Skip to main content

NQE

Network Query Engine (NQE) enables your network and security teams to search your network just like a database. NQE provides an open platform for accessing information about your network in easy to read reports and diagrams.

  • 165 Topics
  • 0 Replies
165 Topics
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
NQE Query to list prefixes advertised to public BGP peers

This query returns a list of devices, their public BGP peers, and the prefixes advertised to each peer. Note that the line where neighbor.neighborAddress not in nonPublicIps limits the output to peers whose IP is not an RFC 1918 or link-local IP address. /*** @intent Lists public BGP peers and what prefixes are advertised to them*/ import "@fwd/L3/IpAddressUtils"; // The prefixes that are advertised from device to neighborAddressgetAdvRoutes(device, neighborAddress) = foreach x in [1] where isPresent(device.bgpRib) let bgpRib = device.bgpRib foreach afiSafi in bgpRib.afiSafis foreach neighbor in afiSafi.neighbors where neighbor.neighborAddress == neighborAddress where isPresent(neighbor.adjRibOutPost) let adjRibOutPost = neighbor.adjRibOutPost foreach route in adjRibOutPost.routes select distinct route.prefix; // List of IP subnets to excludenonPublicIps = ipAddressSet(privateSubnets + [ipSubnet("169.254.0.0/16")]); foreach device in network.devicesforeach networkInstance in device.net

180
Christopher
Employee
GTurner
Employee
GTurnerEmployee
posted in NQE Discussions
Normalized Ranking Without Sorting in NQE

Motivation A customer recently approached me with a challenge: they wanted to feed downstream systems with ordered and banded firewall data. Specifically, they had the following use cases: Identify Top-N firewalls based on configuration complexity and other attributes like greatest number of permissive or shadow rules. Flag percentile-based thresholds for various attributes (e.g., top 10%, bottom 25%) Enable dynamic device selection for exhaustive, compute-heavy rule analysis The challenge? NQE is designed for efficient set-based analysis, therefore it doesn’t require sorting or ranking functions in general. Nevertheless, this customer’s use case called for an approach to simulate these behaviors without external processing. So instead of relying on a built-in sort function, we can create a lightweight, math-driven approach that simulates ranking behavior. It’s fast, deterministic, and works entirely inside the NQE layer so that no external processing or comparisons are required. In th

380
GTurner
Employee
I
IvanRamping Up
asked in NQE Discussions
Is it possible to use regex in a pattern block?

I am trying to match against a Palo Alto configuration looking for rules that are using a specific destination object. Rules are under this structure: config devices {string} vsys {string} rulebase security rules {rule_name: (string)*} and an example of what I am trying to match is: "Example Rule" e32ff2ab-a82f-43b6-953e-7e113v624779 { destination [ non-client "External SRC EDL" "Another EDL-wehave"]; First line would be the rule name and the second is where I would really want to do the regex match. The items past “destination” can be a single entry or multiples within []’s. If there are spaces in the names then the whole name is confined in “’s. My goal is to find all rules which have “External SRC EDL” in the destination and I can’t quite figure out how to do it. Any help would be appreciated.

452
I
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
How can i get output in single coloum 

How can i get output in single coloum . team , i am using below query to get the NTP Server data , however is tried all option to get the output in single coloum , but i am not sucess. NQE Query ciscontppattern= ``` ntp server {server:string} ```; ciscontppattern2= ``` ntp server {vrf:string} {dir:string} {ser:ipv4Address} ```; patternf5 = ``` sys ntp servers { server1:string} {server2:string} ```; cisco1(device) = foreach command in device.outputs.commands let response = parseConfigBlocks(device.platform.os, command.response) foreach match in blockMatches(response, ciscontppattern) select match.data.server; cisco2(device) = foreach command in device.outputs.commands let response = parseConfigBlocks(device.platform.os, command.response) foreach match in blockMatches(response, ciscontppattern2) select match.data.ser; getServers(device) = foreach command in device.outputs.commands where command.commandText == "list sys ntp" let filtered_response = replace(command.response, "{", "") let f

586
R
Spotter
S
Driver
SteveBamfordDriver
asked in NQE Discussions
Arista APs Validate only authorised SSIDs have been configured.

