Community

I’m not sure if most people check back on the built in configs in the Forward Library, but this one is pretty slick.  Are these part of release notes or anything? I looked in the NQE documentation and didn’t find anything related, but I could be looking in the wrong spot.@queryquery(Operating_Systems: List<OS>, Device_Name_Patterns: List<String>, Config_Pattern: PatternBlocks<{}>) = foreach device in network.devices where isPresent(device.files.config) where length(Operating_Systems) == 0 || device.platform.os in Operating_Systems where length(Device_Name_Patterns) == 0 || max(foreach pattern in Device_Name_Patterns select matches(device.name, pattern)) foreach match in blockMatches(device.files.config, Config_Pattern) select { Device: device.name, OS: device.platform.os, "OS Version": device.platform.osVersion, Model: device.platform.model, Match: match.blocks, Tags: device.tagNames };Regardless, these queri

Hey Folks!I’m looking to find out if anyone has modeled their corporate VPN access - maybe using Synthetic Devices - in such a way that allows you to search for user workflows to determine if they are allowed, and have them properly modeled as coming in through the VPN Firewall instead of at the switch VLAN. We are looking to create intent checks for access through our VPN. Happy NQEing!

In this NQE Video, I am going cover and how to use let and group-by qualifiers.Join me for a look at the two NQE qualifiers, let and group-by.Code examples used in videoforeach device in network.deviceslet deviceName = device.namelet affected_interfaces = (foreach interface in device.interfaces group interface.name as interfaces_name by interface.operStatus as oper_status select { int: interfaces_name, oper: oper_status,})foreach entry in affected_interfacesselect { deviceName: deviceName, interfaceNames: entry.int, operStatus: entry.oper}LetUsing let to assign expressions that make the code more easily readable, in this case assigning the device OS version and operating system to variables and filtering on them foreach device in network.deviceslet version = device.platform.osVersionlet os = device.platform.oswhere os == OS.ARISTA_EOS && matches(version, "4.15*")select { deviceName: device.name, version: version, os: os}Grou

I am working on automated resolution of failed connections.   Two questions: (1) On this page in the documentation: /docs/nqe/data-model/type_devicecollectionerror/  there is a list of errors but no descriptions.  Can someone provide? (2) I am studying a failure report and the Connect Test Status notes each of these in PHASEs which seems to imply that each is determined in a sequence.  Is there a list of PHASE order for these? AUTHENTICATION_FAILED-AUTHENTICATION PHASEAUTHORIZATION_FAILED-AUTHORIZATION PHASECONNECTION_FAILED-CONNECTION PHASEDEVICE_IS_CHILD_CONTEXT-SETUP PHASEDEVICE_TYPE_MISMATCH-TYPE_DISCOVERY PHASEDEVICE_TYPE_UNDETECTED-TYPE_DISCOVERY PHASEGUEST_MISSING_HOST_RESULTS-SETUP PHASEJUMP_SERVER_AUTHENTICATION_FAILED-CONNECTION PHASEJUMP_SERVER_CONNECTION_FAILED-CONNECTION PHASEOTHER-AUTHORIZATION PHASEPING_FAILED-CONNECTION PHASEPORT_REACHABILITY_FAILED-CONNECTION PHASEPRIV_PASSWORD_ERROR-SETUP PHASEPROMPT_DISCOVERY_FAILED-SETUP PHASESESSION_CLOSED-TYPE_DISCOVERY PHASETIMED

The MTU query that comes canned in Forward Networks was pretty cool. However, I just wanted the MTU info on links that contained an LLDP or CDP neighbor entry, b/c I just don’t care about the MTU of of access devices, just the infrastructure links.I tried to also modify to not pull MTU on Mgmt Interfaces (ma1, MA1, mgmt0)  However, I’m still pulling some ‘ma1’ interfaces! Oh well .I just sort it out later, but if anyone sees the issue, chime in./** * @intent Return the MTU of interfaces that contain a CDP or LLDP neighbor * @description rcariddi 6/30/2023 Find All links of CDP/LLDP, make sure each side of the link matches. This allows us to ignore non infrastructure links * If we want all values, remove the line: where isPresent(interface1.cdp) || isPresent(interface1.lldp) **/foreach device1 in network.devicesforeach interface1 in device1.interfaceswhere isPresent(interface1.mtu)where isPresent(interface1.cdp) || isPresent(interface1.lldp)where toLowerCase(interface1.name) not in ["m

