General Discussions

CISA just issued Emergency Directive 25‑03 mandating actions to identify and mitigate a campaign exploiting zero‑day vulnerabilities in Cisco ASA / Firepower devices. While the directive is written for federal agencies, the threat is relevant to any organization using those platforms. Below is a summary, risk assessment, and recommended mitigations — along with what Forward Networks is doing to support customers. What’s Going OnCampaign targets Cisco ASA and Firepower / FTD appliances Exploits include unauthenticated RCE and privilege escalation Persistence observed via ROM manipulation Linked to 'ArcaneDoor' activity CVEs: CVE‑2025‑20333 (RCE) and CVE‑2025‑20362 (privilege escalation) Directive mandates inventory, forensic dumps, patching, and reporting Why This Matters to Forward CustomersIf you rely on Cisco ASA, ASAv, or Firepower/FTD appliances in your network perimeter or DMZ, your infrastructure may be at risk of compromise, persistent code injections, or deeper intrusion. Becau

Flagging an important warning from the FBI / IC3, and sharing resources to help you assess and reduce risk. Alert Number: I-082025-PSA - Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure The High-LevelThe FBI is alerting that Russian FSB cyber actors (aka Center 16 / “Berserk Bear” / “Dragonfly”) are actively exploiting a known vulnerability in Cisco Smart Install (SMI) — CVE-2018-0171 — to target networking devices globally. These actors are using SNMP (especially older/insecure versions v1 and v2) and unpatched / end-of-life devices to:Collect configuration files. Modify configs to insert or enable unauthorized access. Do reconnaissance inside victim networks, with particular interest in protocols & applications used in critical infrastructure / industrial control systems.The vulnerability and use of legacy/unsecured protocols make aging equipment especially risky. Even if a device is not directly breached, weak practices may allow attackers in

We’re excited to announce the launch of the newly reinvented Forward Quest — a monthly interactive challenge designed to put your Forward Networks skills to the test. Play Forward Quest What is Forward Quest?Forward Quest is an online game experience built around real-world network engineering scenarios. Each challenge is timed, and your results are added to a community leaderboard where you can see how you stack up against other Forward users. Why play?Forward Quest is more than just a game — it’s a fun way to: Sharpen your skills by solving challenges that mirror real engineering tasks. Learn by doing and discover new ways to use Forward Enterprise in real-world situations. Earn bragging rights (and prizes!) by climbing the leaderboard. Unlock badges that showcase your achievements in the community.  How to play Head to Forward Quest Log in with your Forward Community account Start the first challenge and race the clock to see how fast you can solve it! The first monthly ch

If you’ve ever waded into the world of cybersecurity, you’ve probably run across the acronyms CWE, CVE, and KEV. They sound similar, and they’re all related to security flaws — but each serves a different purpose. Here’s a clear breakdown: CWE (Common Weakness Enumeration)Think of CWE as a blueprint of mistakes. Maintained by MITRE, CWE is a catalog of weakness types — ways that software or hardware can go wrong. A CWE is not tied to a single product; instead, it describes a class of design or coding errors. CWEs can be abstract (like “improper input validation”) or very specific (like “integer overflow in arithmetic operations”). Example: CWE-269 (Improper Privilege Management), which outlines the general problem of failing to correctly enforce privilege levels.  CVE (Common Vulnerabilities and Exposures)CVE zooms in from the abstract to the concrete and specific. A CVE is an actual, identified vulnerability in a particular product or version. Every CVE entry includes metadata

Curious about AWS but not sure where to start? In this step-by-step walkthrough, I’ll show how to set up your own AWS Free Tier account, configure billing safeguards, and follow best practices for security and user management. Whether you’re preparing for certifications or just experimenting with cloud services, this guide will help you get started with confidence.   Cloud infrastructure has become essential in today’s IT landscape, and gaining hands-on experience with AWS (Amazon Web Services) is a valuable step for any engineer. The AWS Free Tier allows you to experiment with building, using, and tearing down AWS services at little to no cost—an excellent way to learn without breaking the budget.In this article, I’ll walk you through: Why you might want to create an AWS Free Tier account How to set one up safely Best practices for billing, security, and user management How to clean up or close your account when you’re done  Why Use AWS Free Tier?Creating your own AWS Free Tier

I have created the Forwords Network account .Why I can not login this vis this link.Forward Enterprise | Forward Networks Docs

Could you help simulate the staging of new BGP peers, route-maps, and new routes to understand how they might impact route path behavior?  I am planning to stage a change that involves adding a new link and BGP peer, with the expectation that routes will prefer the new path after the change. Can this scenario be simulated in the forward network to validate the expected behavior?  So far, I’ve attempted to simulate the changes, and I can see the new/modified interfaces and the transit IPs. However, I don’t see the BGP peer.  Am I missing something in the simulation process? Any guidance would be appreciated.  Are there any limitation with the simulation feature.  

This is for On-Prem environments, to securely retrieve the CVE database file through automation. Create a secure env file (path of your choosing) for your Forward SAAS credentials This keeps secrets out of code and scriptsexport FWD_USERNAME='your_username'   # <-- Replace with your Forward SAAS UNexport FWD_PASSWORD='your_password'   # <-- Replace with your Forward SAAS PW Add the Python script (path of your choosing) to download the CVE index This is the meat and potatoes of retrieving the file for SAAS#!/usr/bin/env python3import requests, osfrom requests.auth import HTTPBasicAuthusername = os.environ.get("FWD_USERNAME")password = os.environ.get("FWD_PASSWORD")if not username or not password:    raise ValueError("Missing credentials.")url = "https://fwd.app/api/cve-index"output_file = "/tmp/cve-index.bin.gz"r = requests.get(url, auth=HTTPBasicAuth(username, password), verify=False)r.raise_for_status()with open(output_file, "wb") as f: f.write(r.content)print(f"Saved to {output

we are using below NQE Query to get the NTP Server details , i need to remove some static value in  server coloum, ciscontppattern=``` ntp server {server:string}```;getServers(device) =  foreach match in blockMatches(device.files.config, ciscontppattern)   select { serverIP: match.data.server}; foreach device in network.deviceslet platform = device.platformwhere device.platform.vendor == Vendor.CISCO  select {  device: device.name,   vendor: device.platform.vendor,    tags: device.tagNames,    os: device.platform.os,    OSVersion :platform.osVersion,  servers: (foreach server in getServers(device)            select server.serverIP)}  Example : i dont want to show entry those have server value - “Inte”

Hi allHas anyone onboarded Arista WIFI yet, the models we have are managed centrally via CV-CUE the Wifi version of cloudvision, although you can extract some commands via SSH.Had a quick look around and couldn’t find anything, I will in the meantime dig around about custom devices 😀Thanks

In the early days of my Air Force career, the tech control facility was filled with the aroma of coffee and the buzz of technology. Each morning, my role was clear: brew the perfect cup for my boss and run countless validation checks through the CLI, ensuring each day started on the right note. Does this sound familiar? Maybe not the coffee but certainly hunched over the keyboard staring at a CRT screen using the CLI to search across hundreds of devices. These were monotonous tasks, logging in to each device one after the next, looking for significant events and up/down statuses, then documenting that information to provide an update to the division chief. It made me wonder if there was a way to automate this drudgery.  It has been 20 years since then and I am now an intern with Forward. It has been a fantastic opportunity to advance my skills in Linux, Python, and deepen my understanding of the role of DevOps in technology organizations.  Key takeaways I have observed at Forward: Coll

 🌟 Revolutionize Your Multicast Network Management with Forward Enterprise 🌟Managing multicast networks can be a daunting task, but Forward Enterprise makes it seamless with its advanced visibility, analysis, and troubleshooting. This demo showcases how the platform simplifies complex operations, offering unparalleled control and insights into your multicast network infrastructure.  Forward Enterprise - Multicast BenefitsSimplified Multicast Management: With an intuitive interface and dynamic topology maps, Forward Enterprise makes it easy for both novices and experts to manage and analyze complex multicast networks efficiently. Comprehensive and Actionable Insights: The platform provides a unified view of network configurations, paths, and device states, empowering administrators with the knowledge to optimize operations and prevent issues. Proactive Troubleshooting and Time-Saving Tools: Advanced search and validation features enable quick diagnosis and resolution of network proble

 Recently, two critical vulnerabilities (CVE-2024-0012 and CVE-2024-9474) were discovered in Palo Alto Networks' PanOS operating system. CVE-2024-0012 lets an attacker gain admin access and exploit other vulnerabilities like 2024-9474. These vulnerabilities allow attackers to gain admin privileges and plant malicious code, potentially giving them deeper access to company networks. The highlights are available below. Watch the video for the full story.Here’s how you can address these threats: Understand the Threat: The vulnerabilities enable unauthorized access, risking the security of your firewalls and networks. CISA has issued directive BOD 23-02. This directive outlines how organizations can reduce their attack surface from misconfigured management interfaces. Leverage Forward for Validation: Identify devices exposed to these vulnerabilities. Filter and prioritize affected devices, especially those connected to the internet The Forward platform provides a nightly update of CVE d