This NQE will validate that only the SSID’s in allowedSSID’s can be used, if it does not exists in the list it will fail the query. Taking advice from an earlier post I have used blockMatches this time, there is some tuning required to remove the duplicates as a result of the table have the entry for each /** * @intent Validate that the arista AP's have only the approved SSID's configured * @description This will check each arista AP for the approved SSIDs and violate when ther SSID does not match * the allowedSSID list. * * You will get multiple entries due to the VAPS list having an entry for each frequency. This will be a future * fix to show only once when the unauthoirised SSID exists */pattern = ```VAP-ID : {VAPId:string} ESSID : {SSID:string}```;// Replace the SSID's with your own.allowedSSID = ["ssid1","ssid2","ssid3"];foreach endpoint in network.endpointswhere endpoint.profileName == "Arista Wireless AP's"foreach command in endpoint.cliCommandResponseswhere command.command ==

90
S
Driver
S
Driver
SteveBamfordDriver
asked in NQE Discussions
Arista WIFI Validate AP Version

Following on from I thought I would share this NQE if others are using Arista AP’s and want to maintain version numbers across their estate. /** * @intent List all Arista AP's and there software version. * @description List all Arista AP End Points and there software version. */ allowedVersion = "18.0.0"; foreach endpoint in network.endpointswhere endpoint.profileName == "Arista Wireless AP's"foreach command in endpoint.cliCommandResponseswhere command.command == "show device info" let ParsedResponse = parseConfigBlocks(OS.UNKNOWN,command.response)foreach line in ParsedResponselet modelNo = patternMatch(line.text,`Device Model : {string}`)foreach line in ParsedResponselet software = patternMatch(line.text, `Device Version : {string}`)foreach line in ParsedResponselet serialNo = patternMatch(line.text,`Serial Number : {string}`)where isPresent(modelNo)where isPresent(software)where isPresent(serialNo)select { violation: software != allowedVersion, name: endpoint.name, location: endpoint

152
S
Driver
cariddir
Spotter
cariddirSpotter
posted in NQE Discussions
Enhancing Inventory with NQE

I have put together a query to enhance inventory by adding LDoS dates and ‘approved software’. It has greatly improved our Life Cycle Mgmt. conversations. The CSV Files reside separately in a ‘standards’ folder. (there are just too many fields to keep in the same script). The resulting output provides:Vendor | Hostname | Model | Location | Vendor LDoS Date | HW Compliance Date | Current OS | Approved OS | Compliance to OS | Replacement Mode | And more /** * @intent Inventory of all devices in FN * @description Take inventory and then cross check them against the CSV Files for SW/HW info**/ import "Home/Network Standards/01_NetworkVars/99_Support_Detailed";foreach device in network.deviceslet platform = device.platformlet snapshotInfo = device.snapshotInfo foreach entry in deviceSupportDetailwhere entry.Model == platform.modellet LDOS = entry.HW_LDoSlet STATUS = entry.LCMlet comma = ", "let ApprovedSW = entry.SW_N + comma + entry.SW_N1 + comma + entry.SW_N2let Replacement = entry.HW_Rep

3054
RobertWelch
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
asked in Koan Challenges
Play our NQE Koan Challenge - Group People by Age

Hello NQE Enthusiasts, I’ll try to post a new Koan Challenge every two months. Challenge This task is to take the following table and group people by age. Input [{ Name: "Bob" , Age: 21 }, { Name: "Sam" , Age: 19 }, { Name: "Jill" , Age: 18 }, { Name: "Jim" , Age: 21 }, { Name: "Sally" , Age: 19 } ]; Example Result [{Age: 21, Count: 2}...] Hint https://fwd.app/docs/nqe/guides/comprehensions/#group-by-qualifier Contributions: Unclaimed

