Okay, changing the Telnet/SSH Prompt Timeout to 5 seconds made each line appear after 5 seconds. Why does it do this? It's a simple paste...

chris.lapoint

Can you please open a support ticket on this one and reference reproduction steps in your post? We'll need to try to reproduce in house to figure out what's going on.

Ciag

Hi Chris,

I'm seeing a similar issue while trying to upload a long banner. Even when using Command script variables such as ${CR} and ${CRLF} I still can't get more than a few words per line.

I ran Wire shark to see if I could spot anything with the transmission of the data but nothing obvious popped up. The only thing I saw which may or may not be contributing to the issue is that all the commands are echoed by the device being uploaded to. This is what I would expect to see if I was typing in the commands through a terminal window, but it might not be needed for the way that NCM uploads the data.

To be honest I'm clutching at straws here because I don't really know what's happening. Will I go ahead and raise a ticket as well?

IPv6Freely

Just a guess here, but perhaps after every CRLF, NCM expects to see a prompt? In a MOTD banner, there is no prompt after a CRLF, so it has to wait for the SSH timeout (which is why lowering the SSH timeout lowered the amount of time I had to wait per banner line).

So perhaps an IOS template issue? I'm not sure how NCM dictates what it expects to get back from the device...

chris.lapoint

Can the folks having issues with banners post their exact commands scripts they're trying to run in NCM, target device types, and whether you're using SSH or Telnet for script execution? I'd like to try to reproduce myself.

I've noticed that on our Cisco 4507 switch in the lab, it requires delimitting the MOTD banner with a "c" before and "c" after the banner.

So, I ran the following and it worked fine:

${EnterConfigMode}
banner motd c THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM. c
exit
exit

Update: Same results on Cisco 3750.

Ciag

This is gonna be a long one folks, sorry. So currently our banner is set up on most of our devices. The devices that do have it configured correctly display the banner in the following format. (The banner on these devices was rolled out using Kiwi Catools a very long time ago, not by me)

Warning Message

Use of this system is restricted to authorised users only.

Unauthorised access or use is prohibited by law.

Violators will be prosecuted.

Authorised systems users must comply with the Information Security Policies

and Standards of the institution.

Your continued use of this system implies your acceptance of the above

conditions and of the legal or disciplinary actions which can be taken

against you if you attempt to gain access without authorisation.

I can achieve this format if I log into the device and paste the banner message manually. But if I try to upload it through NCM using the following script the job fails to enter any text.

conf t

Banner motd C

Warning Message

Use of this system is restricted to authorised users only.

Unauthorised access or use is prohibited by law.

Violators will be prosecuted.

Authorised systems users must comply with the Information Security Policies

and Standards of the institution.

Your continued use of this system implies your acceptance of the above

conditions and of the legal or disciplinary actions which can be taken

against you if you attempt to gain access without authorisation. C

exit

If I enter the banner message text as a single line with no carriage returns I get this banner text at login:

Warning Message Use of this system is restricted to authorised users only. Unaut

horised access or use is prohibited by law. Violators will be prosecuted. Author

ised systems users must comply with the Information Security Policies and Standa

rds of the ins

Which isn’t useful as words are split between lines and the message is cut short.

If I add in the Command script variables for Carriage returns and line feeds as follows:

conf t

banner motd C Warning Message${CR} ${CRLF} Use of this system is restricted to authorised users only. Unauthorised access or use is prohibited by law. Violators will be prosecuted. Authorised systems users must comply with the Information Security Policies and Standards of the institution. C

exit

I see the following result:

Warning Message

Use of this system is restricted to authorised users only. Unauthorised access

or use is prohibited by law. Violators will be prosecuted. Authorised systems us

ers must comply with the Information Security Policies and Standards of the inst

itution.

It’s not ideal but it's closer than any other attempt. As you can see words are still split between lines and if I wish to continue the message it must be contained within a single line of text.

If I attempt to add additional carriage returns anywhere within the message text (with or without line feed commands, the job fails) The carraige returns obviously work at the beginning of the message but if I attempt adding more it just craps out

At the moment I am running the attempts on test 3550 and 2950 boxes. These test devices are running Telnet

IPv6Freely

It’s not ideal but it's closer than any other attempt. As you can see words are still split between lines and if I wish to continue the message it must be contained within a single line of text.

If I attempt to add additional carriage returns anywhere within the message text (with or without line feed commands, the job fails) The carraige returns obviously work at the beginning of the message but if I attempt adding more it just craps out

You're going to have to manually create line breaks for your MOTD (which you know). The reason for this is that a Cisco device will wrap at a number of characters, regardless of whether it's in the middle of a word or not. It's not smart enough to detect that.

As you mentioned, this creates issues. I would suggest going into SSH properties (File > Settings > Telnet/SSH Settings) and changing the "Telnet/SSH Prompt Timeout" slider all the way down to the minimum 5 seconds. You'll find that the script isn't actually "crapping out", but is actually waiting for the SSH Prompt Timeout because you're inserting a line break without a prompt being returned. (As in, NCM expects that every time you hit ENTER, you -should- be getting a prompt back, which is obviously not the case.)

At least this way, a 10 line banner only takes 50 seconds per device, instead of the default (which I think is a 60 second SSH Prompt Timeout) 600 seconds per device.

I ended up setting it to 5 seconds, starting my script, and going home for the night. The script took nearly 2 hours and 10 minutes to complete on ~150 devices.

From the Telnet/SSH Settings window:

The Telnet/SSH Prompt Timeout is used by Orion Network Configuration Manager to determine how much time to wait for a prompt. This can be useful for commands which may change the prompt in unexpected ways, such as the 'hostname' command on Cisco Routers. If a command is given, and the prompt changes, Orion Network Configuration Manager does not know if the command has completed, or if more output is expected. Orion Network Configuration Manager will look for identifiers signaling that more data is due, but if no identifiers are sent, Orion Network Configuration Manager will wait out this time period, then send the next command in it's script.

This explains exactly why the issue is occuring.

IPv6Freely

I also had to deploy an extremely long banner and I was having the same issue. I was able to fix the issue by using Command Script Variables. If you insert a carriage return variable instead of using separate lines in the script it should deliver the banner properly. So in your example you can use the following instead:
THIS IS A DOD COMPUTER SYSTEM. BEFORE PROCESSING CLASSIFIED${CRLF}INFORMATION, CHECK THE SECURITY ACCREDITATION LEVEL OF THIS SYSTEM.
The result of which will be the string of text on two separate lines without the double spacing.

Heh... why was this suggested as an answer? It doesn't even mention the source of the problem, let alone a resolution :P

pyperdown

While this does not pertain to your scripting issue, I found that if you use putty rather than that pile of shite known as hyperterminal via serial, it does not exhibit the duplicated line feeds issue.

Both hyperterminal and realterm borked it badly. Don't know why this happens. I suppose it could be an IOS issue, as I tried change cr/lfs to lf's, cr's, etc all to no avail.