How can i add AVI LB on FWN , TO use port https ,443 .?

is it possible to run NQEs immediately after a snapshot completes?  If Forward can baseline what NQEs are always run after a snapshot completes (possibly this data baseline is based upon a period of time such as 30 days or some admin defined time period).  Administrators can use this baseline data to flag those NQEs of priority to run immediately after the snapshot completes.  in this way, results from priority NQEs are immediately available (from cached results) for applications to use with minimal delay.

Hey, Forward Community Members!We're thrilled to invite you to submit your ideas for network configurations you’d like to see analyzed within our Net3 lab network. Whether it's testing new scenarios, troubleshooting common issues, or exploring unique configurations, we want to know what network setups you’re interested in. Example lab scenarios include:Layer 2  Host-to-Host communication in VXLAN EVPN  fabric based on  Arista STP/RSTP Layer2 pods built  with Cisco or  Arista switches Layer 3 MPBGP with VXLAN EVPN forwarding (Arista vEOS) IPv6/IPv4 Dual stack forwarding using routers/switches by Cisco and Arista, as well as Palo Alto firewalls SD-WAN Viptela/Catalyst SD-WAN As well as other configurations including Network Services - Load-balancer single-arm (SNAT/DNAT): A10 And many others!  What network configuration would you like to see? Our Net3 lab network is constantly expanding with a diverse set of devices, offering a robust environment for analysis and experimentation. H

What command can be ran from the CLI to find the postgres version?

I was helping some folks in getting familiar with Forward Networks, we were having trouble in adding in new devices (that already exist in the parent network) in to the already created workspace. The existing options to add devices in the workspace looks to only include ways to create new connections to those devices. But I did not see any way for me to pull in existing devices from the parent network, after the workspace was already created. Does anyone have any insight into this?

We were finally able to configure and get SSO online and operational this past week in our Dev environment, and pushed it in to the production world yesterday.  After running fine for about 10-12 hours, we came in this morning to the following error: SAML validation failed.  Invalid assertion [insert a bunch of random letters and numbers] for SAML response [insert more random letters and numbers]: Assertion IssueInstant was invalid, expiredContact your Org Admin to resolve the issue. I check with the in group that manages SSO and they claim nothing has changed on their end, so now I must ask:  How do we get past this so I can turn SSO back on? P.S. we are on base 11 app version 24.8 (rolling to 24.9 in a couple hours)

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location.  I also noticed when editing custom source that I had to update in phases. I imported csv of devices.  I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that into a valid query. How to Use AI AssistUsing AI Assist is easy. Just follow these steps:Log in to Forward Enterprise. Navigate to the NQE Library. Open the query editor by adding a new query. Click the AI Assist button. In the Generate tab, type your natural la

Is there a way to export all CVEs that the platform is scanning for.  We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

Before we head off into the weekend I was hoping to ask the community what their stance is on schema based network configuration interfaces like NetConf and OpenConfig GNMI. Question 1: Do you currently or plan to use NetConf and/or GNMI to manage policy across your network? Do you leverage this in your automation pipeline? If so, do you find sufficient vendor support?Question 2: If you do leverage NetConf/GNMI for configuration data, do you still want to inspect the policies via CLI?Thanks for your insights.

Happy Thursday All!  I hope you’re having a great week. I know it’s been a busy one so I’ve highlighted this week’s most popular articles and discussions in the community. Did I miss one of your favorites? Add it in the comments below! Here’s the list... @AricaFN ‘s article on extracting data from custom commands is a great discussion for anyone that has to go beyond the data model to tailor the Forward platform to their organization’s specific needs. @Christopher is on fire (hehe) with this new NQE query that uses the Forward Enterprise aclEntry object to provide consistent output from any Firewall vendor. And if you’re interested in automation, @Christopher’s article on interfacing with Forward with API and Python is a great example to follow.  @Mike ‘s complete NQE tutorial video series is the go to for anyone learning NQE or experts brushing up on the finer points.  Building on @cariddir‘s scripts, @RobertWelch create this plug-and-play NQE to unify the Fortinet Version output for