- - Forward Knowledge Base
Product Updates
FWD.app

Home
Discussions
Community

Community

Connect with others to answer questions, gain new insights, and grow your networking knowledge.

189 Topics

Recently active

Most replies Most views Newest first

dakotaglorySpotter

asked in NQE

Convert MicroSeconds in NQE

A custom source API call returns a date field in microseconds format. Does NQE have a built in function to convert? For example, 1725899407, to Sept. 9, 2024. Currently I don’t need the hours and minutes but in the future it may be necessary. I’ve searched “date” and “microseconds” in the documentation and online without success.

dakotaglorySpotter

Borrowing a capture of the Results window from another post on this site for reference, is it possible to filter for values that are not present?For example, instead of “cisco” could I return records that are !=cisco. I understand I have the options to write it in the NQE or export into Excel and filter as a spreadsheet but it would be useful to have the ability to filter other comparison operators on the fly in the Results window.

332

2 months ago

pjptsujitRamping Up

asked in NQE

How can I convert a Number to a String ?

Is there a command equivalent to str(X) in Forward Networks?

321

2 months ago

pjptsujitRamping Up

asked in NQE

Can user defined functions return a Number?

For a user defined function as follows, can it be used to return a number or does it only return a Bool value? threshold : Number = 100;hasManySubInterfaces(iface) : Bool = length(iface.subinterfaces) > threshold; Say something like the following, is that possible? threshold : Number = 100;hasManySubInterfaces(iface) : Number= length(iface.subinterfaces) + threshold;

202

2 months ago

AndyLSpotter

asked in NQE

Order the results in NQE

Is there any way to order the results in the NQE output ? E.g. order by field A then field B This would be within the query rather than once the results are shown in the table below the query itself.

291

2 months ago

gbaronSpotter

asked in Product Discussions

SSO Error

We were finally able to configure and get SSO online and operational this past week in our Dev environment, and pushed it in to the production world yesterday. After running fine for about 10-12 hours, we came in this morning to the following error: SAML validation failed. Invalid assertion [insert a bunch of random letters and numbers] for SAML response [insert more random letters and numbers]: Assertion IssueInstant was invalid, expiredContact your Org Admin to resolve the issue. I check with the in group that manages SSO and they claim nothing has changed on their end, so now I must ask: How do we get past this so I can turn SSO back on? P.S. we are on base 11 app version 24.8 (rolling to 24.9 in a couple hours)

612

2 months ago

dakotaglorySpotter

posted in Product Discussions

Unable to snapshot; no sources configured when only custom source enabled

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

272

2 months ago

dakotaglorySpotter

posted in Product Discussions

Bulk edit for custom sources

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location. I also noticed when editing custom source that I had to update in phases. I imported csv of devices. I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

251

2 months ago

kevinbrasherCommunity Manager

posted in Product Discussions

Community Highlight: AI Assist for NQE

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that into a valid query. How to Use AI AssistUsing AI Assist is easy. Just follow these steps:Log in to Forward Enterprise. Navigate to the NQE Library. Open the query editor by adding a new query. Click the AI Assist button. In the Generate tab, type your natural la

220

2 months ago

NandSpotter

asked in NQE

Nqe query for BGP Admin status id down

Hi All, Can you please help me to write a NQE query for all ip details where BGP Admin status id is showing down.

363

2 months ago

dakotaglorySpotter

asked in NQE

Parse externalSource HttpEndPoint API ResponseBody

Custom source profile with Endpoint that is using “url/path?_return_type=json-pretty” but responseBody is one long line.I attempt to use splitJsonObjects; however, it isn’t returning in a structured layout for me to pattern match.

