Product Updates
Events
Support
FWD.app

Home
Discussions
Community

Community

Connect with others to answer questions, gain new insights, and grow your networking knowledge.

110 Topics

Recently active

Most replies Most views Newest first

AndyLRamping Up

Using NQE to validate uplink on ACI Fabrics

Problem StatementOur company had issues where some network leafs were not connected to all our spines within an ACI fabric.Traditional methods to validate this were time consuming so we developed a basic NQE query to assist.How it workswe leverage the LLDP information for the network leaves and match this to our spines. In our case, we rely on the device naming convention to match LLDP entries to spines. Our spines have SP within the name.NQE ScriptFunction to gather the links to spines for a given device/* * function: countSpineNeighbours * * parameters: device: Device * * purpose * ------- * * count the number of links that are between the spines and the leafs * * spines are matched based on the SP in the device name, at position 8 * * returns: dict * * { * deviceName: string * interfaceName: string * } */countSpineNeighbours(device) = foreach interface in device.interfaces where interface.interfaceType == IfaceType.IF_ETHERNET foreach n in interface.lldp.neighbors where

daveteeCommunity Manager

published in The Paddock 💬 👋

Community Roundup - Thursday, May 16, 2024

Happy Thursday All! I hope you’re having a great week. I know it’s been a busy one so I’ve highlighted this week’s most popular articles and discussions in the community. Did I miss one of your favorites? Add it in the comments below! Here’s the list... @AricaFN ‘s article on extracting data from custom commands is a great discussion for anyone that has to go beyond the data model to tailor the Forward platform to their organization’s specific needs. @Christopher is on fire (hehe) with this new NQE query that uses the Forward Enterprise aclEntry object to provide consistent output from any Firewall vendor. And if you’re interested in automation, @Christopher’s article on interfacing with Forward with API and Python is a great example to follow. @Mike ‘s complete NQE tutorial video series is the go to for anyone learning NQE or experts brushing up on the finer points. Building on @cariddir‘s scripts, @RobertWelch create this plug-and-play NQE to unify the Fortinet Version output for

ChristopherEmployee

posted in Product Discussions

Deleting links from the Topology view. Where do they go?

If you click on a link in the Topology view, you will have the option to Remove the link. Be Careful! This operation doesn’t just apply to the Topology view. It also removes the link from the model. This will necessitate the application reprocessing the snapshot, and path searches will no longer include paths through the deleted link!If you delete a link by mistake. It can be added back. You can see a list of manually added and deleted links by using the API call /api/snapshots/{snapshotId}/topology/overrides from the https://fwd.app/api-doc page:You can undo the deletion of a link by using the /api/snapshots/{snapshotId}/topology/overrides API call.The format to add back the port that was removed above (ie, to delete the entry for the removal) would be:(Note that having to enter the fields you aren’t changing with empty brackets [ ] won’t be required on version 24.5 or higher)

ChristopherEmployee

Auditing firewall rules with NQE

You can use NQE to examine the firewall rules in all firewalls in a network. However, you will need to use a different approach depending on what you want to audit in your security rules.Forward Enterprise collects and parses the ACLs and security rules from all devices: firewalls, routers, switches, and so on. The data is then parsed and normalized. This data is stored in a database in a custom format that allows the Forward application to perform path analysis.The following NQE query uses the Forward Enterprise aclEntry object to provide consistent output from any vendor Firewall. Note that the scope of device types in the output is limited by using the where statement and filtering to DeviceType.FIREWALL.This query will work for every ACL/security rule on any Firewall in the network. However, because the query is working on normalized data, each security rule in a firewall may be broken up into multiple aclEntry objects. The results of this query may therefore have multiple lines wi

