Forward Networks | Community

Skip to main content

- - Forward Knowledge Base
Product Updates
FWD.app

Product Updates

Forward Networks Knowledge Base

API and Automation

2 Categories
7 Articles

Forward Platform

12 Categories
35 Articles

Integrations

2 Categories
4 Articles

Network Device Vendors

4 Categories
11 Articles

Community Discussions

Recently active
Help others

deronjohnsonEmployee

Synthetic Nodes

Introduction to Forward Networks' Synthetic NodesBeginner

A synthetic node is a user-generated construct in the Forward Networks model. It is used to represent a device or portion of the network from which data cannot be collected by the Forward platform. Most often a synthetic node represents a private service provider network (such as a layer-3 VPN) or the public Internet itself. With Forward Networks' synthetic nodes, you can gain deep insights into traffic behavior, security policy compliance, and connectivity without needing actual devices in place. Key Benefits of Synthetic NodesExtend Network Visibility: Model networks beyond physical limitations by identifying connections between devices, cloud regions, or even hypothetical network expansions. This allows teams to visualize how traffic would behave in different scenarios without deploying new hardware. Improve Troubleshooting: Identify potential routing or connectivity issues in a controlled, testable environment without affecting live network traffic. By analyzing network behavior

DannyRRamping Up

API Path Searching with FQDNs

Hello Forward Networks!I have a question regarding if it's possible to add support to resolve FQDNs in the Path Search API? Or would we have to rely on our own DNS servers to make the resolutions first to then add the discovered IP Address to the source or destination. Can it be possible for Forward Networks to model FQDNs as independent objects? Apologies if this seems like a silly ask!Thank you

ChristopherEmployee

ServiceNow CMDB

Change Control Workflow Automation with the APIIntermediate

It is possible to use the Forward Enterprise API to automate integration with your change control process. For example, suppose you manage Change Control work using a system like ServiceNow to document the owner of a change, the devices involved, the state of the change, and the change results. You may want to trigger the creation of a workspace network and collection via the API. Forward Networks integrates with ServiceNow for ticket creation and CMDB management, but there is not a specific integration for Change Control. However, if your ticketing/workflow system supports running API calls, you can trigger Forward API calls to automate your workflow. Suppose your Change Control Process is the following:Create a ServiceNow ticket to track the change. Add a work plan, including the devices that are part of the change, to the ticket. Create a Workspace Network in Forward Enterprise with the devices in the change. Define NQE queries to validate the state of the network before and after t

captainpacketEmployee

On-Prem Deployment

Keep CVE Data Current in Air-Gapped Forward Enterprise InstancesIntermediate

For Forward Enterprise on-prem customers running air-gapped instances, maintaining up-to-date security data can offer challenges. This Python script addresses those challenges by automating the daily update of the CVE (Common Vulnerabilities and Exposures) database, ensuring your instance reflects the latest threat intelligence—even when it’s offline. You can perform these updates in the Forward Enterprise UI, but this script offers an automated solution to ensure you’re running the most up-to-date definitions. In addition to CVEs, you can modify this script to include custom definitions to identify threats and compliance requirements specific to your industry or sector. Jump to the script Designed for Security and Compliance Teams This script is particularly valuable for:Security Operations Center (SOC) teams monitoring for zero-day vulnerabilities Audit and compliance professionals needing accurate, up-to-date security data Any on-prem customer managing Forward Enterprise in a

RichEmployee

On-Prem Deployment

Certs - Create a CSR for your Forward On-Prem DeploymentIntermediate

When deploying Forward Networks' on-premises solution, securing communications with a trusted SSL/TLS certificate is essential. The first step in this process is generating a Certificate Signing Request (CSR), which is required to obtain a signed certificate from a Certificate Authority (CA). A CSR contains key details about the organization, including domain names and encryption settings, ensuring that the certificate issued aligns with the network's security requirements. This guide walks through the step-by-step process of creating a CSR for Forward On-Prem deployment, including generating a configuration file, using OpenSSL to produce the CSR, and submitting it for signing. Create a CSR for Forward On-Prem Deployment There are two ways to create and generate a CSR, manually or using an answer file. The choice is up to the user, but the answer file is less error prone.The manual process involves answering questions at the command line (CLI) using openssl. The answer file process i

ChristopherEmployee

NQE Discussions

NQE Query to list prefixes advertised to public BGP peers

This query returns a list of devices, their public BGP peers, and the prefixes advertised to each peer.Note that the line where neighbor.neighborAddress not in nonPublicIps limits the output to peers whose IP is not an RFC 1918 or link-local IP address./*** @intent Lists public BGP peers and what prefixes are advertised to them*/import "@fwd/L3/IpAddressUtils";// The prefixes that are advertised from device to neighborAddressgetAdvRoutes(device, neighborAddress) = foreach x in [1] where isPresent(device.bgpRib) let bgpRib = device.bgpRib foreach afiSafi in bgpRib.afiSafis foreach neighbor in afiSafi.neighbors where neighbor.neighborAddress == neighborAddress where isPresent(neighbor.adjRibOutPost) let adjRibOutPost = neighbor.adjRibOutPost foreach route in adjRibOutPost.routes select distinct route.prefix;// List of IP subnets to excludenonPublicIps = ipAddressSet(privateSubnets + [ipSubnet("169.254.0.0/16")]);foreach device in network.devicesforeach networkInstance in de

GTurnerEmployee

NQE Discussions

Normalized Ranking Without Sorting in NQE

Motivation A customer recently approached me with a challenge: they wanted to feed downstream systems with ordered and banded firewall data. Specifically, they had the following use cases:Identify Top-N firewalls based on configuration complexity and other attributes like greatest number of permissive or shadow rules. Flag percentile-based thresholds for various attributes (e.g., top 10%, bottom 25%) Enable dynamic device selection for exhaustive, compute-heavy rule analysis The challenge? NQE is designed for efficient set-based analysis, therefore it doesn’t require sorting or ranking functions in general. Nevertheless, this customer’s use case called for an approach to simulate these behaviors without external processing.So instead of relying on a built-in sort function, we can create a lightweight, math-driven approach that simulates ranking behavior. It’s fast, deterministic, and works entirely inside the NQE layer so that no external processing or comparisons are required.In th

IvanRamping Up

NQE Discussions

Is it possible to use regex in a pattern block?

I am trying to match against a Palo Alto configuration looking for rules that are using a specific destination object. Rules are under this structure:config devices {string} vsys {string} rulebase security rules {rule_name: (string)*} and an example of what I am trying to match is: "Example Rule" e32ff2ab-a82f-43b6-953e-7e113v624779 { destination [ non-client "External SRC EDL" "Another EDL-wehave"]; First line would be the rule name and the second is where I would really want to do the regex match. The items past “destination” can be a single entry or multiples within []’s. If there are spaces in the names then the whole name is confined in “’s. My goal is to find all rules which have “External SRC EDL” in the destination and I can’t quite figure out how to do it. Any help would be appreciated.

Rohit_809 KumarSpotter

NQE Discussions

How can i get output in single coloum

How can i get output in single coloum . team , i am using below query to get the NTP Server data , however is tried all option to get the output in single coloum , but i am not sucess. NQE Query ciscontppattern=```ntp server {server:string}```;ciscontppattern2=```ntp server {vrf:string} {dir:string} {ser:ipv4Address}```;patternf5 = ```sys ntp servers { server1:string} {server2:string}```;cisco1(device) =foreach command in device.outputs.commands let response = parseConfigBlocks(device.platform.os, command.response) foreach match in blockMatches(response, ciscontppattern) select match.data.server;cisco2(device) =foreach command in device.outputs.commands let response = parseConfigBlocks(device.platform.os, command.response) foreach match in blockMatches(response, ciscontppattern2) select match.data.ser;getServers(device) =foreach command in device.outputs.commands where command.commandText == "list sys ntp"let filtered_response = replace(command.response, "{", "")let filtered_

ChristopherEmployee

How to Integrate ServiceNow (SNOW) with Forward Enterprise

Forward Enterprise can integrate with ServiceNow in the following ways: Incident Management - Opening or updating a ServiceNow ticket based on an intent verification failure or change:Forward Docs - Create ServiceNow Incidents CMDB Integration - Pushing updates to the CMBD database with data from Forward Enterprise:Forward Docs - CMDB Integration As a Data Connector with NQE - Extracting data from ServiceNow using an NQE query for use in the NQE Library, Inventory+, or a Decorator by configuring ServiceNow as a Data Connector:Forward Docs - Data Connectors From ServiceNow - By using Flow Designer or Business Rules to access the Forward API. Consult ServiceNow documentation and access one of Forward Enterprise’s API endpoints listed here:Forward Docs - API----The first two integration types above are enabled under Settings > Integrations:

IvanRamping Up

NQE Discussions

Is it possible to use regex in a pattern block?

I am trying to match against a Palo Alto configuration looking for rules that are using a specific destination object. Rules are under this structure:config devices {string} vsys {string} rulebase security rules {rule_name: (string)*} and an example of what I am trying to match is: "Example Rule" e32ff2ab-a82f-43b6-953e-7e113v624779 { destination [ non-client "External SRC EDL" "Another EDL-wehave"]; First line would be the rule name and the second is where I would really want to do the regex match. The items past “destination” can be a single entry or multiples within []’s. If there are spaces in the names then the whole name is confined in “’s. My goal is to find all rules which have “External SRC EDL” in the destination and I can’t quite figure out how to do it. Any help would be appreciated.

need to get api nodes url

Rohit_809 KumarSpotter

General Discussions

How can i remove some static values for output.

we are using below NQE Query to get the NTP Server details , i need to remove some static value in server coloum, ciscontppattern=``` ntp server {server:string}```;getServers(device) = foreach match in blockMatches(device.files.config, ciscontppattern) select { serverIP: match.data.server}; foreach device in network.deviceslet platform = device.platformwhere device.platform.vendor == Vendor.CISCO select { device: device.name, vendor: device.platform.vendor, tags: device.tagNames, os: device.platform.os, OSVersion :platform.osVersion, servers: (foreach server in getServers(device) select server.serverIP)} Example : i dont want to show entry those have server value - “Inte”

SteveBamfordDriver

General Discussions

Hi allHas anyone onboarded Arista WIFI yet, the models we have are managed centrally via CV-CUE the Wifi version of cloudvision, although you can extract some commands via SSH.Had a quick look around and couldn’t find anything, I will in the meantime dig around about custom devices 😀Thanks

SteveBamfordDriver

NQE Discussions

Arista APs Validate only authorised SSIDs have been configured.

This NQE will validate that only the SSID’s in allowedSSID’s can be used, if it does not exists in the list it will fail the query.Taking advice from an earlier post I have used blockMatches this time, there is some tuning required to remove the duplicates as a result of the table have the entry for each /** * @intent Validate that the arista AP's have only the approved SSID's configured * @description This will check each arista AP for the approved SSIDs and violate when ther SSID does not match * the allowedSSID list. * * You will get multiple entries due to the VAPS list having an entry for each frequency. This will be a future * fix to show only once when the unauthoirised SSID exists */pattern = ```VAP-ID : {VAPId:string} ESSID : {SSID:string}```;// Replace the SSID's with your own.allowedSSID = ["ssid1","ssid2","ssid3"];foreach endpoint in network.endpointswhere endpoint.profileName == "Arista Wireless AP's"foreach command in endpoint.cliCommandRespons

Tyson HenrieEmployee

Koan Challenges

Play our NQE Koan Challenge - Group People by Age

Hello NQE Enthusiasts, I’ll try to post a new Koan Challenge every two months. ChallengeThis task is to take the following table and group people by age. Input [{ Name: "Bob", Age: 21 }, { Name: "Sam", Age: 19 }, { Name: "Jill", Age: 18 }, { Name: "Jim", Age: 21 }, { Name: "Sally", Age: 19 } ]; Example Result[{Age: 21, Count: 2}...] Hinthttps://fwd.app/docs/nqe/guides/comprehensions/#group-by-qualifier Contributions: Unclaimed

Rohit_809 KumarSpotter

NQE Discussions

NQE Query - Seeing multiple Values for single devices.

Team ,we are using belong NQE to get the information about Fortinet Firewall SNMP config and server white list information , however NQE provide the result , but devices are repeating ,ex, 1 devices we can see approx. 44 entry , can you please have a look on this and help us to fix . NQE Query // Patterns to match pattern_community= ```config system snmp community edit {string} set name {community:string} config hosts edit {string} set ip {ip:string} {netmask:string} next ```; foreach device in network.deviceslet outputs = device.outputs foreach command in outputs.commandswhere command.commandType == CommandType.CUSTOMwhere command.commandText == "show system snmp community"let central_mgmt = parseConfigBlocks(OS.FORTINET, command.response) // Search for the ""pattern_fmg" pattern looking for a matchforeach match in blockMatches(central_mgmt, pattern_community)//loop through the all server-address IP's and store them in variable

Rohit_809 KumarSpotter

NQE Discussions

how can i convert OS EOL query into basis of vendor and version

how can i convert OS EOL query into basis of vendor and version ? as of now in OS Support query showing output via device wise , i want to see this in to vendor os wise.

DanORamping Up

Adding/Deleting devices with API

We currently use Ansible playbooks to add or delete network devices to our various NMS tools. I want to add Forward Networks to this job so newly added devices or old devices being removed are part of this automation. When FN discovers a device it appears to use sysName for the “Name” of the device. The API however requires me to provide the name value. Is there anyway to just use the management IP to add it to FN and have FN set the name like it does during its own discovery?

gbaronSpotter

NQE Discussions

configuration search within Network Devices

I have a requirement to look for an IP anywhere in the configurations files that pertain to devices with a specific name. I tried to use the built in NQE under Forward Library>Device>Config Search, but when I enter the IP in the bottom box of the Parameters section, “Config_Pattern”, the results come back blank. Yet when I look at the device config, the IP I copied and pasted appears in the actual configuration. Also, the built in NQE seems picky...as in it wont pick of tacacs+ or acl, will pickup tacacs...and case sensitive as well apparently. For now, im looking for help with the IP search, I just wanted to not other issues with it.

Leaderboard

Show full leaderboard

Employee Leaderboard

Show Full Leaderboard

Solving Network Challenges with Forward

Find solutions at any level

Beginner

Learn Forward - solve problems faster

Intermediate

Go further with Forward

Expert

Solve at scale with Forward

Powered by Gainsight

Terms of Use Cookie settings

Sign up

Already have an account? Login

Select a login option:

Register / Login Forward Employee Login

Welcome to the Forward Networks Community

Select a login option:

Register / Login Forward Employee Login

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK