Skip to main content

Community

Connect with others to answer questions, gain new insights, and grow your networking knowledge.

166 Topics
A
AhmedRamping Up
posted in NQE
Initializing an Empty List

Hello,With the actual version of NQE not providing direct way to initialise an Empty list ex:let empty_list = []orempty_list = [] A workaround for this is to construct the creation of that list and providing a value with the same data type you need// an empty List<String>FALLBACK =foreach x in [""]where x != ""select x; // an empty list of NumbersFALLBACK_NUMBERS=foreach x in [0]where x != 0select x; Taking this logic further we can create a function that provides us an empty list of whatever generic type. by taking a default value of that type as an input, then comparing against that value The below block contains the full PoC code// an empty List<String>FALLBACK =foreach x in [""]where x != ""select x;// an empty list of NumbersFALLBACK_NUMBERS=foreach x in [0]where x != 0select x;// An empty list of a generic type TemptyListT(default_val)=foreach x in [default_val]where x != default_valselect x;foreach a in [""]let empty_list_of_strings = FALLBACKlet empty_list_of_number

4
A
Spotter
4 months ago
G
Employee
GaryBEmployee
posted in Product Discussions
Happy Thursday TwinNavigators, Looking for some feedback around you configuration automation experience.

Before we head off into the weekend I was hoping to ask the community what their stance is on schema based network configuration interfaces like NetConf and OpenConfig GNMI. Question 1: Do you currently or plan to use NetConf and/or GNMI to manage policy across your network? Do you leverage this in your automation pipeline? If so, do you find sufficient vendor support?Question 2: If you do leverage NetConf/GNMI for configuration data, do you still want to inspect the policies via CLI?Thanks for your insights.

0
G
Employee
4 months ago
cariddir
Spotter
cariddirSpotter
posted in NQE
Checking the existence of two conditions with NQE

As part of doing configuration audits for our NX-OS devices, I needed a check to see if two conditions were met in a configuration to check compliance.If both conditions were present → GoodIf one condition was met and the other wasn’t → BADElse if → Both conditions were not present → Also good.This is relatively simple with a single condition, but adding another variable, kind of stumped me. Credit to Glen Turner @FN for solving the logic puzzle on this.The example below is for OSPF enabled and SNMP traps for OSPF is enabled. This logic can be used for many other two condition checks such as //VarsPatternNetFlow = ```feature netflow```;PatternNetFlow_Config = ```flow timeout active 60```;//FunctionsCheckPattern(config , pattern) = !hasBlockMatch(config, pattern);&& //VarsPatternBFD = ```feature bfd```;PatternBFD_Config = ```bfd interval 300 min_rx 300 multiplier 3```;//FunctionsCheckPattern(config , pattern) = !hasBlockMatch(config, pattern); /** * @intent Ensure DC NX-OS Devic

0
cariddir
Spotter
4 months ago
Fabrizio
Employee
FabrizioEmployee
posted in Product Discussions
NetBox Integration webinar: Network Discovery, Assurance & Compliance Validation with Forward Networks and NetBox Labs

On May 21st we have shown the integration between Forward and NetBox in a joint webinar. UPDATE: The webinar recording is now available on YouTube:https://youtu.be/TSX14uke1NE.The description includes a link to the webinar slides and the GitHub repository. The integration is part of the NetBox’s Network Automation Architecture framework where Forward provides the Observability and Assurance piece, as shown in the picture below:NetBox Network Automation Architecture The first use case is about onboarding an empty NetBox instance with device data collected by Forward, such as Devices, Interfaces, Vendors, Location, and so forth.Onboarding an empty NetBox instanceThe integration is based on a Python script. It imports the data from Forward using NQE queries via REST APIs, transform the data from the Forward to the NetBox schema and then exports it to NetBoxThe process can be automated using a web-hook so that NetBox is updated every time Forward collects from the network.To run the integr

3
Fabrizio
Employee
4 months ago
Tyson Henrie
Employee
Tyson HenrieEmployee
asked in NQE
match two lines with different amounts of output

I have a problem where the two lines of this module output are not the same.  How can I put in essentially null place holders so that they resultant patterns are the "same"?example outputNotice that module 2 does not have Fw or Sw.Mod MAC addresses Hw Fw Sw Status 1 a03d.6f81.0740 to a03d.6f81.074f 1.1 15.0(1r)SG12 03.07.03.E Ok 2 b0aa.777d.d010 to b0aa.777d.d017 1.0 Ok  I was trying to use these two patterns and tried to put in placeholds of Fw and Sw at the end of "pattern03".  But the NQE does not like this.pattern02 = ```Mod MAC addresses {modNum:number} {string} to {string} {hwVer:string} {fwVer:string} {swVer:string} {modStatus:string}```;pattern03 = ```Mod MAC addresses {modNum:number} {string} to {string} {hwVer:string} {modStatus:string} {fwVer: null:string} {swVer: null:string}```;getMacAddrList(parsedOutput) = foreach pattern in [pattern02, pattern03] foreach match in blockMatches

4
G
Employee
4 months ago
A
Spotter
AndyLSpotter
posted in NQE
Using NQE to validate uplink on ACI Fabrics

Problem StatementOur company had issues where some network leafs were not connected to all our spines within an ACI fabric.Traditional methods to validate this were time consuming so we developed a basic NQE query to assist.How it workswe leverage the LLDP information for the network leaves and match this to our spines. In our case, we rely on the device naming convention to match LLDP entries to spines. Our spines have SP within the name.NQE ScriptFunction to gather the links to spines for a given device/* * function: countSpineNeighbours * * parameters: device: Device * * purpose * ------- * * count the number of links that are between the spines and the leafs * * spines are matched based on the SP in the device name, at position 8 * * returns: dict * * { * deviceName: string * interfaceName: string * } */countSpineNeighbours(device) = foreach interface in device.interfaces where interface.interfaceType == IfaceType.IF_ETHERNET foreach n in interface.lldp.neighbors where

2
A
Spotter
5 months ago
C
Employee
ChristopherEmployee
posted in NQE
Auditing firewall rules with NQE

You can use NQE to examine the firewall rules in all firewalls in a network. However, you will need to use a different approach depending on what you want to audit in your security rules.Forward Enterprise collects and parses the ACLs and security rules from all devices: firewalls, routers, switches, and so on. The data is then parsed and normalized. This data is stored in a database in a custom format that allows the Forward application to perform path analysis.The following NQE query uses the Forward Enterprise aclEntry object to provide consistent output from any vendor Firewall. Note that the scope of device types in the output is limited by using the where statement and filtering to DeviceType.FIREWALL.This query will work for every ACL/security rule on any Firewall in the network. However, because the query is working on normalized data, each security rule in a firewall may be broken up into multiple aclEntry objects. The results of this query may therefore have multiple lines wi

0
C
Employee
5 months ago
devecis
Employee
devecisEmployee
published in NQE
Video: Optimizing NQE Queries for Success

 Sean Deveci, Federal Systems EngineerAndreas Voellmy, Sr. Director of Engineering Join me, @devecis, and @Andreas as we show you how to upgrade your NQEs, making them easier to troubleshoot, more scalable, and more resilient. These techniques are not only great for NQE, but will also up improve your Python and Javascript.         Work side-by-side with us as we show you how to:Improve the results of your scripts to maximize the end-user experience. Streamline your scripts so they're easier to read, manage and share. Make your scripts more resilient so they can keep up with your changing environment.        Ask questions below and let us know what you'd like to see in future demos! 

