Home
Discussions
Community

Community

Connect with others to answer questions, gain new insights, and grow your networking knowledge.

139 Topics

Recently active

Most replies Most views Newest first

AndyLSpotter

Uptime Checks in NQE

I wrote a basic NQE script to obtain the uptime for devices and display them in years, days and hours. When i reviewed the results I saw some super robust devices out there that had not been rebooted for several years.This led to some discussion about whether uptime could be used in part to determine in device software upgrades were taking place regularly. As such we developed a really basic uptime check and threshold of around 6 months. Any devices that been up longer than 6 months would definitely have not been upgraded. (Our devices all reboot for software patches and upgrades).This script is below/*------------------------------------------------------------------------------------------------------------ * thresholdDays the number of days before uptime is not acceptable. ------------------------------------------------------------------------------------------------------------*/thresholdDays = 183;/*---------------------------------------------------------------------------------

Tyson HenrieEmployee

List with double quoted items in the list

I had to change a lot, but this keeps the intent. This is from a PANOS firewall. The problem is that I am trying to find the objects in this list. However, some objects have double quotes to show there are spaces in the name of the object and some do not. I’m not sure how to clean this since NQE natively does not use double quotes to designate a single object that happens to contain spaces. sampleInput = """policy { shared; panorama { address-group { THE-GRAPE-Subnets { static [ "Green Grapes Are Good" RedGrapes BlackGrapes "Wine Grapes" PurpleGrapes]; tag GRAPES; description "This is a list of Grapes"; }""";pattern01 = ```policy panorama address-group THE-GRAPE-Subnets static "[ {object: (string*)} ```;foreach x in [1]let config = parseConfigBlocks(OS.PAN_OS, sampleInput)foreach match in blockMatches(config, pattern01)select { objects: match.data, block: match.blocks}Then this is the result from the “objects” column.{object:["Green

MikeCommunity Manager

published in Videos

Unifying Networks with Merged Snapshots

Maintaining complete network visibility in today’s complex IT environments is daunting. Network segmentation, while essential for security, often complicates obtaining a comprehensive view of the entire network infrastructure. Federal IT departments charged with the responsibility of keeping networks mission-ready face significant hurdles in visualizing connectivity, ensuring security zone segmentation, and performing complete path searches across segmented domains. Challenges of a segmented network include:Limited Visibility - Segmentation obscures the overall connectivity map, complicating network interaction visualization. Complex Troubleshooting - Diagnosing issues spanning multiple segments is difficult without a unified network view. Operational Inefficiencies - Lack of a holistic view leads to inefficiencies, requiring manual information assembly across different interfaces.I created a blog post and video about Forward’s Merged Snapshot capabilities and how we address these cha

AndyLSpotter

Using NQE to generate output for L3VPN

Is there any additional documentation as to what needs to be included in any NQE query that is used to dynamically create l3vpn synthetic devices ?

MikeCommunity Manager

posted in Videos

ServiceNOW CMDB Integration

Is your network inventory spread across ServiceNow CMDB, spreadsheets, and various applications, leading to inaccuracies and causing you to overspend on service contracts?Discover how Forward Networks integrates with ServiceNow to seamlessly populate and update your CMDB with all organizational devices.

MikeCommunity Manager

posted in Videos

Demo Tuesday - 6/25/24 - Special Cisco Live Edition | Full Demo

If you've ever wished Demo Tuesdays were longer OR if you've always wondered what @Mike looks like in sequins-- this is the stream you've been waiting for. Mike takes our Cisco Live Demo Theater audience through a full 30 minutes of Forward Enterprise product demonstration live in Las Vegas.

Rohit_809 KumarDriver

asked in Product Discussions

Forward Network API

How can i collect below information from Forward Network via API for Network devices. ?• IP address,• MAC address• Interface details• Device Name• Subnet details1.Which API should be used to get the above information? In the documentation, I see an API to get networks/ Network collection/ devices ;2.Is there a single API call that can pull the above information, or are there multiple API calls?3.If it's one API call, what's the Max pagination limit?4.Can you please provide a Sample API or a Postman export to make an API call.

Rohit_809 KumarDriver

Collect NQE report Data via POWER BI

How can i collect NQE Query Data from Forward Network to Power BI Easily,

NandDriver

Interface alias details for Fortinet Firewall from NQE query

Hi All,Need to fetch interface alias details of Fortinet firewalls from NQE query. Please help me to build the logic.