RobertWelchEmployee

Fortinet VPN Status NQE with Violation

How do you add a violation to alert you when a Fortinet VPN is down? (After a Snapshot is processed, that is). Or, how does one quickly check the VPN status for a particular Snapshot to compare state? How about simply verifying that the proper TCP port is being used for the VPN tunnel? (You know what the answer is already… It’s NQE, of course).The purpose of this NQE for Fortinet VPN tunnels is:Show the status of all VPN tunnels. Add a Violation that can be added to the NQE Verifications. Provide a searchable and sortable report for all VPN tunnels.This NQE leverages the Fortinet “get vpn ipsec tunnel summary” command that is run during Collection. See the prior example for finding the commandType and whether the command is already in the Forward Networks collection, or whether a custom command should be created. /** * @intent Fortinet VPN Status * @description Enumerate the output of "get vpn ipsec tunnel summary" for all Fortinet devices. * When the selectors(total,up): 1/0, this

devecisEmployee

published in NQE

Video: Optimizing NQE Queries for Success

Sean Deveci, Federal Systems EngineerAndreas Voellmy, Sr. Director of Engineering Join me, @devecis, and @Andreas as we show you how to upgrade your NQEs, making them easier to troubleshoot, more scalable, and more resilient. These techniques are not only great for NQE, but will also up improve your Python and Javascript. Work side-by-side with us as we show you how to:Improve the results of your scripts to maximize the end-user experience. Streamline your scripts so they're easier to read, manage and share. Make your scripts more resilient so they can keep up with your changing environment. Ask questions below and let us know what you'd like to see in future demos!

ChristopherEmployee

posted in Product Discussions

How to use workspace networks to test custom commands

Some customers have asked, “How do I run a custom command on just a few devices, to test if it gives me what I need for an NQE query?” You can do this with a workspace network!First, click the Network drop down and choose Add Workspace network Add a name for your Workspace and click Next. Add the device or devices you want to test the custom command(s) on and click Add X devices. Then Next. Check the custom command group you want to include in the Workspace and click Next and Done. You can also skip this step and add the custom command in the workspace later. Make sure you are in the new Workspace network in the Network selection drop-down. Go to Settings > Collection Settings > Custom commands and enable the Custom command group.(You can also add a new custom command from this page by editing the command group or adding a new one.) Return to the main page by clicking Search, and then choose Take Snapshot from the snapshot drop-down. This will collect the data using your cust

ChristopherEmployee

posted in Product Discussions

How to get a list of devices using the API and Python.

The same data that can be found in the Forward Enterprise GUI can also be accessed via the API. Here is an example to pull a JSON formatted list of all the devices in a Network using the API and Python.Start by generating an API key from Settings > Account API Tokens. You will have to re-enter your password. Write down the API password. It will not be shown again! Go to the API docs (https://fwd.app/api-doc) If you have an on-prem deployment of Forward Networks, the domain name in the URL will be specific to your company. Enter the API Access Key and Secret Key that you created.Go to the Network Devices section of the same page (https://fwd.app/api-doc#network-devices)Click Try it out. Note that this button will only work if you have already entered your API credentials. Enter the Network ID that you want to pull a list of devices from. (This is the number in the URL when you are in the App on the search tab: fwd.app/?/settings/account?networkId=12346&snapshotId=91011)Click Exe

AricaFNEmployee

A Basic Guide to Extracting Data From Custom Commands

The Forward Networks data model has an extensive collection of normalized vendor agnostic data for each of your devices. There are times though, when you may need a piece of information about a device that you can’t seem to find within the data model, or you need to pull information from a configuration that is not part of the running config or standard collection. This is where custom commands come in. Forward Networks allows you to add additional show commands to each snapshot to tailor the platform to your organization’s specific needs. Knowing how to pull information out of these files gives you flexibility to extract what you need to answer urgent questions, taking your data management to the next level. The basic formula that will get you started foreach device in network.devicesforeach command in device.outputs.commandswhere command.commandText == "<YOUR COMMAND HERE>"let parsed_response = parseConfigBlocks(device.platform.os, command.response)let my_data = blockMatches(pa

