Learn NQE

what scripting language NQE use?

In this NQE Video, I am going cover and how to use let and group-by qualifiers.Join me for a look at the two NQE qualifiers, let and group-by.Code examples used in videoforeach device in network.deviceslet deviceName = device.namelet affected_interfaces = (foreach interface in device.interfaces group interface.name as interfaces_name by interface.operStatus as oper_status select { int: interfaces_name, oper: oper_status,})foreach entry in affected_interfacesselect { deviceName: deviceName, interfaceNames: entry.int, operStatus: entry.oper}LetUsing let to assign expressions that make the code more easily readable, in this case assigning the device OS version and operating system to variables and filtering on them foreach device in network.deviceslet version = device.platform.osVersionlet os = device.platform.oswhere os == OS.ARISTA_EOS && matches(version, "4.15*")select { deviceName: device.name, version: version, os: os}Grou

I hope everyone had a relaxing holiday and New Year!Now that we are getting back into the swing of things, do you suspect there are rogue devices in your network, but you have no easy way to find them?  I remembered what I had to do back in the day to find rogue devices, and needless to say, it was not easy to find them.  Could Forward Networks help Mike find these rogue devices?  I had the same question, and I enlisted the help of our resident NQE expert, Jack Shen, to see if we could identify and locate where these unwanted devices are easily.  Code example used in the demoThe NQE query that was used in the video to find if there were any Huawei devices in their network is below. foreach device in network.devicesforeach host in device.hostswhere isPresent(host.macAddress)let assigneeName = ouiAssignee(host.macAddress)where isPresent(assigneeName)let vendor = toUpperCase(assigneeName)select { violation: matches(vendor, "HUAWEI*"), deviceName: device.name, deviceInterfaces: host.int

In todays NQE Video, I will show you the basics of using if expressions and how to use them when you want to create your own multi-vendor parser.Code examples used in videoThis particular parser is going to look at DNS servers and check to make sure that they are configured with the appropriate servers.dns_addresses = [ipAddress("1.1.1.1"), ipAddress("1.0.0.1")];ios_xe = ```ip name-server {dns:ipv4Address+}```;arista = ```ip name-server vrf {string} {dns:ipv4Address+}```;palo_alto = ```config devices localhost.localdomain deviceconfig system dns-setting servers primary {dns:ipv4Address+} ```;cisco_asa = ```dns server-group {string} name-server {dns:ipv4Address+}```;generic = ```dns {dns:ipv4Address+}```;foreach device in network.deviceslet os = device.platform.oslet dns_pattern = if os == OS.PAN_OS then palo_alto else if os == OS.IOS_XE then ios_xe else if os == OS.ARISTA_EOS then arista else if os == OS.ASA then cisco_as

In today's video I will introduce the NQE foreach and where statements. We explore the data model and how to start off your NQE queries as well as go into when and why you would want to use a where statement.Code examples used in videoReturn all IPsec tunnels and create a report of the peer IP address, interface status and operational statusforeach device in network.devicesforeach interface in device.interfaceswhere interface.interfaceType == IfaceType.IF_TUNNEL_IPSECselect { deviceName: device.name, tunnelName: interface.name, peerIP: interface.tunnel.dst, adminStatus: interface.adminStatus, operStatus: interface.operStatus}You could modify the above to violate if the administrative status is up but the operational status not up with the following NQE query:foreach device in network.devicesforeach interface in device.interfaceswhere interface.interfaceType == IfaceType.IF_TUNNEL_IPSECselect { deviceName: device.name, tunnelName: interface.name, peerIP: interface.tunnel.dst, v

 Join Mike on a journey to introduce a feature of the Forward Enterprise platform called the Network Query Engine (A.K.A NQE) and why it will make your job as a network or security operator much easier.   Let us know what you think about NQE; what do you see yourself using it for?  If you have any questions ask them below 👇🏻 Code example used in videoReturn a violation if an interface on a Cisco IOS XE device is administratively up but operationally downforeach device in network.devicesforeach interface in device.interfaceswhere device.platform.os == OS.IOS_XEselect { deviceName: device.name, interfaceName: interface.name, adminStatus: interface.adminStatus, operStatus: interface.operStatus, violation: interface.adminStatus == AdminStatus.UP && interface.operStatus != OperStatus.UP} 

Join me for a look at the comparisons you can use in NQE to filter out on what data you need to see in your query. Code examples used in videoUsing equals (==) to return any default routes in any VRF foreach device in network.devicesforeach networkInstance in device.networkInstanceslet afts = networkInstance.aftslet ipv4Unicast = afts.ipv4Unicastforeach ipEntry in ipv4Unicast.ipEntrieswhere ipEntry.prefix == ipSubnet("0.0.0.0/0")foreach nh in ipEntry.nextHopswhere isPresent(nh.ipAddress)select { deviceName: device.name, vrfName: networkInstance.name, RouteEntry: ipEntry.prefix, nextHop: nh.ipAddress}Using not equal to (!=), to exclude ASA’s a platform inventory reportforeach device in network.deviceswhere device.platform.model != "ASAv"select { deviceName: device.name, deviceModel: device.platform.model }Choose whether or not to report on interface MTU that is:Greater than 1500 ( > ) Greater than or equal to 1500 ( >= ) Less than 1500 ( < ) Less than or equal to 1500

Join me on an introduction to working with Lists in NQE. We cover some of the basic list comparisons and the list function length().Code examples used in videoReturn all Arista devices, and if the device is not running the approved OS, return a violation for that deviceapproved_os = ["4.15.0F"];foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSselect { violation: device.platform.osVersion not in approved_os, name: device.name, version: device.platform.osVersion} There is another way to write this query. We can write it so that it will only return all devices that are violating versus returning every device and violating the devices that are not compliant. This query would look like:approved_os = ["4.15.0F"]foreach device in network.deviceswhere device.platform.os == OS.ARISTA_EOSwhere device.platform.osVersion not in approved_osselect {violation: truename: device.name, version: device.platform.osVersion} We are using where only to filter devices that are run

In todays video, we are going to look at the basics of working with numbers and booleans in NQE.  Code examples used in videoCheck to make sure that the distribution switches that run spanning-tree in a newly acquired DC are running the correct root bridge priority, if not show a violation rbPri = 5297;foreach device in network.devicesforeach stpRoot in device.stp.rapidPvst.vlanswhere matches(device.name, "sjc*dist*")select { violation: rbPri != stpRoot.bridgePriority, device: device.name, vlanID: stpRoot.vlanId }Any questions or comments, post them in the comments below 👇🏻

In todays video, we are going to go into a deeper dive on the NQE files tab. We discuss the different states the NQE queries can be in and go over the permission structure in NQE. Any questions or comments, feel free to post them below

We created the Forward Networks Community as a place to share NQE solutions and collaborate on innovative ways to better understand our networks. Network Query Engine (NQE) enables your network and security teams to search your network just like a database. NQE provides an open platform for accessing information about your network in easy to read reports and diagrams. This offers an interface for the uniform presentation of dozens of vendors, thousands of devices, billions of lines of configuration code, and multiple public cloud providers across your enterprise network.  ❗Before you share any NQE script or screenshots from Forward Networks, ensure you remove sensitive information. This may include host names, IP addresses, company names, or other information you’d prefer to keep private. You can also choose an anonymous username if you wish to have an additional layer of privacy.  What to include when you share an NQE: What it doesInclude a short description of what your NQE script do

 Curious on how to work with strings in NQE?  This video covers the basics of working with the String datatype in NQE.  Let us know what have you done with strings that made your co-workers say “How did you do that!”  Post your queries or questions below 👇🏻 Code examples used in videoReturn all devices where the first three characters of the device name is atlforeach device in network.deviceswhere prefix(device.name, 3) == "atl" select { deviceName: device.name}Return all devices where the beginning of the device name is atlforeach device in network.deviceswhere matches(device.name, "atl*")select { deviceName: device.name}Return all devices where the beginning of the device name is atl and contains the word spineforeach device in network.deviceswhere matches(device.name, "atl*spine*")select { deviceName: device.name} 

 In todays NQE video, join Mike on learning how to navigate the NQE library!    Have any questions?  Post them in the comments below 👇🏻