130
Tyson Henrie
Employee
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
Using an NQE Query in Inventory+ with Diffs

It is possible to compare the output of an NQE query using the Diffs feature by first adding the NQE query to Inventory+. Consider the following NQE query, which lists all the static routes on all devices. (Note that the next hop is listed in this example provided that the next hop is an IP address. The query could be expanded to handle other types of next hops). getStaticRoutes(routingTable) = foreach ipEntry in routingTable.ipEntries foreach nextHop in ipEntry.nextHops where nextHop.originProtocol == OriginProtocol.STATIC select { prefix: ipEntry.prefix, nextHopType: nextHop.nextHopType, nextHop: ipEntry.nextHops }; foreach device in network.devicesforeach networkInstance in device.networkInstanceslet afts = networkInstance.aftswhere isPresent(afts.ipv4Unicast)let ipv4Unicast = afts.ipv4Unicastlet staticRouteCount = length(getStaticRoutes(ipv4Unicast))where staticRouteCount > 0foreach entry in getStaticRoutes(ipv4Unicast)select { Device: device.name, "Network Instance": networkInstan

290
Christopher
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in NQE Discussions
Input device under maintenance. Get back the BGP peers and outbound interfaces between the devices.

I provided a query for doing this some time ago. However, it was written for running where the Data Model did not have as many BGP elements as the current Data Model. Now that there are more BGP elements in the data model it makes this query much simpler. Which also means it runs faster. The inspiration for this query was a customer that run BGP between pretty much all devices. This is why it is only based on BGP peers. /** * @intent Input the device under maintenance. get the list of BGP peers and outbound interfaces * @description This is a Parameterized Query. You input the devicename string. * it will look for the BGP peers of that devices, plus determine the interfaces that connect the * devices together. This way you can mute the alarms for the BGP peers and links before a maintenance window. */ import "@fwd/L3/Interface Utilities"; //getL3Interfaces(device: Device) getPeerInfo(neighbor, sourceRouterId) = max(foreach device in network.devices where device.name == neighbor.peerDev

180
Tyson Henrie
Employee
R
Employee
RenataBudkoEmployee
published in NQE Discussions
Enhancing STIG Compliance Checks with Parameterized QueriesIntermediate

When working with STIG compliance checks, a common challenge is that many checks only verify the existence of a control—not whether the configured values align with site-specific requirements. This can be a problem when compliance policies vary across different data centers and locations. With a little work, it is easy to customize the queries. Benefits are apparent. You get: more precision to verify your specific ACL and group names Verifying differing configuration policies across multiple data centers or locations Improved compliance and governance across a variety of configurations and regions There are two approaches you can use to customize queries. Copy the query and modify the block match to include the value of your parameter Parametrize the query and use your location-specific string value as a query parameter. Parameterized queries are slightly more complex but make existing STIG checks - and other NQEs - more flexible. Let’s use an example of a library STIG query /Forward L

420
R
Employee
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
Merge multiple NQE Query in single view.

we are using 4 different query to get some information in FWD , is their any way to merge these queries into one and get the output in single file. Query 1 for NTP Fortinet :- pattern_fmg = ``` config system ntp config ntpserver edit 1 set server {ntp1:string} ```; pattern_servers = ``` config system ntp config ntpserver edit 2 set server {ntp2:string} ```; pattern_servers2 = ``` config system ntp config ntpserver edit 3 set server {ntp3:string} ```; // Loop through list of devices finding those that are Fortinet // and store outputs of commands in the 'outputs' variable // Loop through list of devices finding those that are Fortinet foreach device in network.devices /* where device.platform.vendor == Vendor.FORTINET */ let outputs = device.outputs // Loop through the commands in the outputs var, looking for custom // commands that are from 'show system ntp' and store in a variable called central_mgmt foreach command in outputs.commands where command.commandType == CommandType.CUSTOM w

752
R
Spotter
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
NQE Query - Seeing multiple Values for single devices.

