Skip to main content

General Discussions

New to Forward Networks or a seasoned professional? You found the right place!

  • 38 Topics
  • 44 Replies
38 Topics
A
Employee
andrewcarverEmployee
posted in General Discussions
On-Prem CVE DB Fetch Automation

This is for On-Prem environments, to securely retrieve the CVE database file through automation. Create a secure env file (path of your choosing) for your Forward SAAS credentials This keeps secrets out of code and scriptsexport FWD_USERNAME='your_username'   # <-- Replace with your Forward SAAS UNexport FWD_PASSWORD='your_password'   # <-- Replace with your Forward SAAS PW Add the Python script (path of your choosing) to download the CVE index This is the meat and potatoes of retrieving the file for SAAS#!/usr/bin/env python3import requests, osfrom requests.auth import HTTPBasicAuthusername = os.environ.get("FWD_USERNAME")password = os.environ.get("FWD_PASSWORD")if not username or not password:    raise ValueError("Missing credentials.")url = "https://fwd.app/api/cve-index"output_file = "/tmp/cve-index.bin.gz"r = requests.get(url, auth=HTTPBasicAuth(username, password), verify=False)r.raise_for_status()with open(output_file, "wb") as f: f.write(r.content)print(f"Saved to {output

150
A
Employee
R
Spotter
Rohit_809 KumarSpotter
asked in General Discussions
How can i remove some static values for output.

we are using below NQE Query to get the NTP Server details , i need to remove some static value in  server coloum, ciscontppattern=``` ntp server {server:string}```;getServers(device) =  foreach match in blockMatches(device.files.config, ciscontppattern)   select { serverIP: match.data.server}; foreach device in network.deviceslet platform = device.platformwhere device.platform.vendor == Vendor.CISCO  select {  device: device.name,   vendor: device.platform.vendor,    tags: device.tagNames,    os: device.platform.os,    OSVersion :platform.osVersion,  servers: (foreach server in getServers(device)            select server.serverIP)}  Example : i dont want to show entry those have server value - “Inte”

212
Tyson Henrie
Employee
S
Driver
SteveBamfordDriver
asked in General Discussions
Arista WIFI

Hi allHas anyone onboarded Arista WIFI yet, the models we have are managed centrally via CV-CUE the Wifi version of cloudvision, although you can extract some commands via SSH.Had a quick look around and couldn’t find anything, I will in the meantime dig around about custom devices 😀Thanks

715
S
Driver
seanreuter
Employee
seanreuterEmployee
posted in General Discussions
My Networking Journey - Evolution from Coffee to Code

In the early days of my Air Force career, the tech control facility was filled with the aroma of coffee and the buzz of technology. Each morning, my role was clear: brew the perfect cup for my boss and run countless validation checks through the CLI, ensuring each day started on the right note. Does this sound familiar? Maybe not the coffee but certainly hunched over the keyboard staring at a CRT screen using the CLI to search across hundreds of devices. These were monotonous tasks, logging in to each device one after the next, looking for significant events and up/down statuses, then documenting that information to provide an update to the division chief. It made me wonder if there was a way to automate this drudgery.  It has been 20 years since then and I am now an intern with Forward. It has been a fantastic opportunity to advance my skills in Linux, Python, and deepen my understanding of the role of DevOps in technology organizations.  Key takeaways I have observed at Forward: Coll

480
seanreuter
Employee
C
Employee
ChiaraEmployee
published in General Discussions
A Deep Dive into Multicast Network Analysis with Forward Enterprise

 🌟 Revolutionize Your Multicast Network Management with Forward Enterprise 🌟Managing multicast networks can be a daunting task, but Forward Enterprise makes it seamless with its advanced visibility, analysis, and troubleshooting. This demo showcases how the platform simplifies complex operations, offering unparalleled control and insights into your multicast network infrastructure.  Forward Enterprise - Multicast BenefitsSimplified Multicast Management: With an intuitive interface and dynamic topology maps, Forward Enterprise makes it easy for both novices and experts to manage and analyze complex multicast networks efficiently. Comprehensive and Actionable Insights: The platform provides a unified view of network configurations, paths, and device states, empowering administrators with the knowledge to optimize operations and prevent issues. Proactive Troubleshooting and Time-Saving Tools: Advanced search and validation features enable quick diagnosis and resolution of network proble

580
C
Employee
Mike
Community Manager
MikeCommunity Manager
published in General Discussions
Mitigating Vulnerabilities in Palo Alto Networks DevicesBeginner

