Managing Connections and System Banners

This chapter describes how to manage connections to other hosts and set banner messages for router users. For a complete description of the connections and system banner commands in this chapter, refer to the "Connections and System Banners Commands" chapter in the Configuration Fundamentals Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.

The following sections describe the connections and system banners tasks:

• Manage Connections

• Set Up Terminal Banners

• Set Up Terminal Messages

Manage Connections

This section describes session-management activities. The following sections describe connection-management activities that apply to all supported connection protocols:

• Escape to the EXEC Prompt

• Switch to Another Connection

• Assign a Logical Name to a Connection

• Change a Login Name

• Lock Access to a Terminal

• Specify a TACACS Host

• Send Messages to Other Terminals

• Clear TCP/IP Connections

• Exit a Session Started from a Router

• Log Out of a Router

• Disconnect a Line

Escape to the EXEC Prompt

After you have started a connection, you can escape out of the current session and return to the EXEC prompt by using the escape sequence command (Ctrl-Shift-6 then x [Ctrl^x] by default). You can type the command character as you hold down the Ctrl key or with the Ctrl key released; you can type either uppercase or lowercase letters.

Switch to Another Connection

You can have several concurrent sessions open and switch back and forth between them.

The number of sessions that can be open is defined by the session-limit command.

Assign a Logical Name to a Connection

To assign a logical name to a connection, perform the following task in EXEC mode:

The logical name can be useful for keeping track of multiple connections.

You are prompted for the connection number and name to assign. The where command displays a list of the assigned logical connection names.

Change a Login Name

You can change a login username if you must match outgoing access list requirements or other login prompt requirements. To change a login username, perform the following task in user EXEC mode:

The router must be one of the routers defined in a router configuration. For more information, refer to the "Specify a TACACS Host" section later in this chapter, or refer to the tacacs-server host command in the "TACACS, Extended TACACS, and TACACS+ Commands" chapter of the Security Command Reference.

If you do not specify a host, the router tries each of the TACACS servers in the list until it receives a response.

If you specify a host that does not respond, no other TACACS server will be queried. The router either denies access or function, according to the action specified by the tacacs-server last-resort command, if it is configured.

If you specified a TACACS server host with the user @tacacs-server argument, the TACACS server specified is used for all subsequent authentication or notification queries, with the possible exception of SLIP address queries.

For an example of changing a login name, see the "Change a Login Name Example" section at the end of this chapter.

Lock Access to a Terminal

You can prevent access to your terminal session while keeping your connection open by setting up a temporary password. To lock access to the terminal, perform the following tasks in EXEC mode:

The Cisco IOS software honors session timeouts on a locked line. You must clear the line to remove this feature. The system administrator must set up the line to allow use of the temporary locking feature.

Specify a TACACS Host

You can specify a TACACS host when you dial in or use the login command. Only the specified host is accessed for user authentication information.

To specify the name of a TACACS host at login, perform the following task in EXEC mode:

For an example of specifying a TACACS host, see the "Specify a TACACS Host Example" section at the end of this chapter.

Send Messages to Other Terminals

You can send messages to one or all terminal lines. A common reason for doing this is to inform users of an impending shutdown. To send a message to other terminals, perform the following task in EXEC mode:

The system prompts for the message, which can be up to 500 characters long. Enter Ctrl-Z to end the message. Enter Ctrl-C to abort the command.

Clear TCP/IP Connections

To clear a TCP connection, perform the following task in privileged EXEC mode:

The clear tcp command is particularly useful for clearing hung TCP connections.

The clear tcp line line-number command terminates the TCP connection on the specified TTY line. Additionally, all TCP sessions initiated from that TTY line are terminated.

The clear tcp local host-name port remote host-name port command terminates the specific TCP connection identified by the host name/port pair of the local and remote router.

Exit a Session Started from a Router

The protocol used to initiate a session determines how you exit that session.

Except for XRemote, you also can escape to the EXEC prompt and enter either of the following commands to terminate an active terminal session:

Log Out of a Router

The method you use to disconnect from a router depends on where you are located in relation to the router, and the port on the router to which you log in. Keep the following in mind:

• If your terminal or computer running a terminal-emulation application is connected physically to the console port of the router, you can disconnect from the console port by physically disconnecting the cable from the console port of the router.

• If your terminal or computer running a terminal-emulation application is remotely connected to the console port of the router, you disconnect by issuing the command or key sequence used by your terminal-emulation package. For example, if you are on a Macintosh computer running the application "TCP/Connect" from InterCon Corporation, you would press Ctrl-] at the user or privileged EXEC prompt to disconnect.

• If you are on a remote terminal and connect to a VTY line through a synchronous interface on the router, you can issue any of the following commands to disconnect:

  • close

  • exit

  • logout

  • quit

Disconnect a Line

To disconnect a line, perform the following task in EXEC mode:

Avoid disconnecting a line to end a session. Instead, log off the host to allow the router to clear the connection. Then end the session. Only if you cannot log out of an active session should you disconnect the line.

Set Up Terminal Banners

The types of banners that can be displayed to terminal users who connect to the router are described in the following sections:

• Configure a Message-of-the-Day (MOTD) Banner

• Configure a Login Banner

• Configure a Line-Activation Banner

• Configure an Incoming Banner

You also can turn off message displays, as described in the "Enable or Disable the Display of Banners" section.

For an example of displaying terminal banner messages, see the "Banner Example" section at the end of this chapter.

Configure a Message-of-the-Day (MOTD) Banner

You can configure a message-of-the-day (MOTD) banner to be displayed on all connected terminals. This banner is displayed at login and is useful for sending messages that affect all network users (such as impending system shutdowns). To do so, perform the following task in global configuration mode:

Configure a Login Banner

You can configure a login banner to be displayed on all connected terminals. This banner is displayed after the MOTD banner and before the login prompts.

To configure a login banner, perform the following task in global configuration mode:

The login banner cannot be disabled on a per-line basis. To globally disable the login banner, you must delete the login banner with the no banner login command.

Configure a Line-Activation Banner

You can configure a line-activation banner to be displayed when an EXEC process (such as a line-activation or incoming connection to a VTY line) is created. To do so, perform the following task in global configuration mode:

Configure an Incoming Banner

You can configure a banner to be displayed on terminals connected to reverse Telnet lines. This banner is useful for providing instructions to users of these types of connections. Reverse Telnet connections are described in more detail in the "Establishing a Reverse Telnet Session to a Modem" chapter in the Dial Solutions Configuration Guide.

To configure a banner that is sent on incoming connections, perform the following task in global configuration mode:

Enable or Disable the Display of Banners

You can control display of the message-of-the-day (MOTD) and line-activation (EXEC) banners. By default, these banners are displayed on all lines. To suppress or reinstate the display of such banners, perform one of the following tasks in line configuration mode:

These commands determine whether the router will display the EXEC banner and the message-of-the-day (MOTD) banner when an EXEC session is created. These banners are defined with the banner motd and banner exec commands. By default, the MOTD banner and the EXEC banner are enabled on all lines.

Disable the EXEC and MOTD banners using the no exec-banner command.

The MOTD banners can also be disabled by the no motd-banner line configuration command, which disables MOTD banners on a line. If the no exec-banner command is configured on a line, the MOTD banner will be disabled regardless of whether the motd-banner command is enabled or disabled. Table 6 summarizes the effects of the exec-banner command and the motd-banner command.

For reverse Telnet connections, the EXEC banner is never displayed. Instead, the incoming banner is displayed. The MOTD banner is displayed by default, but it is disabled if either the no exec-banner command or no motd-banner command is configured. Table 7 summarizes the effects of the exec-banner command and the motd-banner command for reverse Telnet connections.

Set Up Terminal Messages

The types of messages that can be displayed to terminal users who connect to the router are described in the following sections:

• Configure an Idle Terminal Message

• Display a "Line in Use" Message

• Display a "Host Failed" Message

Configure an Idle Terminal Message

You can configure messages to be displayed on a console or terminal not in use. Also called a vacant message, this message is different from the banner message displayed when an EXEC process is activated. To configure an idle terminal message, perform the following task in line configuration mode:

Display a "Line in Use" Message

You can display a "line in use" message when an incoming connection is attempted and all rotary group or other lines are in use. Perform the following task in line configuration mode:

If you do not define such a message, the user receives a system-generated error message when all lines are in use. You also can use this message to provide the user with further instructions.

Display a "Host Failed" Message

You can display a "host failed" message when a Telnet connection with a specific host fails. Perform the following task in line configuration mode:

Managing Connections and System Banners Examples

This section contains the following examples:

• Change a Login Name Example

• Specify a TACACS Host Example

• Clear TCP/IP Connection Examples

• Banner Example

Change a Login Name Example

The following example shows how login usernames and passwords can be changed. In this example, a user currently logged on under the username user1 attempts to change that login name to user2. After entering the login command, the user enters the new username, but enters an incorrect password. Because the password does not match the original password, the system rejects the attempt to change the username.

Router> login
Username: user2
Password:
% Access denied
Still logged in as "user1"

router> login
Username: user2
Password:
router>

Specify a TACACS Host Example

In the following example, user1 specifies the TACACS host host1 to authenticate the password:

router> login
Username: user1@host1
Translating "HOST1"...domain server (131.108.1.111) [OK] 

Clear TCP/IP Connection Examples

The following example clears a TCP connection using its TTY line number. The show tcp command displays the line number (tty2) that is used in the clear tcp command.

Router# show tcp
 
    tty2, virtual tty from host router20.cisco.com
    Connection state is ESTAB, I/O status: 1, unread input bytes: 0
    Local host: 171.69.233.7, Local port: 23
    Foreign host: 171.69.61.75, Foreign port: 1058
 
    Enqueued packets for retransmit: 0, input: 0, saved: 0
 
    Event Timers (current time is 0x36144):
    Timer          Starts    Wakeups            Next
    Retrans             4          0             0x0
    TimeWait            0          0             0x0
    AckHold             7          4             0x0
    SendWnd             0          0             0x0
    KeepAlive           0          0             0x0
    GiveUp              0          0             0x0
    PmtuAger            0          0             0x0
 
    iss: 4151109680  snduna: 4151109752  sndnxt: 4151109752     sndwnd:  24576
    irs: 1249472001  rcvnxt: 1249472032  rcvwnd:       4258  delrcvwnd:     30
 
    SRTT: 710 ms, RTTO: 4442 ms, RTV: 1511 ms, KRTT: 0 ms
    minRTT: 0 ms, maxRTT: 300 ms, ACK hold: 300 ms
 
Router# clear tcp line 2
    [confirm]
     [OK]

The following example clears a TCP connection by specifying its local router host name and port and its remote router host name and port. The show tcp brief command displays the local (Local Address) and remote (Foreign Address) host names and ports to use in the clear tcp command.

Router# show tcp brief
    TCB       Local Address           Foreign Address        (state)
    60A34E9C  router1.cisco.com.23      router20.cisco.1055  ESTAB
 
Router# clear tcp local router1 23 remote router20 1055
    [confirm]
     [OK]

The following example clears a TCP connection using its TCB address. The show tcp brief command displays the TCB address to use in the clear tcp command.

Router# show tcp brief
    TCB       Local Address           Foreign Address        (state)
    60B75E48  router1.cisco.com.23      router20.cisco.1054  ESTAB
 
Router# clear tcp tcb 60B75E48
    [confirm]
     [OK]

Banner Example

The following example shows how to use the banner global configuration commands and the no exec-banner line configuration command to notify your users that the server is going to be reloaded with new software:

! The EXEC and MOTD banners are inappropriate for the VTYs.
line vty 0 4
 no exec-banner
!
banner exec /
 This is Cisco Systems training group router.
 
 Unauthorized access prohibited.
 /
!
banner incoming /
 You are connected to a Hayes-compatible modem.
 
 Enter the appropriate AT commands.
 Remember to reset anything to change before disconnecting.
 /
!
banner motd /
 The router will go down at 6pm for a software upgrade
 /