Team , we are using belong NQE to get the information about Fortinet Firewall SNMP config and server white list information , however NQE provide the result , but devices are repeating ,ex, 1 devices we can see approx. 44 entry , can you please have a look on this and help us to fix . NQE Query // Patterns to match pattern_community= ``` config system snmp community edit {string} set name {community:string} config hosts edit {string} set ip {ip:string} {netmask:string} next ```; foreach device in network.devices let outputs = device.outputs foreach command in outputs.commands where command.commandType == CommandType.CUSTOM where command.commandText == "show system snmp community" let central_mgmt = parseConfigBlocks(OS.FORTINET, command.response) // Search for the ""pattern_fmg" pattern looking for a match foreach match in blockMatches(central_mgmt, pattern_community) //loop through the all server-address IP's and store them in variable "servers" let servers = (foreach server in blockM

191
Andreas
Employee
cariddir
Spotter
cariddirSpotter
posted in NQE Discussions
NQE to Pull Cisco WAP OS Version from Cisco (IOS-XE) WLC's.

Continuing scripts to pull more information from Cisco WLC’s. Find my original Cisco WAP post here: Pre-requisites: Add Custom Command to IOS-XE for collection “show ap image | inc None” Add Tag of “WLC” on your Wireless Controllers WLC’s are on c9800 running IOS-XE IOS-XE version is 17.x.x /*** @intent - pull Name & OS Versions from Cisco AP's via Cisco WLC's* @description Log into Cisco WLC's "C9800" and pull AP information from the controllers with "show ap image | inc None"**/ // Pattern of output//AP_INFO = ```{APName:string} {PrimaryOS:string} {BackupOS:string}```; foreach device in network.deviceslet platform = device.platformforeach Tag in device.tagNameswhere Tag == "WLC" foreach Command in device.outputs.commandswhere Command.commandText == "show ap image | inc None"let parsed = parseConfigBlocks(OS.IOS_XE, Command.response) //parses text into lineslet matchData = blockMatches(parsed, AP_INFO) //applies pattern to lines foreach x in matchData select { name: device.name, Locat

450
cariddir
Spotter
cariddir
Spotter
cariddirSpotter
posted in NQE Discussions
NQE to Pull Cisco WAP information from WLC's.

We continue to rely almost exclusively on Forward Networks for our lifecycle management and planning (purchasing). One of the big gaps, however, was I couldn’t get the Wireless Access Points on the network, and had to go to other devices and export it into excel. Not terrible, but time consuming. You can also check out my related post: I threw together simple script to collect the Cisco AP’s “Name/Location/AP-Model/IP-Address/Country-Code. ​@AhmedKhedr Pre-requisites: Add Custom Command to IOS-XE for collection “show ap sum” Add Tag of “WLC” on your Wireless Controllers WLC’s are on c9800 running IOS-XE IOS-XE version is 17.9.6 It appears older versions of OS (<17.9.6) don’t align nicely, but i’m sure you can adjust for it using the core of this script. I’m adding one more table to this, to pull the LDoS date from the model that is pulled from the custom command… which I will update when I get it to work ;-) /*** @intent - pull Name & Model & IP address* @description Log into Cisco WLC

442
cariddir
Spotter
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
Using NQE to verify NTP servers are configured for multiple vendors

Is often necessary to audit the same setting across multiple vendors. For example, you can use the following NQE query to list the NTP servers on both Cisco IOS and Fortinet devices. patternFortinet = ```config system ntp set ntpsync enable set type custom config ntpserver edit {number} set server {ntpServer:string}```; patternCisco =```ntp server {ntpServer:string}```; getNtpServers(parsedCommand, ntpPattern) = foreach match in blockMatches(parsedCommand, ntpPattern) select { serverIP: match.data.ntpServer }; getFortinetNtpServers(device) = foreach command in device.outputs.commands where command.commandText == "show system ntp" let parsedCommand = parseConfigBlocks(OS.FORTINET, command.response) foreach server in getNtpServers(parsedCommand, patternFortinet) select server.serverIP; getCiscoNtpServers(device) = foreach server in getNtpServers(device.files.config, patternCisco) select server.serverIP; foreach device in network.deviceslet ntpServers = when device.platform.os is FORTINET

340
Christopher
Employee
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
how can i convert OS EOL query into basis of vendor and version

how can i convert OS EOL query into basis of vendor and version ? as of now in OS Support query showing output via device wise , i want to see this in to vendor os wise.

443
AricaFN
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in Koan Challenges
Play our NQE Koan Challenge - Calculate Centuries

Hello NQE Enthusiasts, Here is another Koan challenge. The task is to take a list of years and calculate the centuries Input:[1776, 2001, 1643, 1969]; Result[{“Year”: 1776, “Century”: 18}...] Hints: Use string conversions like toString Create a toNumber function Try not to look at the replies until you have tried the challenge yourself.

674
davetee
Community Manager
cariddir
Spotter
cariddirSpotter
posted in NQE Discussions
NQE for reporting on Encryption Level For Cisco IOS/IOS-XE/NX-OS

I was asked to do pull all the password encryption methods for Cisco (route-switch) devices from our security team. Here are a couple of NQE that I wrote to send off to the security team, hopefully it might be of use to someone else. They are pretty simple but if anyone has recommendations to enhance or combine into a single script, lemme know! Results: Showing IOS/IOS_XE Devices Nexus - ** Add custom command to collection for NX-OS Devices show run | grep admin password /** * @intent Show encryption level and method on Cisco NX-OS devices * Test * @description Use CSV table below to match Encryption Level to Method * add custom command for NXOS devices: show run | grep admin password**/Encrpytion = """csvEncryLvl,EncryMeth9,SCRYPT-Hash5,MD54,SHA25610,SHA5127,Cisco_Type7-Algorithm0,No-Encryption"""; pattern1 = ```{username:string} {admin:string} {PW:string} {Level:number} {str:string} {role:string} {NA:string}```; foreach device in network.deviceslet platform = device.platformwhere pla

683
Mullers
Employee
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
Finding a list of devices based on a list of IP addresses from a traceroute

It may be useful to compare the output of a traceroute against the Path Search output from Forward Networks. The following NQE query takes a list of IP addresses as a parameter, and returns a list of devices based on interface IPs. This query could be used while onboarding sources into Forward Networks. If there is no device entry for an interface IP address from this NQE, it could mean that the device with that IP address needs to be added to the collection (to Sources). If there is overlapping IP space in the network - for example, if private IP space for network interface IPs at difference locations is the same - this query will return ALL the devices with a given interface IP. Note that Forward Networks’ Path Search is superior to traceroute in that Path Search will shows layer-2 hops and cloud network objects that don’t respond to traceroute. import "@fwd/Interfaces/Interface IPs"; deviceIps = foreach device in network.devices select { device: device.name, ips: (foreach record in

490
Christopher
Employee
R
Spotter
Rohit_809 KumarSpotter
posted in NQE Discussions
how can i get information about device uptime ?

how can i get information about device uptime ?

