Reply

Policy Compliance - Regex and Banner MOTD

Posts: 75
1608     0

Hi Guys,

So I am making a lot of process on creating policies for Cisco devices.  I would now like to also check for the correct banner MOTD.  For some reason, our banner has lots of "*".  Anyways, I tried using the \* to indicate it was no wildcard, but that didn't seem to work. 

Has anyone else encountered this problem and the solution?

Example Banner

banner motd *********************************** WARNING **********************************
banner motd there are bunch of words here
banner motd *********************************** WARNING **********************************
banner motd *********************************** WARNING **********************************

Example Policy

"Must contain this block"

banner motd \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* WARNING \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
banner motd there are bunch of words here
banner motd \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* WARNING \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
banner motd \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* WARNING \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Susan,

[ Edited ]
Adviser
Posts: 453
1608     0

Susan,

Here is an example of my Banner:

banner motd ^C
########################## Sif's Network Services ###########################
        WARNING: This system is restricted solely to Sif's authorized users
for legitimate purposes only. The actual or attempted access, use, or
modification of this system is strictly prohibited by Sif's. Unauthorized
users are subject to Company disciplinary proceedings and/or criminal and civil
penalties under state, federal, or other applicable domestic and foreign laws.
The use of this system may be monitored and recorded for administrative and
security reasons. Anyone accessing this system expressly consents to such
monitoring and is advised that if monitoring reveals possible evidence of
criminal activity, Sif's may provide the evidence of such activity to law
enforcement officials. All users must comply with Sif's Corporate
Instructions regarding the protection of Sif's information assets.
                 
########################## Sif's Network Services ###########################
^C

I had to do a find and replace (on Windows download Notepad++ great for find and replace, oyea it's free) for the following

# to \#

' to \'

@ to \@

^ to \^

Now my rule text looks like this:

banner motd \^C
\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# Sif\'s Network Services \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#
        WARNING: This system is restricted solely to Sif\'s authorized users
for legitimate purposes only. The actual or attempted access, use, or
modification of this system is strictly prohibited by Sif\'s. Unauthorized
users are subject to Company disciplinary proceedings and\/or criminal and civil
penalties under state, federal, or other applicable domestic and foreign laws.
The use of this system may be monitored and recorded for administrative and
security reasons. Anyone accessing this system expressly consents to such
monitoring and is advised that if monitoring reveals possible evidence of
criminal activity, Sif\'s may provide the evidence of such activity to law
enforcement officials. All users must comply with Sif\'s Corporate
Instructions regarding the protection of Sif\'s information assets.
                 
\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# Sif\'s Network Services \#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#
\^C

Now we same must containg this block, some issues I ran in too with customers were they copied and past the message from one device to another.

So they ended up with banner motd ^CC or banner motd ^CCCC and the rule fail.

If you have this issue replace "banner motd \^C" with "banner motd .+"

Let me know if this works for you.

 

Sif

Follow me on LinkedIn: https://www.linkedin.com/in/sifbaksh
Twitter: https://twitter.com/sifbaksh

https://sifbaksh.com
Showing results for 
Search instead for 
Did you mean: 

Recommended for You