NandDriver

WAN Interfaces Inventory from NQE query

Hi Team,I want to add only admin status up interfaces condition, CDP LLDP neighbor info in below query, please help me on this.Extra question- 1. any method to shirk the results to only getting WAN interfaces any idea on this.2. want to add one more column to fetch circuit id details from Interface or Interface description.NQE Query- pattern_interfaces = ["*WAN *"];testPatterns(s, p) = max (foreach pattern in pselect matches(toLowerCase(s), toLowerCase(pattern)));foreach device in network.devicesforeach interface in device.interfaceslet platform = device.platformlet ethernet = interface.ethernetwhere isPresent(interface.description)where testPatterns(interface.description, pattern_interfaces)select { test: testPatterns(interface.description, pattern_interfaces), deviceName: device.name, Location: device.locationName, Tags: device.tagNames, Vendor: platform.vendor, Model: platform.model, interfaceName: interface.name, negotiatedSpeed: ethernet.negotiatedPortSpeed, negotiatedMod

VarunSRamping Up

asked in Product Discussions

API URL

need to get api nodes url

kuhlskevEmployee

Are your BGP Peers also IPSEC Peers? - An expansion on Custom Command Parsing

As Arica shared with us previously in I wanted to expand on a customer request to show another example from a customer.They want to make sure all their BGP Peers are also IPsec Peers. This is a great way to demonstrate Custom Commands, Data Model and Functions. Notice up at the top we have the Pattern to match withpattern2 = ``` interface: {int:string} PERMIT, {flags:string} #send errors {sErrs:string} #recv errors {rErrs:string} local crypto endpt.: {localIP:string} remote crypto endpt.: {peer: ipv4Address} ```; Then we have a function to take a device and return all its IPsec peerspeerIpsec(deviceName) = foreach device in network.devices where deviceName == device.name let outputs = device.outputs foreach command in outputs.commandswhere command.commandText == "show crypto ipsec sa" let ipsecOutput = parseConfigBlocks(OS.IOS_XE, command.response) // this is for testing with sample show command output//let ipsecOutput = parseConfigBlocks(OS.IOS_XE, ipsec)foreach peer in bloc

NandDriver

WAN,INT Interfaces info through NQE query

I want to create a custom interface description nqe query in Forward Networks.Requirement is to getting only WAN, INT interfaces information through the query. I have used below logic through it i am not getting the results. Please help me out. foreach device in network.devicesforeach interface in device.interfaceslet platform = device.platformwhere interface.description=="WAN"select { deviceName: device.name, Location: device.locationName, Tags: device.tagNames, Vendor: platform.vendor, Model: platform.model, interfaceName: interface.name, description: interface.description,operStatus: interface.operStatus,adminStatus: interface.adminStatus,cdpNeighborsCount: length(interface.cdp.neighbors), lldpNeighborsCount: length(interface.lldp.neighbors) }

cariddirSpotter

A little help if possible to do some math

Sorry about the lack of punctuation in the title, I can’t edit after ;-)So I don’t know if this is possible, but maybe someone has an idea.The script below provides the following output:OutputThe goal of the script is to figure out how ‘over provisioned’ we are on a switch. i.e. how many ports have never passed a packet. This is in order to size environments better for future refreshes.So the output provides all the necessary info, but I’m not sure how to get a row to tell me “% Utililized”This would be the total count of the ports in use (last column) divided into the the number of ports that specific switch, that show “0” across the board, and I’ll just take 1 zero and assume the rest are zeros (sometimes they are not, but this is just an estimate anyway). Any ideas are greatly appreicated./*** @intent Branch Counters* @description Branch Counters Interface Status show int counters on Arista & IOS-XE Switches * 1. Check to see what switch ports have had no traffic accross the wir

cariddirSpotter

Use NQE to grab Helper IP's from Interfaces

Apologies - This isn’t a question, and I can’t change it to a conversation -With recent changes in our NAC servers, we needed to check that our ‘ip helper-addresses’ were consistent to our regional standards. This is something we usually did with Python, but here’s a simple script to grab the helpers on each of the interfaces. I got the script working, but had some formatting issues, and thankfully a colleague was able to use some logic to format (@danny,Ramirez) via this statement:let ips = (foreach ip in ServerIP where match.data.IntName == ip.data.IntName select distinct toString(ip.data.helper))Ideally, we would would define the NAC servers per region, and export them as a check, but I haven’t gotten there yet ;-)pattern = ```interface {IntName:string} ip helper-address {helper:ipv4Address}```;foreach device in network.devices// Feel free to trim the scope with a where// where "Branch" in device.tagNames && "Core" in device.tagNames && "C9500" in device.tagNames