463
davetee
Community Manager
A
Employee
andrewcarverEmployee
posted in NQE Discussions
Identifying Devices with Inbound/Outbound ACLs Configured on Interfaces

This NQE can be a quick way for you to identify interfaces and subinterfaces with configured ACLs. This could be invaluable from a couple angles: path analysis/troubleshooting and audit. Check it out! Let me know what you think! *I put both where length(acls.inboundAclNames) > 0 && length(acls.outboundAclNames) > 0 and where length(acls.inboundAclNames) > 0 || length(acls.outboundAclNames) > 0 because I feel both can have benefit in their own circumstances. foreach device in network.devicesforeach interface in device.interfacesforeach subinterface in interface.subinterfaceslet acls = subinterface.aclswhere length(acls.inboundAclNames) > 0 && length(acls.outboundAclNames) > 0// where length(acls.inboundAclNames) > 0 || length(acls.outboundAclNames) > 0select { deviceName: device.name, asset: device.tagNames, interfaceName: interface.name, subinterfaceName: subinterface.name, inboundAclNames: acls.inboundAclNames, outboundAclNames: acls.outboundAclNames}

200
A
Employee
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
How can i get Fortianalyzer details from fortinet firewall ?

Team, i am collecting frtianazlyer data from fortinet firewall via custom command , however i tried below query to get the data . pattern_faz = ``` config log fortianalyzer setting set status enable set server {faz:string} ```; foreach device in network.devices /* where device.platform.vendor == Vendor.FORTINET */ let outputs = device.outputs foreach command in outputs.commands where command.commandType == CommandType.CUSTOM where command.commandText == "show log fortianalyzer setting" let configurations = parseConfigBlocks(OS.FORTINET, command.response) foreach match in blockMatches(configurations, pattern_faz) /* where !matches(device.name, "*_*") */ select { deviceName: device.name, SiteName: device.locationName, "Primary DNS": match.data.faz, } but unfortunatelly i m getting zero result. can anyone help on this

321
R
Spotter
deronjohnson
Employee
deronjohnsonEmployee
published in NQE Discussions
Find the Uptime of Your Network Devices (5 minutes or less)Beginner

Discover insightful network performance metrics—without having to write a single character of code. In this article, you'll learn how to quickly check the uptime of your network devices using the Forward Platform. It’s an easy introduction to show you how to extract network insights using Forward’s built-in capabilities. Log in to your Forward Platform In the left navigation, scroll down to the NQE section and click Library. At the top of the query window, click the New query icon When prompted, provide a unique name for your query. Save time finding scripts - create a folder to store you new scripts in one place Your query is now open and ready to edit. Remember, you’re not writing one character of code. On the far right side of the window, click the Data Model tab. Type uptime in the search field. This displays elements in the Forward data model that pertain to uptime. Hover your cursor over the first result - uptime:Duration. A dialogue displays a description of this data model attr

510
deronjohnson
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in NQE Discussions
Check whether the interface Description field contains the name of the connected device

This is to discuss a common practice with the use of the interface Description field. It is really common to look at CDP or LLDP and find the neighbor device name, then put that remote device name into the interface Description of the interface that connects these two devices together. It is also common to add the remote device interface as well. /** * @intent Verify if the interface description includes the device name of the linked device * @description Use the Link element of the data model to determine the device name and interface * of a networking device that is connected to this interface. * Verify that the remote device name and remote interface an included in the interface Description. */ export getL3Interfaces(device: Device) = foreach iface in device.interfaces where length(iface.links) > 0 foreach ifaceIpInfo in getSvis(iface) + getSubIfaces(iface) select { name: ifaceIpInfo.name, adminStatus: ifaceIpInfo.adminStatus, operStatus: ifaceIpInfo.operStatus, ipv4: ifaceIpInfo.ip

440
Tyson Henrie
Employee

Most helpful members this week

  • Community Champ Award
    CarlBhas earned the badge Community Champ Award
  • Community Champ Award
    Christopherhas earned the badge Community Champ Award
  • NQE Collaborator
    Rohit_809 Kumarhas earned the badge NQE Collaborator
  • Community Champ Award
    Vladi Bhas earned the badge Community Champ Award
  • Community Champ Award
    dakotagloryhas earned the badge Community Champ Award
Show all badges

Popular tags

Terms of UseCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings