Cisco Config Sanitizer
Remove sensitive data from Cisco configs before posting on Reddit, Cisco Community, or sending to TAC. The sanitizer redacts passwords, SNMP community strings (including trap host communities), TACACS+ and RADIUS keys, crypto ISAKMP pre-shared keys, banner content, and optionally anonymizes IP addresses using RFC 5737 documentation ranges. For configs you cannot send off box, a desktop version runs the same redaction fully offline on your own machine.
Open the SanitizerWhat it does
- Redacts enable secret, line passwords, username credentials
- SNMP community strings and snmp-server host trap communities
- TACACS+ and RADIUS shared keys
- Crypto ISAKMP pre-shared keys and PKI certificate blocks
- Banner login and motd content
- Optional: IP address anonymization (RFC 5737, 192.0.2.x, 198.51.100.x)
- Shows exactly which lines were modified
Frequently asked
What does the sanitizer remove?
Enable secrets, line and username passwords, SNMP community strings, TACACS+ and RADIUS keys, crypto ISAKMP pre-shared keys, PKI certificate blocks, and banner text. It can also anonymize IP addresses using RFC 5737 documentation ranges.
Can I see what changed?
Yes. The output shows exactly which lines were modified so you can confirm nothing sensitive slipped through.
Is there a fully offline option?
Yes. A desktop version runs the same redaction on your own machine with no upload, for configs you cannot send off box.