 Recently, two critical vulnerabilities (CVE-2024-0012 and CVE-2024-9474) were discovered in Palo Alto Networks' PanOS operating system. CVE-2024-0012 lets an attacker gain admin access and exploit other vulnerabilities like 2024-9474. These vulnerabilities allow attackers to gain admin privileges and plant malicious code, potentially giving them deeper access to company networks. The highlights are available below. Watch the video for the full story.Here’s how you can address these threats: Understand the Threat: The vulnerabilities enable unauthorized access, risking the security of your firewalls and networks. CISA has issued directive BOD 23-02. This directive outlines how organizations can reduce their attack surface from misconfigured management interfaces. Leverage Forward for Validation: Identify devices exposed to these vulnerabilities. Filter and prioritize affected devices, especially those connected to the internet The Forward platform provides a nightly update of CVE d

410
Mike
Community Manager
R
Spotter
Rohit_809 KumarSpotter
asked in General Discussions
Information required to add AVI ON FWN using https

How can i add AVI LB on FWN , TO use port https ,443 .?

383
V
Employee
B
BillWRamping Up
asked in General Discussions
run nqe immediately after snapshot completes

is it possible to run NQEs immediately after a snapshot completes?  If Forward can baseline what NQEs are always run after a snapshot completes (possibly this data baseline is based upon a period of time such as 30 days or some admin defined time period).  Administrators can use this baseline data to flag those NQEs of priority to run immediately after the snapshot completes.  in this way, results from priority NQEs are immediately available (from cached results) for applications to use with minimal delay.

341
RobertWelch
Employee
elyor_khakimov
Employee
elyor_khakimov
published in General Discussions
Submit Your Ideas for Network Configurations to Analyze in the Forward Networks Net3 Lab!

Hey, Forward Community Members!We're thrilled to invite you to submit your ideas for network configurations you’d like to see analyzed within our Net3 lab network. Whether it's testing new scenarios, troubleshooting common issues, or exploring unique configurations, we want to know what network setups you’re interested in. Example lab scenarios include:Layer 2  Host-to-Host communication in VXLAN EVPN  fabric based on  Arista STP/RSTP Layer2 pods built  with Cisco or  Arista switches Layer 3 MPBGP with VXLAN EVPN forwarding (Arista vEOS) IPv6/IPv4 Dual stack forwarding using routers/switches by Cisco and Arista, as well as Palo Alto firewalls SD-WAN Viptela/Catalyst SD-WAN As well as other configurations including Network Services - Load-balancer single-arm (SNAT/DNAT): A10 And many others!  What network configuration would you like to see? Our Net3 lab network is constantly expanding with a diverse set of devices, offering a robust environment for analysis and experimentation. H

420
elyor_khakimov
Employee
G
Spotter
gbaronSpotter
asked in General Discussions
how to find postgress version

What command can be ran from the CLI to find the postgres version?

524
G
Spotter
D
DannyRRamping Up
asked in General Discussions
How do I add a device from the parent network to an existing workspace network?

I was helping some folks in getting familiar with Forward Networks, we were having trouble in adding in new devices (that already exist in the parent network) in to the already created workspace. The existing options to add devices in the workspace looks to only include ways to create new connections to those devices. But I did not see any way for me to pull in existing devices from the parent network, after the workspace was already created. Does anyone have any insight into this?

913
davetee
Community Manager
G
Spotter
gbaronSpotter
asked in General Discussions
SSO Error

We were finally able to configure and get SSO online and operational this past week in our Dev environment, and pushed it in to the production world yesterday.  After running fine for about 10-12 hours, we came in this morning to the following error: SAML validation failed.  Invalid assertion [insert a bunch of random letters and numbers] for SAML response [insert more random letters and numbers]: Assertion IssueInstant was invalid, expiredContact your Org Admin to resolve the issue. I check with the in group that manages SSO and they claim nothing has changed on their end, so now I must ask:  How do we get past this so I can turn SSO back on? P.S. we are on base 11 app version 24.8 (rolling to 24.9 in a couple hours)

812
G
Spotter
D
Spotter
dakotaglorySpotter
posted in General Discussions
Unable to snapshot; no sources configured when only custom source enabled

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

312
D
Spotter
D
Spotter
dakotaglorySpotter
posted in General Discussions
Bulk edit for custom sources

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location.  I also noticed when editing custom source that I had to update in phases. I imported csv of devices.  I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

291
Tyson Henrie
Employee
kevinbrasher
Community Manager
kevinbrasherCommunity Manager
posted in General Discussions
Community Highlight: AI Assist for NQE

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that into a valid query. How to Use AI AssistUsing AI Assist is easy. Just follow these steps:Log in to Forward Enterprise. Navigate to the NQE Library. Open the query editor by adding a new query. Click the AI Assist button. In the Generate tab, type your natural la

320
kevinbrasher
Community Manager
G
Spotter
gbaronSpotter
asked in General Discussions
Can I pull the entire CVE database

Is there a way to export all CVEs that the platform is scanning for.  We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

643
davetee
Community Manager
G
Employee
GaryBEmployee
posted in General Discussions
Happy Thursday TwinNavigators, Looking for some feedback around you configuration automation experience.