cariddirSpotter

OSPF Interface Confguration

Using the same logic in my previous post to grab ip helper addresses, I was thinking what else could I re-use this kind of script to grab, and it was for our OSPF configuration. If you are configuring OSPF type/timers/intervals/cost on interfaces, you can use this script to grab the values on each interface. This will make it easy to set up a violation check for anyone that wants. What would be ideal is if I could group the interfaces per devicehost-XYZ. intf1: Type: DeadInterval: HelloInterval: Load : Cost intf2: Type: DeadInterval: HelloInterval: Load : Cost intf3: Type: DeadInterval: HelloInterval: Load : Costhost-ABC. intf1: Type: DeadInterval: HelloInterval: Load : Cost intf2: Type: DeadInterval: HelloInterval: Load : Cost intf3: Type: DeadInterval: HelloInterval: Load : Cost // standard config// interface {ifaceName:string}// ip ospf network point-to-point// ip ospf dead-interval 20// ip ospf h

RonAvilaRamping Up

NQE example similar to using grep and awk

when going through devices with interface descriptions, for exampledescription “to site x interface gi0/0”;description “to site y interfaace gi0/1”:block pattern is description {desc:string}Since it is a description with multiple words and space delimited, is there a way to get the entire description no matter how many words there are? As the above would only get the first word.similar to the way I would use grep for example:grep '^description' ciscoconfig.txtor if I wanted specific columns or text within lines beginning with description, I would grep and use awk like belowgrep '^description' ciscoconfig.txt | awk '{print $2}'grep '^description' ciscoconfig.txt | awk '{print $2 $4}'grep '^description' ciscoconfig.txt | awk '{print $4 $2}'Etc.can anybody provide an NQE Example, Thanks

ChristopherEmployee

Using the API and NQE together to list interfaces with IP addresses and MAC addresses

The API can be used to perform most functions available in the GUI. To perform complex queries of data in the API, it is necessary to insert an NQE query into the API call, or reference an existing NQE query in the Repository.In this example, we first create an NQE query in the Org Repository called list-interfaces. This NQE query will iterate through each device, interface, and sub-interface and list the IP addresses and MAC addresses for each interface.foreach device in network.devicesforeach interface in device.interfacesforeach subinterface in interface.subinterfaceslet ipv4 = subinterface.ipv4foreach address in ipv4.addressesselect { deviceName: device.name, interfaceName: interface.name, subinterfaceName: subinterface.name, ip: ipSubnet(address.ip, address.prefixLength), macAddress: interface.ethernet.macAddress}The output of the NQE in the GUI looks like this: In order to access this information via the API, you must first commit the query. Then get the Query ID and the Com

AhmedRamping Up

Recursively Match a Pattern

Using NQE to do Configurations Compliance checks require having the proper structure for the searched text pattern.Ex: this will not match eventhough that line exists within the configurations, but it’s not in the root levelPATTERN=```set admintimeout 10```;So, to match this line we have to provide the proper structure, or recusively add an extra level until a match is foundSo, modifing that example to one of the below patterns should workPATTERN1=```config system global set admintimeout 10```;PATTERN2=```{(string)+} set admintimeout 10```;So, in this example it was only 1 level down, so it’s straight forward to fix.But having to work with different patterns with different nesting levels the below code can be used to automatically modify the provided pattern and recursively search all the different levels Beware that there are many limitations due to the actual version of the language.ex: splitting a string is not straight forward, so the pattern has to be provided as a list of strings

AndyLSpotter

Using NQE to capture Licence Information

One of my colleagues told me that some of our devices had licence issues.output from show licence usage shows the issue easily, so custom command is the way to go SOMEDEVICE# show license usageFeature Ins Lic Status Expiry Date Comments Count--------------------------------------------------------------------------------….NXOS_ESSENTIALS_M4 No - Unused - -FC_PORT_ACTIVATION_PKG No 0 Unused -LAN_ENTERPRISE_SERVICES_PKG No - In use Honor Start 70D 15H-------------------------------------------------------------------------------- The key part is to extract the features for the device, and check that the No is present, with In Use also present.This is done via the following function, which determines valid input and detects violation.blockData =```{feature:string} {active:string} {licenceCount:string} {status:string}```;customCommand = "show license usage";getRe

GaryBEmployee

Who wants to play a game? Fizz buzz Challenge

I like to give my team little challenges to exercise their NQE skills. Why don’t you play along this weekend and let’s see all the different ways you can accomplish this goal. Tune in to see some creative ways to solve the FizzBuzz challenge with NQEFizzBuzzThe task is to write a program that prints the numbers from 1 to 100, but with a twist:For multiples of three, print "Fizz" instead of the number. For multiples of five, print "Buzz" instead of the number. For numbers which are multiples of both three and five, print "FizzBuzz" instead of the number.

cariddirSpotter

NQE for Finding Good Configurations & Bad configurations

One of the painful parts of trying to audit configurations, is accounting for the variations in the configuration that differ based on Vendor/Model/OS etc… Additionally, accounting for ‘old’ configurations/mis-configuration across these variations adds an extra (sometimes silent, sometimes not) “WTF” as one attempts to isolate the problems.With initial input from Arica , I wound up writing 2 scripts to find the ‘new’ configuration and one to find the old, then ‘xlookup-ed’ the differences in excel. Not to fun, but it was effective enough. Then I figured, how hard could it be to combine them? It was harder than I though, so I created the shell, and then asked for some help from a colleague (thanks Ahmed).@AricaFN@AhmedKhedr The result of the script produces an easily scanned results for the problems.Model ---- DeviceName ---- GoodConfig --- BadConfig/*** @intent Ensure SNMP Communities are correct* @description 2 columns, one column showing where the "GOOD Strings are, and another colu

AndyLSpotter

Using NQE to Obtain List of Unique Authentication Servers

For the networks I work on there are a lot of different servers, mainly due to environmental conditions such as NAT that are used for the basic management of the devices. This include authentication, snmp-traps, ntp, syslog and so on.The following code allows us to see at a glance all the unique servers ip addresses, along with a reference to each device being used.It’s very easy to list this as individual records, but sometimes it’s nice to consolidate this to show the number of servers, and how many devices are using them. One such use case, may be when moving device from old/demising servers to new servers.This script is a skeleton for Tacacs, it does not deal with the various different command syntax across the various vendors and is just shown as an example. In this case for Cisco.Firstly a function to get the information from each device, namely the authentication server and the device name.getTacacsDeviceEntry(device) = foreach match in patternMatches(device.files.config, `t

AhmedRamping Up

Initializing an Empty List

Hello,With the actual version of NQE not providing direct way to initialise an Empty list ex:let empty_list = []orempty_list = [] A workaround for this is to construct the creation of that list and providing a value with the same data type you need// an empty List<String>FALLBACK =foreach x in [""]where x != ""select x; // an empty list of NumbersFALLBACK_NUMBERS=foreach x in [0]where x != 0select x; Taking this logic further we can create a function that provides us an empty list of whatever generic type. by taking a default value of that type as an input, then comparing against that value The below block contains the full PoC code// an empty List<String>FALLBACK =foreach x in [""]where x != ""select x;// an empty list of NumbersFALLBACK_NUMBERS=foreach x in [0]where x != 0select x;// An empty list of a generic type TemptyListT(default_val)=foreach x in [default_val]where x != default_valselect x;foreach a in [""]let empty_list_of_strings = FALLBACKlet empty_list_of_number

ChristopherEmployee

posted in Product Discussions

Permit-all behavior in path search results: GUI vs API

There is a difference in default behavior for path search results in the GUI vs the API.For example, consider this path search:f(10.100.0.101)(ipv4_dst.190.37.14.120)(tp_dst.80)Notice that in the GUI, the path is blocked on atl-edge-fw01In the API, however, the same search yields a result showing ALL the hops in the path as if the traffic were permitted through all the firewalls. In other words, the path search above entered in the API is similar to the output in the GUI for the search:f(10.100.0.101)(ipv4_dst.190.37.14.120)(tp_dst.80)m(permit_all)Notice that the forwardingOutcome is DELIVERED, while the securityOutcome is Denied. This indicates that if the traffic were permitted through all the firewalls in the path, that the packet would be delivered to the destination.There are two firewalls in the path that have a behavior of “ACL_DENY”{ "srcIpLocationType": "INTERFACE_ATTACHED_SUBNET", "dstIpLocationType": "DNAT", "info": { "paths": [ { "forwardingOutcome": "DELI

1
2
3
4
...
6

Page 1 / 6

Nandhas earned the badge NQE Contributor
AndyLhas earned the badge NQE Contributor
AndyLhas earned the badge Founding Member
GaryBhas earned the badge NQE Contributor
huutho5011has earned the badge Community Champ Award

Show all badges

Powered by Gainsight

Terms of Use Cookie settings

Sign up

Already have an account? Login

Select a login option:

Register / Login Forward Employee Login

Welcome to the Forward Networks Community

Select a login option:

Register / Login Forward Employee Login

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK