Router Hardware Management Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Router Hardware Management Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

Exclude Sensitive Information in Show Running Configurations Output

Updated: July 1, 2026

Want to summarize with AI?

Log in

Describes how to mask sensitive information such as strings, usernames, passwords, comments, and IP addresses in the show running-configuration command output by enabling sanitization on the nonvolatile generation (NVGEN) process.

The configuration output sanitization is a security feature that

  • masks sensitive information within the running configuration output

  • replaces sensitive strings with a placeholder, and

  • protects sensitive data such as passwords and IP addresses from unauthorized exposure.

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Excluding Sensitive Information in Show Running Configurations Command Output

Release 7.5.4

You can now exclude sensitive information such as strings, usernames, passwords, comments, or IP addresses within the show running-configuration command output by enabling sanitization on the nonvolatile generation (NVGEN) process.

With this feature, you can achieve better data protection to prevent cybersecurity risks compared to regular router algorithms.

This feature introduces the nvgen default-sanitize command.

The show running configuration command uses the nonvolatile generation (NVGEN) process in Cisco IOS-XR software to collect configuration information from every system component and construct a running configuration file. Because this file often contains sensitive information that poses a security threat, this feature provides a mechanism to sanitize the output. When you enable sanitization, the NVGEN process replaces the corresponding information with the <removed> string to prevent unauthorized access to critical data.

The feature allows you to mask these types of sensitive information in the show running configuration output:

  • Strings

  • Usernames

  • Passwords

  • Comments

  • IP Addresses

On enabling the sanitization in show running configurations, the NVGEN process replaces the corresponding information with <removed> string. For example, if you enable sanitization for IP Addresses, the show running configuration includes the <removed> string in place of all the IP Addresses in the output.

This feature introduces the nvgen default-sanitize command.

Configure sanitization

Use these tasks to configure sanitization for each category of sensitive information:

Sanitize strings

When you enable sanitization for the strings category, the NVGEN process replaces configurable string values, such as interface descriptions, with the <removed> token in the show running-configuration output.

Procedure

1.

Enter the global configuration mode.

Example:

Router# config
2.

Enable default sanitization for strings.

Example:

Router:(config)# nvgen default-sanitize strings
3.

Commit the changes.

Example:

Router:(config)# commit
4.

Verify that string sanitization is enabled in the running configuration.

Example:

Router# show run nvgen
nvgen
 default-sanitize strings
!
5.

Verify that configurable strings are masked in the interface running configuration.

Example:

Router# show run int Hu0/2/0/4
interface HundredGigE0/2/0/4
 ! This is comment 1
 description <removed>
 !

Sanitize usernames

When you enable sanitization for the usernames category, the NVGEN process replaces configured usernames with the <removed> token in the show running-configuration output.

Procedure

1.

Enter the global configuration mode.

Example:

Router# config
2.

Enable default sanitization for usernames.

Example:

Router:(config)# nvgen default-sanitize usernames
3.

Commit the changes.

Example:

Router:(config)# commit
4.

Verify that username sanitization is enabled in the running configuration.

Example:

Router# show run nvgen
nvgen
 default-sanitize usernames
!
5.

Verify that usernames are masked in the user running configuration.

Example:

Router# show run username test
username <removed>
 group root-lr
 password 7 172864HJWBJHBCWH
!

Sanitize passwords

When you enable sanitization for the passwords category, the NVGEN process replaces password values with the <removed> token in the show running-configuration output.

Procedure

1.

Enter the global configuration mode.

Example:

Router# config
2.

Enable default sanitization for passwords.

Example:

Router:(config)# nvgen default-sanitize passwords
3.

Commit the changes.

Example:

Router:(config)# commit
4.

Verify that password sanitization is enabled in the running configuration.

Example:

Router# show run nvgen
nvgen
 default-sanitize passwords
!
5.

Verify that passwords are masked in the user running configuration.

Example:

Router# show run username test
username test
 group root-lr
 password 7 <removed>
!

Sanitize comments

When you enable sanitization for the comments category, the NVGEN process replaces inline configuration comments with the <comments removed> token in the show running-configuration output.

Procedure

1.

Enter the global configuration mode.

Example:

Router# config
2.

Enable default sanitization for comments.

Example:

Router:(config)# nvgen default-sanitize comments
3.

Commit the changes.

Example:

Router:(config)# commit
4.

Verify that comment sanitization is enabled in the running configuration.

Example:

Router# show run nvgen
nvgen
 default-sanitize comments
!
5.

Verify that comments are masked in the interface running configuration.

Example:

Router# show run int Hu0/2/0/4
interface HundredGigE0/2/0/4
 ! <comments removed>
 description This is bundle member
 !

Sanitize IP addresses

When you enable sanitization for the ipaddrs category, the NVGEN process replaces IP address values with the <removed> token in the show running-configuration output.

Procedure

1.

Enter the global configuration mode.

Example:

Router# config
2.

Enable default sanitization for IP addresses.

Example:

Router:(config)# nvgen default-sanitize ipaddrs
3.

Commit the changes.

Example:

Router:(config)# commit
4.

Verify that IP addresses are masked in the interface running configuration.

Example:

Router# show run int Hu0/2/0/4
interface HundredGigE0/2/0/4
 ! This is comment 1
 description This is bundle member
  ipv4 address <removed> <removed> 
!