Before we head off into the weekend I was hoping to ask the community what their stance is on schema based network configuration interfaces like NetConf and OpenConfig GNMI. Question 1: Do you currently or plan to use NetConf and/or GNMI to manage policy across your network? Do you leverage this in your automation pipeline? If so, do you find sufficient vendor support?Question 2: If you do leverage NetConf/GNMI for configuration data, do you still want to inspect the policies via CLI?Thanks for your insights.

180
G
Employee
davetee
Community Manager
daveteeCommunity Manager
published in General Discussions
Community Roundup - Thursday, May 16, 2024

Happy Thursday All!  I hope you’re having a great week. I know it’s been a busy one so I’ve highlighted this week’s most popular articles and discussions in the community. Did I miss one of your favorites? Add it in the comments below! Here’s the list... @AricaFN ‘s article on extracting data from custom commands is a great discussion for anyone that has to go beyond the data model to tailor the Forward platform to their organization’s specific needs. @Christopher is on fire (hehe) with this new NQE query that uses the Forward Enterprise aclEntry object to provide consistent output from any Firewall vendor. And if you’re interested in automation, @Christopher’s article on interfacing with Forward with API and Python is a great example to follow.  @Mike ‘s complete NQE tutorial video series is the go to for anyone learning NQE or experts brushing up on the finer points.  Building on @cariddir‘s scripts, @RobertWelch create this plug-and-play NQE to unify the Fortinet Version output for

220
davetee
Community Manager
I
imageryanRamping Up
asked in General Discussions
Retrieval of Cisco Firepower device information

We have started to do some testing with FN. In our AWS network, we are using Cisco Firepower Threat Defense (FTD) devices managed by Firepower Management Console (FMC). FN is able to connect to an FTD and retrieve device details but does not support retrieval from FMC.In our network, for complicated routing reasons, we can’t easily enable FN to connect to our FTD instances. I can, however, provide a URL that will retrieve all the information from FMC. I would like to configure an “HTTP(S) external source” to provide that info. What I cannot figure out, however, is the required format for the data to that is returned by the URL GET. The document just states that FN will “infer” the schema. In my case, there’s no inference needed. I am writing the code that will return the info. I can format the data however FN needs it.For those who care about the details, the implementation is an AWS Lambda function that connects to the FMC REST API and returns the info. An AWS API gateway provides the

981
captainpacket
Employee
joe
Employee
joe
published in General Discussions
Incident Management: A Proactive Approach to Minimize DisruptionBeginner

Incident Management: A Proactive Approach to Minimize Disruption Experiencing an incident can be chaotic, with alarms sounding off and urgent communications flooding in, often at the least opportune moments. The key to effective incident management is not just to respond with urgency but to anticipate and mitigate issues before they escalate. The TL;DRTo effectively manage incidents, you must first establish visibility across and baselines of your network. Know what’s normal and what’s not. Ensure robust logs are being collected in a centralized manner, and contain all relevant details to facilitate troubleshooting. Develop your response team. Know their strengths and weaknesses, and ensure everyone on the team has skin in the game. publish playbooks, runbooks, and other procedural documents so everyone knows what is expected of them during an incident. Foster relationships with your peers and other teams long before an incident ever begins. And always strive to improve your incident m

440
joe
Employee
davetee
Community Manager
daveteeCommunity Manager
posted in General Discussions
Podcast - Understanding Where Digital Twins Fit in Today’s Tech Stack with Craig Johnson

Launch Podcast Join Craig Johnson (@captainpacket) and William Collins as they discuss the power of community, and then dig into the growth and adoption of Digital Twins and where they fit in today’s tech stack. Topics covered include:The Concept of Digital Twins in Networking: Drawing parallels to other industries like manufacturing. Craig explains that a digital twin is a digital representation of a real-world network, allowing for easier troubleshooting, visualization, and understanding of network components and configurations.  Evolution of Digital Twin with Cloud and Automation: Craig discusses the evolution of digital twin solutions, particularly in the context of cloud and automation. The conversation highlights the importance of extending digital twin capabilities to multi-cloud environments and standardizing network forwarding logic across vendors. Core Technical Components and Implementation: Craig outlines the technical components required for implementing a digital twin, fo

150
davetee
Community Manager
joe
Employee
joe
posted in General Discussions
Security Certifications

For those interested in security certifications, I wanted to pass along this hidden gem of certification training.Ben Malisow is an excellent technical editor and trainer, and is the guy behind the wannabea.. certification training programs. I would highly recommend his trainings for CISM, CISSP, CCSP, and SSCP for anyone interested in these certifications. - https://www.wannabeacism.com/

450
joe
Employee
joe
Employee
joe
posted in General Discussions
How to provide path search snapshot when working with support

Sometimes a path search may not present the results you expect. When engaging with support regarding a path search issue, you may be asked to provide a snapshot with the relevant path search data. To capture a snapshot of a path search, first perform the path search in question. In this example, we are performing a simple path search from atl-ce01 to atl-core-pe01: Now, press and hold the Alt or Cmd key, and the icon on the far right of the query bar will change from ‘Copy Query’ to ‘Export Query’. Click on the ‘Export Query’ icon: The Export Snapshot wizard will now display all devices relevant to that path, and allow you to add any additional devices you wish to add to the snapshot (if necessary).  Finally, obfuscate the IP and MAC addresses if necessary, and export the snapshot: This will allow you to download a zip file snapshot of the path search and all devices within the path of this search. This will provide the support team with all data necessary to investigate your path sear

470
joe
Employee
F
FSKAJRamping Up
asked in General Discussions
DeviceCollectionError Descrptions and sequence of PHASEs?

I am working on automated resolution of failed connections.   Two questions: (1) On this page in the documentation: /docs/nqe/data-model/type_devicecollectionerror/  there is a list of errors but no descriptions.  Can someone provide? (2) I am studying a failure report and the Connect Test Status notes each of these in PHASEs which seems to imply that each is determined in a sequence.  Is there a list of PHASE order for these? AUTHENTICATION_FAILED-AUTHENTICATION PHASEAUTHORIZATION_FAILED-AUTHORIZATION PHASECONNECTION_FAILED-CONNECTION PHASEDEVICE_IS_CHILD_CONTEXT-SETUP PHASEDEVICE_TYPE_MISMATCH-TYPE_DISCOVERY PHASEDEVICE_TYPE_UNDETECTED-TYPE_DISCOVERY PHASEGUEST_MISSING_HOST_RESULTS-SETUP PHASEJUMP_SERVER_AUTHENTICATION_FAILED-CONNECTION PHASEJUMP_SERVER_CONNECTION_FAILED-CONNECTION PHASEOTHER-AUTHORIZATION PHASEPING_FAILED-CONNECTION PHASEPORT_REACHABILITY_FAILED-CONNECTION PHASEPRIV_PASSWORD_ERROR-SETUP PHASEPROMPT_DISCOVERY_FAILED-SETUP PHASESESSION_CLOSED-TYPE_DISCOVERY PHASETIMED

952
F
deronjohnson
Employee
deronjohnsonEmployee
posted in General Discussions
Background on the Jump Server for FWD Enterprise

Background on the Jump Server for FWD Enterprise Forward Enterprise obtains data for path analysis primarily using industry-standard command-line interface (CLI) access. This is typically done with secure shell (SSH) read-only credentials provided to the platform so that configuration and state can be retrieved. In certain customer instances, it is required to limit SSH access to a specific host or hosts, which will more effectively audit and maintain the security of network devices. This is commonly known as the bastion or jump server. A jump server, jump host, or jump box is a computer on a network used to access and manage devices in a separate security zone. The most common example is managing a host in a DMZ from trusted networks or computers. A jump server is a hardened and monitored device that spans two dissimilar security zones and provides a controlled means of access between them. User access should be tightly controlled and monitored OpenSSH is commonly used for configurati

910
deronjohnson
Employee
  • Community Contributor
    AricaFNhas earned the badge Community Contributor
  • NQE Collaborator
    gbaronhas earned the badge NQE Collaborator
  • Community Contributor
    CarlBhas earned the badge Community Contributor
  • Community Contributor
    gbaronhas earned the badge Community Contributor
  • Community Contributor
    Christopherhas earned the badge Community Contributor
Show all badges
Terms of UseCookie settings