RobertWelchEmployee

Create a Consistent Report Across Multiple Fortinet Devices and Versions

Keeping your systems up-to-date with the current operating system versions is hard enough. Firewall vendors, with IPS, URL filtering, and now AI/ML functionality adds a bit more complexity of ensuring that all the policy enforcement points are consistent and up to date. The purpose of this NQE is to unify the Fortinet Version output for comparison and inventory analysis. Version consistency, license consistency, and uptime is easily observed in this tabular NQE report. Building upon @cariddir examples of using device specific commands, or adding Custom commands, this NQE uses techniques shown in his posts.The example of using device specific commands shown in the prior examples is powerful to extend the functionality of NQE. As well as to pull reports that may be tedious to process if performed manually. Since this information is already available in the Forward Networks platform, why not use the platform to data mine the insights desired.The output of Fortinet’s Version contains m

ChristopherEmployee

How do find the serial number of a device in NQE or Inventory+?

Forward Networks includes serial numbers in its model as part of the component object. So if you want to see the serial number for a device, you must iterate through the components of that device. The serial number for the device itself usually belongs to the chassis, but some vendors may have multiple controller cards. The serial numbers for line cards, power supplies, etc will also be listed as components with serial numbers.There is a build-in NQE query in the Forward Library called Device Hardware that is included in Inventory+ by default. If it has been deleted from Inventory+, you can add it back by clicking on Inventory+ > Add NQE Queries and then selecting the Device Hardware NQE and clicking add and then Add.Note the foreach component in platform.components loop and the component.serialNumber entry in the NQE query code below:/** * @intent Information about device hardware */foreach device in network.deviceslet platform = device.platformforeach component in platform.compone

RobertWelchEmployee

Fortinet Interface Configuration and Verification Method

How do you quickly verify that only specific Fortinet interfaces are configured for ssh, or ping, or fgfm (FortiGate to FortiManager Protocol)? Or, how can you quickly report on which interfaces are in which VDOM (Virtual Domain) or VRF (Virtual Routing and Forwarding)? (You know what the answer is already… It’s NQE, of course). The purpose of this NQE example is to showcase the use of:Customer Commands - In this case, Fortinet “show system interface”. Using the blockMatches() NQE function to match variable blocks. Using an if, else loop to iterate through variable block values. Use the tabular output report to search / filter across all of the Fortinet devices.Building upon @cariddir examples of using device specific commands and adding Custom Commands, this NQE uses techniques shown in his post.Additionally, leveraging @Mike’s if Expression tutorial to iterate through the variable Fortinet interface “set” values. Fortinet interface configuration options are extensive per the Forti

ShivangKRamping Up

NQE Query to get SSL profiles from Custom Commands on F5

I am trying to create a NQE query for all the F5 devices. The query searches for SSL profile on custom command. Custom Command is : show ltm virtual detail recursive | grep -E "Ltm::ClientSSL Profile:" -E "Virtual Server:"The NQE should return SSL Profiles and the VIPs associated with them.

cariddirSpotter

Switch Port Activity

This is a script to pull switch port stats from our access switches in our network. The data pulled in this script is used for ‘right sizing’ and network planning. We can then export the results, and pivot table them to see the % of switch ports in use/not-in use. I’ll add this attachment later./*** @intent Show int counters on Arista & IOS-XE Switches * @description * 1. Check to see what switch ports have had no traffic accross the wire for sizing and planning. * 2. Match on platform.os* 3. Use the information from the custom command 'show int counters'.* 4. Get counts of switch ports on that device so we can use to calculate % in use**/// Pattern of output// Arista & Cisco Same ColumnsTraffic = ```{Port:string} {InOctets:number} {InUcastPkts:number} {InMcastPkts:number} {InBcastPkts:number}```;// Arista FunctionEOS_Stats = foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSforeach command in device.outputs.commandswhere command.commandText == "sh int