I hope everyone had a relaxing holiday and New Year!Now that we are getting back into the swing of things, do you suspect there are rogue devices in your network, but you have no easy way to find them?  I remembered what I had to do back in the day to find rogue devices, and needless to say, it was not easy to find them.  Could Forward Networks help Mike find these rogue devices?  I had the same question, and I enlisted the help of our resident NQE expert, Jack Shen, to see if we could identify and locate where these unwanted devices are easily.  Code example used in the demoThe NQE query that was used in the video to find if there were any Huawei devices in their network is below. foreach device in network.devicesforeach host in device.hostswhere isPresent(host.macAddress)let assigneeName = ouiAssignee(host.macAddress)where isPresent(assigneeName)let vendor = toUpperCase(assigneeName)select { violation: matches(vendor, "HUAWEI*"), deviceName: device.name, deviceInterfaces: host.int

In todays NQE Video, I will show you the basics of using if expressions and how to use them when you want to create your own multi-vendor parser.Code examples used in videoThis particular parser is going to look at DNS servers and check to make sure that they are configured with the appropriate servers.dns_addresses = [ipAddress("1.1.1.1"), ipAddress("1.0.0.1")];ios_xe = ```ip name-server {dns:ipv4Address+}```;arista = ```ip name-server vrf {string} {dns:ipv4Address+}```;palo_alto = ```config devices localhost.localdomain deviceconfig system dns-setting servers primary {dns:ipv4Address+} ```;cisco_asa = ```dns server-group {string} name-server {dns:ipv4Address+}```;generic = ```dns {dns:ipv4Address+}```;foreach device in network.deviceslet os = device.platform.oslet dns_pattern = if os == OS.PAN_OS then palo_alto else if os == OS.IOS_XE then ios_xe else if os == OS.ARISTA_EOS then arista else if os == OS.ASA then cisco_as

In today's video I will introduce the NQE foreach and where statements. We explore the data model and how to start off your NQE queries as well as go into when and why you would want to use a where statement.Code examples used in videoReturn all IPsec tunnels and create a report of the peer IP address, interface status and operational statusforeach device in network.devicesforeach interface in device.interfaceswhere interface.interfaceType == IfaceType.IF_TUNNEL_IPSECselect { deviceName: device.name, tunnelName: interface.name, peerIP: interface.tunnel.dst, adminStatus: interface.adminStatus, operStatus: interface.operStatus}You could modify the above to violate if the administrative status is up but the operational status not up with the following NQE query:foreach device in network.devicesforeach interface in device.interfaceswhere interface.interfaceType == IfaceType.IF_TUNNEL_IPSECselect { deviceName: device.name, tunnelName: interface.name, peerIP: interface.tunnel.dst, v

 Join Mike on a journey to introduce a feature of the Forward Enterprise platform called the Network Query Engine (A.K.A NQE) and why it will make your job as a network or security operator much easier.   Let us know what you think about NQE; what do you see yourself using it for?  If you have any questions ask them below 👇🏻 Code example used in videoReturn a violation if an interface on a Cisco IOS XE device is administratively up but operationally downforeach device in network.devicesforeach interface in device.interfaceswhere device.platform.os == OS.IOS_XEselect { deviceName: device.name, interfaceName: interface.name, adminStatus: interface.adminStatus, operStatus: interface.operStatus, violation: interface.adminStatus == AdminStatus.UP && interface.operStatus != OperStatus.UP} 

Join me for a look at the comparisons you can use in NQE to filter out on what data you need to see in your query. Code examples used in videoUsing equals (==) to return any default routes in any VRF foreach device in network.devicesforeach networkInstance in device.networkInstanceslet afts = networkInstance.aftslet ipv4Unicast = afts.ipv4Unicastforeach ipEntry in ipv4Unicast.ipEntrieswhere ipEntry.prefix == ipSubnet("0.0.0.0/0")foreach nh in ipEntry.nextHopswhere isPresent(nh.ipAddress)select { deviceName: device.name, vrfName: networkInstance.name, RouteEntry: ipEntry.prefix, nextHop: nh.ipAddress}Using not equal to (!=), to exclude ASA’s a platform inventory reportforeach device in network.deviceswhere device.platform.model != "ASAv"select { deviceName: device.name, deviceModel: device.platform.model }Choose whether or not to report on interface MTU that is:Greater than 1500 ( > ) Greater than or equal to 1500 ( >= ) Less than 1500 ( < ) Less than or equal to 1500