1691
steve
Employee
5 months ago
C
Employee
ChristopherEmployee
posted in Product Discussions
How to use workspace networks to test custom commands

Some customers have asked, “How do I run a custom command on just a few devices, to test if it gives me what I need for an NQE query?” You can do this with a workspace network!First, click the Network drop down and choose Add Workspace network  Add a name for your Workspace and click Next.  Add the device or devices you want to test the custom command(s) on and click Add X devices. Then Next.  Check the custom command group you want to include in the Workspace and click Next and Done. You can also skip this step and add the custom command in the workspace later.  Make sure you are in the new Workspace network in the Network selection drop-down. Go to Settings > Collection Settings > Custom commands and enable the Custom command group.(You can also add a new custom command from this page by editing the command group or adding a new one.) Return to the main page by clicking Search, and then choose Take Snapshot from the snapshot drop-down. This will collect the data using your cust

1
RobertWelch
Employee
5 months ago
C
Employee
ChristopherEmployee
asked in NQE
How do find the serial number of a device in NQE or Inventory+?

Forward Networks includes serial numbers in its model as part of the component object. So if you want to see the serial number for a device, you must iterate through the components of that device. The serial number for the device itself usually belongs to the chassis, but some vendors may have multiple controller cards. The serial numbers for line cards, power supplies, etc will also be listed as components with serial numbers.There is a build-in NQE query in the Forward Library called Device Hardware that is included in Inventory+ by default. If it has been deleted from Inventory+, you can add it back by clicking on Inventory+ > Add NQE Queries and then selecting the Device Hardware NQE and clicking add and then Add.Note the foreach component in platform.components loop and the component.serialNumber entry in the NQE query code below:/** * @intent Information about device hardware */foreach device in network.deviceslet platform = device.platformforeach component in platform.compone

1
C
Employee
5 months ago
S
ShivangKRamping Up
asked in NQE
NQE Query to get SSL profiles from Custom Commands on F5

I am trying to create a NQE query for all the F5 devices. The query searches for SSL profile on custom command. Custom Command is : show ltm virtual detail recursive | grep -E "Ltm::ClientSSL Profile:" -E "Virtual Server:"The NQE should return SSL Profiles and the VIPs associated with them.  

5
S
6 months ago
cariddir
Spotter
cariddirSpotter
posted in NQE
Switch Port Activity

This is a script to pull switch port stats from our access switches in our network. The data pulled in this script is used for ‘right sizing’ and network planning. We can then export the results, and pivot table them to see the % of switch ports in use/not-in use. I’ll add this attachment later./*** @intent Show int counters on Arista & IOS-XE Switches * @description * 1. Check to see what switch ports have had no traffic accross the wire for sizing and planning. * 2. Match on platform.os* 3. Use the information from the custom command 'show int counters'.* 4. Get counts of switch ports on that device so we can use to calculate % in use**/// Pattern of output// Arista & Cisco Same ColumnsTraffic = ```{Port:string} {InOctets:number} {InUcastPkts:number} {InMcastPkts:number} {InBcastPkts:number}```;// Arista FunctionEOS_Stats = foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSforeach command in device.outputs.commandswhere command.commandText == "sh int

2
cariddir
Spotter
6 months ago
chrisnaish
Employee
chrisnaishEmployee
posted in NQE
AWS - NQE Query to track Public IP usage

AWS - Public IPv4 charge changes Back on Jul 28, 2023, AWS announced forthcoming changes to their billing for IPv4 public IP usage, which take effect as of Feb 1, 2024. In summary, AWS says, "Effective February 1, 2024, there will be a charge of $0.005 per IP per hour for all public IPv4 addresses, whether attached to a service or not (there is already a charge for public IPv4 addresses you allocate in your account but don’t attach to an EC2 instance).". More information can be viewed here: https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/. Update Apr. 2, 2024: In light of this, Forward Networks can assist with keeping track of your Public IP usage via an improved NQE Query located in “NQE->Library->Forward Library->Cloud->AWS->Public IPv4 Cloud Cost” that will show you what's being used: /** * @intent Shows the number and cost of AWS public IPv4 IP addresses */import "L3/IpAddressUtils";// $0.005 per hour per IPcostPerIpPerDay = 24.

1
davetee
Community Manager
6 months ago
S
SteffiRamping Up
asked in NQE
NQE query to filter CVEs with CRITICAL Severity

Hi,I wrote an NQE query which is expected to return devices with CRITICAL severity only. The query returns almost a million results which is unlikely. Each device has so many rows with CRITICAL CVEs. foreach cveDatabase in [network.cveDatabase]foreach cve in cveDatabase.cvesforeach device in network.deviceslet platform = device.platformlet Severity = Severity.CRITICALselect {   "Device Name": device.name,  "CVE ID": cve.cveId,  "Severity": Severity.CRITICAL,  "Vendor": platform.vendor,  "Model": platform.model}    

5
S
6 months ago
I
imageryanRamping Up
asked in Product Discussions
Retrieval of Cisco Firepower device information

We have started to do some testing with FN. In our AWS network, we are using Cisco Firepower Threat Defense (FTD) devices managed by Firepower Management Console (FMC). FN is able to connect to an FTD and retrieve device details but does not support retrieval from FMC.In our network, for complicated routing reasons, we can’t easily enable FN to connect to our FTD instances. I can, however, provide a URL that will retrieve all the information from FMC. I would like to configure an “HTTP(S) external source” to provide that info. What I cannot figure out, however, is the required format for the data to that is returned by the URL GET. The document just states that FN will “infer” the schema. In my case, there’s no inference needed. I am writing the code that will return the info. I can format the data however FN needs it.For those who care about the details, the implementation is an AWS Lambda function that connects to the FMC REST API and returns the info. An AWS API gateway provides the

1
captainpacket
Employee
6 months ago
H
huutho5011Ramping Up
asked in Product Discussions
Error during SNOW integration

Hi all, We are getting “No processed Snapshot found. Please take a Snapshot and try again.” when trying to hook Forward Network with SNOW CMDB, anyone has any idea why this happen ? ( We do have snapshots already taken and processed) Thank you 

3
deronjohnson
Employee
6 months ago
davetee
Community Manager
daveteeCommunity Manager
posted in Videos
(Demo) Unlock network insights with Forward Networks and generative A.I.

 No time! Skip to the demo. @nikhilhandigol demonstrates how generative A.I. unlocks network insights and shows the Tech Field Day delegates how Forward Networks seamlessly incorporates generative A.I. into its network digital twin software. Inside the most popular product feature, Network Query Engine, every user can perform natural language queries to access crucial network data in seconds. You can watch the entire Tech Field Day here. Got questions? Ask below!

0
davetee
Community Manager
6 months ago
davetee
Community Manager
daveteeCommunity Manager
posted in Videos
(Demo) Unlocking Network, Security, and Reliability with a Forward Networks Digital Twin

  Every network engineer can associate with 7:58 In this introduction, @Mike explains Forward Network's digital twin software, Forward Enterprise, and how network digital twin benefits more than just networking people. Forward Enterprise analyzes every possible network behavior, traces where every packet could ever go, and gives every user a queryable vendor-independent data model so NetOps, SecOps, CloudOps and even Compliance teams can get a mathematically-accurate view of the network.Check out the entire Network Field Day series here

0
davetee
Community Manager
6 months ago
cariddir
Spotter
cariddirSpotter
posted in NQE
Arista Field Notice - Aboot Version report

This is a simple NQE to run a custom command to report on the ABOOT Version and Platform of Arista Devices. From Arista:In a small set of cases systems may experience an unexpected reboot. The reload is due to an uncorrectable ECC error caused by a corner case timing conflict on the CPU sub-system tracked by bugID 419257. This bug affects the range of CPU models present in these products. The affected systems are not restricted by specific serial numbers or date code ranges and the reload is unpredictable. Systems running Aboot6 BIOS revision lower than 6.1.7 or 6.0.9 and Aboot4 BIOS revision lower than 4.1.1 or 4.0.7 are susceptible to this issue. There are currently 4 release trains of Aboot across these systems: 4.0.x and 4.1.x, 6.0.x, and 6.1.x. A single common patch file will introduce the update across all release trains and is not platform or version-specific----------------------------------------------------------------------------------------------------------The custom Comma

2
cariddir
Spotter
7 months ago
S
SteffiRamping Up
posted in NQE
check all network non-server-facing interfaces that are down.

foreach d in network.devicesforeach i in d.interfaceswhere length(i.links) != 0where i.adminStatus == AdminStatus.DOWNselect {deviceName:d.name, interface:i.name} 

1
davetee
Community Manager
7 months ago
Mike
Community Manager
MikeCommunity Manager
posted in Videos
Demo Tuesday - 2/27/24 - Zero Trust XTREME!

Well let me tell you something brother!  You think you know everything about Zero Trust?? You don't know diddley about network security without a network digital twin.  Watch @Mike hit viewers with the figurative folding chair of knowledge or be hit by one. Tune in to see which it is!  

2
davetee
Community Manager
7 months ago
Mike
Community Manager
MikeCommunity Manager
posted in Videos
Demo Tuesday - 1/30/24 - If you could ask your network anything, what would it be?

Good news, you can ask it all the questions you want with Forward Enterprise's new AI Assist feature. Watch @Mike use natural language to perform Network Query Engine searches-- no matter your role or skill level, you can conduct sophisticated network queries with a minimal learning curve.  

0
Mike
Community Manager
7 months ago
Mike
Community Manager
MikeCommunity Manager
posted in Videos
Demo Tuesday - 1/9/24 - STIGS with Sean

How can federal agencies possibly comply with the HUNDREDS of complex specifications in the DISA STIG compliance checklists?  @Mike has special guest @devecis in studio to learn how a network digital twin can streamline your federal network compliance and give you full confidence heading into an audit.  

0
Mike
Community Manager
7 months ago
joe
Employee
joe
posted in Product Discussions
How to provide path search snapshot when working with support

Sometimes a path search may not present the results you expect. When engaging with support regarding a path search issue, you may be asked to provide a snapshot with the relevant path search data. To capture a snapshot of a path search, first perform the path search in question. In this example, we are performing a simple path search from atl-ce01 to atl-core-pe01: Now, press and hold the Alt or Cmd key, and the icon on the far right of the query bar will change from ‘Copy Query’ to ‘Export Query’. Click on the ‘Export Query’ icon: The Export Snapshot wizard will now display all devices relevant to that path, and allow you to add any additional devices you wish to add to the snapshot (if necessary).  Finally, obfuscate the IP and MAC addresses if necessary, and export the snapshot: This will allow you to download a zip file snapshot of the path search and all devices within the path of this search. This will provide the support team with all data necessary to investigate your path sear

0
joe
Employee
8 months ago
cariddir
Spotter
cariddirSpotter
posted in NQE
NQE to get VIP Mappings on Fortinets

An FW engineer was looking to get the results from the command, “show firewall vip”, from all Fortinet Firewalls in Forward Networks. Command: show firewall vipconfig firewall vip    edit "x-7.6.254.158-dns"        set uuid d60c0a52-2630-51eb-9d53-bc032ca5e1c0        set extip x.x.x.x        set mappedip "y.y.y.y"        set extintf "any"    next    edit "x.x.x.1/32"        set uuid 796a2ac2-2251-51ec-5c82-26b2e049a7a7        set comment "Voice LAB"        set extip x.x.x.1        set mappedip "y.y.y.1"        set extintf "any"    next    edit "x.x.x.2-y.y.y.2"        set uuid 9ea63058-47ac-51ec-2a7f-5b0d00a1d142        set comment "Cloud"        set extip x.x.x.2        set mappedip "y.y.y.2"        set extintf "any"    next  Finding the command in the data model  /** Thank you Danny Ramirez with the Smarts on this * * @intent Grap VIP's on Fortinets command.output of "show firewall vip" * @description Define VIP format, and then iterate through to pull the VIP * Name and theMapped

0
cariddir
Spotter
8 months ago
Show all badges
Terms of UseCookie settings