chrisnaishEmployee

AWS - NQE Query to track Public IP usage

AWS - Public IPv4 charge changes Back on Jul 28, 2023, AWS announced forthcoming changes to their billing for IPv4 public IP usage, which take effect as of Feb 1, 2024. In summary, AWS says, "Effective February 1, 2024, there will be a charge of $0.005 per IP per hour for all public IPv4 addresses, whether attached to a service or not (there is already a charge for public IPv4 addresses you allocate in your account but don’t attach to an EC2 instance).". More information can be viewed here: https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/. Update Apr. 2, 2024: In light of this, Forward Networks can assist with keeping track of your Public IP usage via an improved NQE Query located in “NQE->Library->Forward Library->Cloud->AWS->Public IPv4 Cloud Cost” that will show you what's being used: /** * @intent Shows the number and cost of AWS public IPv4 IP addresses */import "L3/IpAddressUtils";// $0.005 per hour per IPcostPerIpPerDay = 24.

SteffiRamping Up

NQE query to filter CVEs with CRITICAL Severity

Hi,I wrote an NQE query which is expected to return devices with CRITICAL severity only. The query returns almost a million results which is unlikely. Each device has so many rows with CRITICAL CVEs. foreach cveDatabase in [network.cveDatabase]foreach cve in cveDatabase.cvesforeach device in network.deviceslet platform = device.platformlet Severity = Severity.CRITICALselect { "Device Name": device.name, "CVE ID": cve.cveId, "Severity": Severity.CRITICAL, "Vendor": platform.vendor, "Model": platform.model}

Tyson HenrieEmployee

match two lines with different amounts of output

I have a problem where the two lines of this module output are not the same. How can I put in essentially null place holders so that they resultant patterns are the "same"?example outputNotice that module 2 does not have Fw or Sw.Mod MAC addresses Hw Fw Sw Status 1 a03d.6f81.0740 to a03d.6f81.074f 1.1 15.0(1r)SG12 03.07.03.E Ok 2 b0aa.777d.d010 to b0aa.777d.d017 1.0 Ok I was trying to use these two patterns and tried to put in placeholds of Fw and Sw at the end of "pattern03". But the NQE does not like this.pattern02 = ```Mod MAC addresses {modNum:number} {string} to {string} {hwVer:string} {fwVer:string} {swVer:string} {modStatus:string}```;pattern03 = ```Mod MAC addresses {modNum:number} {string} to {string} {hwVer:string} {modStatus:string} {fwVer: null:string} {swVer: null:string}```;getMacAddrList(parsedOutput) = foreach pattern in [pattern02, pattern03] foreach match in blockMatches

imageryanRamping Up

Retrieval of Cisco Firepower device information

We have started to do some testing with FN. In our AWS network, we are using Cisco Firepower Threat Defense (FTD) devices managed by Firepower Management Console (FMC). FN is able to connect to an FTD and retrieve device details but does not support retrieval from FMC.In our network, for complicated routing reasons, we can’t easily enable FN to connect to our FTD instances. I can, however, provide a URL that will retrieve all the information from FMC. I would like to configure an “HTTP(S) external source” to provide that info. What I cannot figure out, however, is the required format for the data to that is returned by the URL GET. The document just states that FN will “infer” the schema. In my case, there’s no inference needed. I am writing the code that will return the info. I can format the data however FN needs it.For those who care about the details, the implementation is an AWS Lambda function that connects to the FMC REST API and returns the info. An AWS API gateway provides the

huutho5011Ramping Up

asked in Product Discussions

Error during SNOW integration

Hi all, We are getting “No processed Snapshot found. Please take a Snapshot and try again.” when trying to hook Forward Network with SNOW CMDB, anyone has any idea why this happen ? ( We do have snapshots already taken and processed) Thank you

published in The Paddock 💬 👋

Incident Management: A Proactive Approach to Minimize Disruption

Incident Management: A Proactive Approach to Minimize Disruption Experiencing an incident can be chaotic, with alarms sounding off and urgent communications flooding in, often at the least opportune moments. The key to effective incident management is not just to respond with urgency but to anticipate and mitigate issues before they escalate. The TL;DRTo effectively manage incidents, you must first establish visibility across and baselines of your network. Know what’s normal and what’s not. Ensure robust logs are being collected in a centralized manner, and contain all relevant details to facilitate troubleshooting. Develop your response team. Know their strengths and weaknesses, and ensure everyone on the team has skin in the game. publish playbooks, runbooks, and other procedural documents so everyone knows what is expected of them during an incident. Foster relationships with your peers and other teams long before an incident ever begins. And always strive to improve your incident m

daveteeCommunity Manager

posted in Videos

(Demo) Unlock network insights with Forward Networks and generative A.I.