In cloud environments, the complexity of network architecture, especially with the prevalent use of NAT (Network Address Translation), often obscures visibility, making the detection of duplicate subnets a challenging task. This lack of transparency can lead to network inefficiencies, conflicts, and potential security risks. The NQE query I'm sharing specifically addresses this challenge, offering a streamlined approach to uncover hidden duplicate subnets, a crucial step in maintaining a robust and efficient cloud network. To tackle the issue of detecting overlapping IPv4 CIDR blocks across different VPCs in cloud environments, I've developed a precise NQE (Network Query Engine) query. This query methodically scans through all cloud accounts and their respective VPCs, identifying any instances where IPv4 CIDR blocks overlap. The query is designed to compare each VPC within a cloud account against others, ensuring comprehensive coverage and accurate detection of duplications. Below is t

At Forward Networks, ensuring a seamless and efficient support experience for our users is our top priority. Our revamped Support Portal is designed to make getting the help you need both straightforward and swift. Here’s how you can navigate our user-friendly platform:Creating a Support Account Submitting a Support Request Tracking Your Support RequestsCreating a Support AccountAccess the Portal: Visit our Support Portal at https://support.forwardnetworks.com.Log In or Register:Already a Community Member? Use your community credentials to sign in.New Users: Registration is a breeze! Just follow these simple steps: Click on ‘Sign Up’. Enter your email and choose a password. Verify your email by clicking the link sent to your inbox. Set up Two-Factor Authentication (2FA) with your preferred TOTP app for added security. Submitting a Support RequestOnce logged in, you’re all set to submit a support request. Here’s how to ensure your request is handled efficiently:Determine the Urgency: Se

Join me on an introduction to working with Lists in NQE. We cover some of the basic list comparisons and the list function length().Code examples used in videoReturn all Arista devices, and if the device is not running the approved OS, return a violation for that deviceapproved_os = ["4.15.0F"];foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSselect { violation: device.platform.osVersion not in approved_os, name: device.name, version: device.platform.osVersion} There is another way to write this query. We can write it so that it will only return all devices that are violating versus returning every device and violating the devices that are not compliant. This query would look like:approved_os = ["4.15.0F"]foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSwhere device.platform.osVersion not in approved_osselect {violation: truename: device.name, version: device.platform.osVersion} We are using where only to filter devices that are run

Hi!  Looking for help with an NQE to scan/identify configuration for all Cisco switches within a workspace that contain one of two QOS policy maps within at least one of the device interfaces. For example interface gigabitethernet1/1 service-policy output 1P7Q3T orservice-policy output 1P7Q1T Thanks        

In todays video, we are going to look at the basics of working with numbers and booleans in NQE.  Code examples used in videoCheck to make sure that the distribution switches that run spanning-tree in a newly acquired DC are running the correct root bridge priority, if not show a violation rbPri = 5297;foreach device in network.devicesforeach stpRoot in device.stp.rapidPvst.vlanswhere matches(device.name, "sjc*dist*")select { violation: rbPri != stpRoot.bridgePriority, device: device.name, vlanID: stpRoot.vlanId }Any questions or comments, post them in the comments below 👇🏻

 Forward’s own Matt Honea (@matthonea), Head of Security and Compliance, and Mike Lossmann (@Mike), Technical Product Marketing Manager recently presented at Security Field Day 10 (XFD10).Matt and Mike bring diverse experience in cybersecurity and networking infrastructure to these presentations from XFD10. Learn as Matt dissects today’s threats, how they’re delivered, and how to protect your organization from similar attacks. Mike provides a demonstration of the Forward Networks Enterprise application, specifically highlighting how it can safeguard your organization’s network and, in turn, your organization’s valuable intellectual property.   Do you have questions or want to learn more? Ask below!  The Game Changer - Network Digital Twin for Network Security with Forward Networks Matt and Mike discuss reasons why are so many network security breaches are hitting hitting the headlines lately Matt Honea guides you through the latest news-worthy exploitations of network vulnerabilities a

Background on the Jump Server for FWD Enterprise Forward Enterprise obtains data for path analysis primarily using industry-standard command-line interface (CLI) access. This is typically done with secure shell (SSH) read-only credentials provided to the platform so that configuration and state can be retrieved. In certain customer instances, it is required to limit SSH access to a specific host or hosts, which will more effectively audit and maintain the security of network devices. This is commonly known as the bastion or jump server. A jump server, jump host, or jump box is a computer on a network used to access and manage devices in a separate security zone. The most common example is managing a host in a DMZ from trusted networks or computers. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. User access should be tightly controlled and monitored OpenSSH is commonly used for configurati

In todays video, we are going to go into a deeper dive on the NQE files tab. We discuss the different states the NQE queries can be in and go over the permission structure in NQE. Any questions or comments, feel free to post them below

I am trying to get the BGP advertised and received prefixes for Arista EOS and Cisco NXOA devices. I tried the below two queries and they only work for IOS and IOS-XE. devicesBGP Received routes ----------------------------------------------------------foreach device in network.devices// where device.name == "jcdwans01"where isPresent(device.bgpRib)let bgpRib = device.bgpRibforeach afiSafi in bgpRib.afiSafisforeach neighbor in afiSafi.neighborswhere isPresent(neighbor.adjRibInPost)let adjRibInPost = neighbor.adjRibInPostselect {  deviceName: device.name,  platform: device.platform.os,  afiSafiAfiSafiName: afiSafi.afiSafiName,  neighborNeighborAddress: neighbor.neighborAddress,  routesCount: length(adjRibInPost.routes)}BGP advertised routes -foreach device in network.deviceswhere isPresent(device.bgpRib)let bgpRib = device.bgpRibforeach afiSafi in bgpRib.afiSafisforeach neighbor in afiSafi.neighborswhere isPresent(neighbor.adjRibOutPost)let adjRibOutPost = neighbor.adjRibOutPostforeach

This is both incredibly amazing and absolutely frightening. The cat is extremely out of the bag now.Boston Dynamics put a generative AI into the robot dog Spot. And there are different personalities.  

If you are in/near the Atlanta area on Nov 14, please join me at this Optm event where I will presenting with other executives from Optm, Infoblox, BigPanda, and LogicMonitor.  I’d love to connect in person, and happy to have additional conversations. Event Registration

We had a fun costume contest for Forward employees and their fur babies. Here are the winners!Our co-founder, Peyman, won Best Costume!Our infra engineer, Manuel, won Most Original Costume!Our apps engineering manager, Gayathri, won Scariest Costume!Gayathri’s dog, Nash, won Best Pet Costume!What do you think of the costumes? Do you have any fun ones to share of your own? 🎃

You can now attach EC2 interfaces to multiple different VPCs in AWS: https://aws.amazon.com/about-aws/whats-new/2023/10/multi-vpc-eni-attachments/ The implications of this are pretty huge - previously to control access (with a firewall, etc) between VPCs you needed to use a Transit Gateway, generally associated with a centralized applicance via a Gateway load balancer.  This solution is great and scales very well, but its probably overkill for smaller environments. What if you only have 2-4 VPCs?  This solution would work great - simple attach your NVA interfaces to different VPCs and modify your route tables accordingly.  This eliminates the cost and complexity of TGWs, keeping all the performance benefits. What use cases can you see for this new functionality?  Off the top of my head, you could also provide remote access without using a VPN gateway too.  I’m sure there are more. This also models correctly out of the box in Forward as well :)

WHO DARES TO INVESTIGATE THE DARK PRESENCE WITHIN THE NETWORK DURING AN AUDIT? Network modeling illuminates the dark corners of your network, so you don't have to be scared anymore. No boogeyman can derail your network audit because the 'digital twin' models all of your network devices, even the cloud, with mathematically-accurate precision. It’s the single-source of truth trusted by the world's largest networks. It’s not dark magic — it's Forward Enterprise. 

Is it possible to use a SSH jump server to log into a Telnet server, and then from there log into each of the devices?