794

2 months ago

RobertWelchEmployee

posted in Top NQEs

CDP to the Rescue! AKA Search for Duplicate Hostnames and Management IPs with CDP

File this under “ya I’ll never do that again”. We’ve all had at least one “oops” that sticks with us.How does one find Cisco Switches or Routers that just happen to have the same Hostname or the same Management IP Address reported in LLDP and / or CDP? What if those alleged Cisco device just happen to have the same configuration except for the out of band management address? Accidentally of course. Well, this happened during a rapid stand up of two new Cisco routers. (Not me, of course. I learned this lesson many moons ago). To speed up the deployment, a copy / paste of config from one Router to two others occurred. Oh, yes, some nasty stuff happened after this. But that’s not pertinent to the resolution.NQE to the rescue. Since the Management IP addresses were “forgotten” or unknown to those troubleshooting the issue, how does one find these near identical twins? Remember that CDP announces Serial Numbers. LLDP typically does not advertise the device’s Serial Number. Thu

280

2 months ago

Vladi BEmployee

posted in NQE

Best way to start writing a Parser - Part 2

In Part 1 of Best way to start writing a Parser I described how you can start writing a parser without running it against a snapshot, which can save a lot of time.I ended it with parsing the interface out of a device output blob.This Article will extend the same NQE, but I will extend the content of the information that we will be parsing for.As a reminder, here the final NQE from Part 1:test_string ="""GigabitEthernet0/0 is up, line protocol is up (connected) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is XON, input flow-control is XON ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 25w3d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/1

560

2 months ago

Vladi BEmployee

posted in NQE

Best way to start writing a Parser - Part 1

Are you new to NQE?Do you need to write a pattern match parser but don't know where to start?Do you want to test your pattern match without running it against your snapshot, because it takes too long for each iteration?Well, I have been there and here's what I've learned.If you start writing a parser, you'll most likely run into multiple iterations that won't give you the desired results. If you're as impatient as me, you'd like to get your test results quickly back so you can adjust the parser.To do this, you can:Take a sample of the config or device output and store it in a variable. Write the parser to run against this sample. Check if the result is what you expect. Modify the parser and run step 3 until you get your expected results.Well, that sounds easy enough! But how do you actually do each of these steps?Here's an example.For example, lets assume you have to lookup information from the "show interfaces" command on Cisco devices, something like this:GigabitEthernet0/0 is up, li

rathidRamping Up

what is format to pass the the path parameter in Path Mtu consistency check ?is it a list of devices ? is it a traceroute ?or source or destination ip ?

652

3 months ago

alineamorimRamping Up

asked in NQE

NQE for OneIP table

How would one replicate the OneIP table with NQE, including info such as IP address, MAC address, vendor, switch name and switch port?

801

3 months ago

gbaronSpotter

asked in NQE

NQE to state whether NQE is a OS or Config match...or both.

I have an already pretty extensive NQE written to return a half dozen or so fields, but I cant figure out how to differentiate whether the CVE returned is a OS or Config match...or both. Can someone help with that code?

372

3 months ago

cariddirSpotter

asked in NQE

Using NQE to get BGP routes advertised.

Has anyone put together a simple Query to grab the advertised routes to a BGP Peer?I haven’t had much time to try, but maybe someone has done this on side.In summary, I want to try and associate routes to a device/location in our branch environment.foreach device in network.deviceswhere "Branch" in device.tagNames && "WAN" in device.tagNames I thought there would be some simple query in the model to just pull ‘bgp advertised routes’ and I could limit it with the above, and associate that route to that location. But after looking for 10 min, I couldn’t find anything of use. Anyway, if anyone has done something, it would be great to see/try. I saw a very ‘wild’ one on the community @baher , amazing work BTW.But i’m basically looking for the result of the routes advertised to any BGP neighbor.

634

3 months ago

gbaronSpotter

asked in NQE

NQE > External Sources > SNMP sources > Outputs > rawOidEntries

Hello: I am not sure if this should be a discussion or question so apologies on that. I have an NQE where I am pulling the raw Oid data and displaying the rawValue result as an output. I want to be able to name each of those outputs so that its know to the public what that raw data represents. One such example is a returned value of INV: 2.12 in the rawValue field. But I would like to have know as hardware revision.I did apply names to the Oids in the custom source profile, but its not pulling that. Can this be done?

13511

3 months ago

gbaronSpotter

asked in Product Discussions

Can I pull the entire CVE database

Is there a way to export all CVEs that the platform is scanning for. We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

513

3 months ago

Sebastian CorosRamping Up

asked in Product Discussions

How to pull device files from multiple devices at once via the API

Hi Forward Networks team, I am looking at the API, specifically the call to get a device's data files.I can get the files for a single device at a time by just putting in the hostname in the parameters, however I was wondering if there is a parameter which will allow me to pull from multiple devices at once.For example lets say I want to pull from devices ABC, DEF, GHIorI want to pull from every device that starts with ABC*Is this something that can be done?Or would another possibility be to create a separate group of devices which includes all the devices I want to pull from and then just run the GET call on that device group. Kind regards,Sebastian

815

3 months ago

DannyRRamping Up

asked in Product Discussions

DELIVERED_TO_INCORRECT_LOCATION API Status Clarification

Hello,I have a question when using the Search Path API.Could we get an elaboration on the meaning of that “DELIVERED_TO_INCORRECT_LOCATION” forward outcome status, such as why it appears and if there’s anything we can do to address the “INCORRECT_LOCATION” part, if it’s necessary?I presume the status means that somewhere along the routing, it somehow ended up at a destination Forward Networks didn’t expect. But I just wanted to know if there was any more to it.Thanks!

282

3 months ago

NandSpotter

asked in NQE

Forward Networks Cloud Objects Count difference through NQE Query

Hi Team,We want to fetch the Cloud objects difference count that compare today and yesterday(For example) Snapshot and provide the missing Cloud objects details which are missing from Current snapshot through NQE Query. Please assist us if anyone can relate with this.

191

3 months ago

baherEmployee

published in Top NQEs

IP Inventory Table NQE

Identifying all the IP addresses on your network can be a complex and tedious task - and even impossible on some networks. This NQE makes it significantly easier to identify all the IP addresses in use on your network, including those that are stale or obsolete. OverviewThis NQE identifies IPv4 and IPv6 addresses that are in use within the network. Due to the scarcity and value of IPv4 addresses, companies often seek to maximize their utilization and identify any under utilized address space. This can help to either improve the utilization of owned addresses or free up unused address space for sale. Whether you’re consolidating for financial purposes or re-IPing due to mergers, acquisitions, or network reorganizations, this NQE is essential for identifying all the IP addresses within the network. ResultsImproved IP Utilization: By identifying stale or obsolete IP addresses, this NQE enables organizations to optimize their IP space, reducing the need to purchase additional address spa

770

3 months ago

Tyson HenrieEmployee

posted in NQE

NHRP check for extraneous configs

This is a good example of how NQE can work well with IP subnet information.In this case the customer had found that the router's parser would not exclude misconfigurations. They found that some of the NHRP configuration commands had used the incorrect subnet. The correct IP configs were there as well, but now it means there are extra config lines and it would be nice to clean these up. There were under 100 devices that were violations out of the tens of thousands of devices that were collected.Config segment from Cisco router with a violation.!interface Tunnel0 ip address 10.16.1.16 255.255.255.0 ip nhrp map multicast 172.16.16.1 ip nhrp map 10.6.16.1 172.16.16.1 <<--This command does not match the tunnel subnet ip nhrp map multicast 192.168.16.1 ip nhrp map 10.16.1.1 192.168.16.1 ip nhrp network-id 16 ip nhrp nhs 10.16.1.1!/** * @intent Find ip nhrp commands that are not in the same subnet as the tunnel subnet * @description The 'ip nhrp map' and 'ip nhrp nhs' address should be

290

3 months ago

Page 3 / 8

CarlBhas earned the badge NQE Contributor
gbaronhas earned the badge NQE Contributor
Rohit_809 Kumarhas earned the badge Community Contributor
VarunShas earned the badge NQE Contributor
RobertWelchhas earned the badge NQE Contributor

Show all badges

Sign up

Already have an account? Login

Select a login option:

Welcome to the Forward Networks Community

Select a login option:

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.