No time! Skip to the demo. @nikhilhandigol demonstrates how generative A.I. unlocks network insights and shows the Tech Field Day delegates how Forward Networks seamlessly incorporates generative A.I. into its network digital twin software. Inside the most popular product feature, Network Query Engine, every user can perform natural language queries to access crucial network data in seconds. You can watch the entire Tech Field Day here. Got questions? Ask below!

daveteeCommunity Manager

posted in Videos

(Demo) Unlocking Network, Security, and Reliability with a Forward Networks Digital Twin

Every network engineer can associate with 7:58 In this introduction, @Mike explains Forward Network's digital twin software, Forward Enterprise, and how network digital twin benefits more than just networking people. Forward Enterprise analyzes every possible network behavior, traces where every packet could ever go, and gives every user a queryable vendor-independent data model so NetOps, SecOps, CloudOps and even Compliance teams can get a mathematically-accurate view of the network.Check out the entire Network Field Day series here

cariddirSpotter

Arista Field Notice - Aboot Version report

This is a simple NQE to run a custom command to report on the ABOOT Version and Platform of Arista Devices. From Arista:In a small set of cases systems may experience an unexpected reboot. The reload is due to an uncorrectable ECC error caused by a corner case timing conflict on the CPU sub-system tracked by bugID 419257. This bug affects the range of CPU models present in these products. The affected systems are not restricted by specific serial numbers or date code ranges and the reload is unpredictable. Systems running Aboot6 BIOS revision lower than 6.1.7 or 6.0.9 and Aboot4 BIOS revision lower than 4.1.1 or 4.0.7 are susceptible to this issue. There are currently 4 release trains of Aboot across these systems: 4.0.x and 4.1.x, 6.0.x, and 6.1.x. A single common patch file will introduce the update across all release trains and is not platform or version-specific----------------------------------------------------------------------------------------------------------The custom Comma

SteffiRamping Up

check all network non-server-facing interfaces that are down.

foreach d in network.devicesforeach i in d.interfaceswhere length(i.links) != 0where i.adminStatus == AdminStatus.DOWNselect {deviceName:d.name, interface:i.name}

daveteeCommunity Manager

posted in The Paddock 💬 👋

Podcast - Understanding Where Digital Twins Fit in Today’s Tech Stack with Craig Johnson

Launch Podcast Join Craig Johnson (@captainpacket) and William Collins as they discuss the power of community, and then dig into the growth and adoption of Digital Twins and where they fit in today’s tech stack. Topics covered include:The Concept of Digital Twins in Networking: Drawing parallels to other industries like manufacturing. Craig explains that a digital twin is a digital representation of a real-world network, allowing for easier troubleshooting, visualization, and understanding of network components and configurations. Evolution of Digital Twin with Cloud and Automation: Craig discusses the evolution of digital twin solutions, particularly in the context of cloud and automation. The conversation highlights the importance of extending digital twin capabilities to multi-cloud environments and standardizing network forwarding logic across vendors. Core Technical Components and Implementation: Craig outlines the technical components required for implementing a digital twin, fo

1
2
3
4
5

Page 1 / 5

huutho5011has earned the badge Community Champ Award
AricaFNhas earned the badge Community Champ Award
rrogers33has earned the badge Founding Member
Si_Pricehas earned the badge Founding Member
NQEwizardhas earned the badge Founding Member

Show all badges

Powered by Gainsight

Terms of Use Cookie settings

Sign up

Already have an account? Login

Select a login option:

Register / Login Forward Employee Login

Welcome to the Forward Networks Community

Select a login option:

Register / Login Forward Employee Login

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK