Skip to main content

NQE

Network Query Engine (NQE) enables your network and security teams to search your network just like a database. NQE provides an open platform for accessing information about your network in easy to read reports and diagrams.

  • 177 Topics
  • 0 Replies
177 Topics
Mike
Community Manager
MikeCommunity Manager
published in Learn NQE
Getting Started with NQE - The Complete SeriesBeginner

Want to use NQE to gain insights into your network, but don’t know where to begin? Follow along as I cover the basics of NQE and shares example queries. Have questions? Ask them below! 

8580
Mike
Community Manager
chrisnaish
Employee
chrisnaishEmployee
published in NQE Discussions
Default Outbound Access in Azure is Retiring — Are You Ready?Beginner

On September 30, 2025, Microsoft will retire the default outbound access method for Azure VMs. This means any new deployments without an explicitly configured egress path (like a NAT gateway or public IP) will no longer have outbound Internet access by default. Why does this matter? Default outbound access is:Implicit and brittle — IPs are assigned by Microsoft and can change without notice Insecure — Opens potential paths to the internet that may go unnoticed Deprecated — Will soon be unavailable for new resources Microsoft recommends using explicit outbound connectivity, such as:Subnets associated with a NAT Gateway VMs in the backend pool of a standard Load Balancer with outbound rules VMs with explicitly assigned public IPs      Read Microsoft’s official guidance How to Audit Your Azure Subnets for Missing NAT Gateways With Forward Networks, you can identify Azure subnets that have Internet-bound routes but no associated NAT Gateway — a risky configuration in today’s Zero Trust wor

120
chrisnaish
Employee
C
Spotter
CarlBSpotter
asked in NQE Discussions
Is there a media type inside the data model?

I am trying to locate all of my fiber 100Mbps interfaces because they are being phased out by various vendors and not supported on newer equipment.The data model has an interface speed value (ethernet.speedMbps) but not seeing a medial type - I can see both inside the interface details however the speed/media is naturally in strings without spaces so challenging to pull out. I was looking to see if both speed and media types were in the data model for a simple NQE vs having to parse out the interface details. Also the interface speed value (ethernet.speedMbps) but it appears that if bandwidth is statically configured, that value is used - on Cisco devices bandwidth can be set to value for protocol calculation but is not necessarily matching the actual interface speed.  

242
AricaFN
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in Koan Challenges
Play our NQE Koan Challenge - Finding Nemo

Hello NQE Enthusiasts, It has been two months, so time for another challenge. ChallengeThe task is to list Name, Age and Pets owned by all people under 20 years old, that own fish. Input:persons =[{ Name: "Tim", Age: 21, pets:["dog", "mouse", "fish"] }, { Name: "Mark", Age: 19, pets: ["dog", "fish", "cat"] }, { Name: "Nina", Age: 18, pets: ["snake", "lizard"] }, { Name: "Leroy", Age: 24, pets: ["fish"]}, { Name: "Sally", Age: 11, pets: ["dog", "fish"] }]; Example Result[Name,  Age, Pet…….]  Contributions: Unclaimed

382
N
J
john_hayesRamping Up
asked in NQE Discussions
Forward NQE to Identify Unused Firewall Rules

Is it possible to write a Forward NQE query that will produce a list of firewall rules that have not been used in the last 90 / 180 / 365 days (based on hit count)?  It would be helpful to have firewall name, the rule ID numbers, and last used date/time if possible.

541
AricaFN
Employee
G
Spotter
gbaronSpotter
asked in NQE Discussions
OS Support NQE (Forward Library)

After some digging and working with other FN personnel, it appears that the above mentioned NQE is missing all 17.12, and all 03. IOS versions in the data model for the OS Support NQE report.  This was determined first by modifying an NQE to run a check against the OS Support and return violations for those IOS that are no longer supported, which would come back as failed.  Good IOS would report as pass.  However, the above mentioned IOSs all returned a value of “Indeterminate”.  Which then made us look at the OS Support NQE itself and the devices associated with the above/below IOS versions are not listed on the report, but they are in the regular inventory. Known Affected IOS (from our known devices):03.01.0103.07.04E03.11.03a03.11.0503.11.0817.12.0317.12.0417.12.04a17.12.04b

493
G
Spotter
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
NQE Query to list prefixes advertised to public BGP peers

This query returns a list of devices, their public BGP peers, and the prefixes advertised to each peer.Note that the line     where neighbor.neighborAddress not in nonPublicIps limits the output to peers whose IP is not an RFC 1918 or link-local IP address./*** @intent Lists public BGP peers and what prefixes are advertised to them*/import "@fwd/L3/IpAddressUtils";// The prefixes that are advertised from device to neighborAddressgetAdvRoutes(device, neighborAddress) = foreach x in [1] where isPresent(device.bgpRib) let bgpRib = device.bgpRib foreach afiSafi in bgpRib.afiSafis foreach neighbor in afiSafi.neighbors where neighbor.neighborAddress == neighborAddress where isPresent(neighbor.adjRibOutPost) let adjRibOutPost = neighbor.adjRibOutPost foreach route in adjRibOutPost.routes select distinct route.prefix;// List of IP subnets to excludenonPublicIps = ipAddressSet(privateSubnets + [ipSubnet("169.254.0.0/16")]);foreach device in network.devicesforeach networkInstance in de

532
Tyson Henrie
Employee
Christopher
Employee
ChristopherEmployee
published in NQE Discussions
Create an exportable function to validate a device setting for any device typeIntermediate

Is often necessary to audit the same setting across multiple vendors.For example, the NTP server setting differs across vendors.You can write an exportable function that returns the NTP servers for ANY device type.The following NQE query creates a reusable function called getNtpServers with the export command. The function takes a single argument device and returns a list of NTP servers based on the device type. A different function is called using the when statement based on the OS. Note that the NTP server configuration in Cisco devices is in the device.files.config file (the running configuration), but for Fortinet and F5 devices you need the result of a Custom Command to see the NTP configuration.Note also that the same nested function getCiscoNtpServers is used for multiple Cisco OS types.If you find an OS type or pattern that isn’t identified, you can add in new patterns and functions, or alter or expand the patterns already included./** * @intent Helper function getNtpServers(de

903
G
Spotter
Christopher
Employee
ChristopherEmployee
published in NQE Discussions
Using NQE to Perform Configuration BenchmarksIntermediate

Often you need to verify that the configuration of your network matches certain requirements. These could be standard benchmarks, such as CIS benchmarks, or internal benchmarks specific to your environment.For example, you may need to:Verify that all Cisco devices have only SSH version 2 enabled Verify that all Palo Alto devices have a login banner set Verify the mininum password length for Fortinet devicesYou can verify these settings, or anything else in the configuration, using NQE. Verify that all Cisco devices have only SSH version 2 enabled The following query looks for the exact pattern ssh version 2 in the device configuration file (device.files.config). If the pattern does not exist (!checkpattern), then the violation will be True. pattern =```ssh version 2```;checkPattern(config) =hasBlockMatch(config, pattern);foreach device in network.deviceswhere device.platform.vendor == Vendor.CISCOselect {device: device.name,os: device.platform.os,violation: !checkPattern(device.files.c

1592
Christopher
Employee
shyawnkarim
Employee
shyawnkarimEmployee
published in NQE Discussions
Make Critical Info Pop in NQE TablesBeginner

In Inventory, you have probably noticed how some table columns make it easy to spot issues at a glance. Green means things are healthy and red means something needs attention. The Status column in the Network devices table, located in Inventory, is a good example: “processed” shows up in green while something like “connection refused” stands out in red.Now, you can bring the same visual feedback into your own NQE queries. We’ve added a new builtin called withInfoStatus. It lets you tag any value in your result table with a label: OK, WARNING, or ERROR. The results table uses that label to color values appropriately.Here is an example. Suppose you want to flag devices whose OS support has already ended. This query checks if the support date is in the past and then labels it.  foreach device in network.deviceslet platform = device.platformlet osSupport = platform.osSupportwhere isPresent(osSupport) && isPresent(device.snapshotInfo.collectionTime)let collectionDate = date(device.s

590
shyawnkarim
Employee
rob
Employee
robEmployee
published in NQE Discussions
Check for Unused Firewall Rules (and Catch New Ones Too)Intermediate

This NQE script helps you spot firewall rules that haven’t processed traffic lately. It flags rules as unused if they haven’t processed any packets in the last 30 days—but only on active firewalls (not ones in BACKUP or STANDALONE_INACTIVE modes).If you have rules that are supposed to be quiet (like for failover scenarios), you can list them in expectedUnusedRules so they don’t show up as false positives.As a bonus, it also highlights newly created rules—anything added in the last 30 days—so you get visibility into what’s changing as well as what’s sitting idle.All timing is based on the device’s snapshot collection time. You can also find this script in the Forward NQE LibraryForward Library > Security > Firewalls with Unused Security Rules/** * @intent Verifies that active firewalls have no unused security rules * @description This query considers a rule to be unused if it last processed * a packet more than 30 days ago. This query only applies this check to * firewalls that

340
rob
Employee
R
Rajesh vRamping Up
asked in Learn NQE
what scripting language NQE use?

what scripting language NQE use?

533
R
J
john_hayesRamping Up
asked in NQE Discussions
Forward NQE Query to Identify Modified Firewall Rules

Is it possible to write a Forward NQE query that will produce a list of firewall rules that have been modified in the last 30 days?  It would be helpful to have firewall name, the rule ID numbers, and date/time last modified if possible.

524
V
Employee
AricaFN
Employee
AricaFNEmployee
posted in NQE Discussions
NQE to Identify IP Subnet Utilization

This NQE uses the L3 interface info and ARP tables to find the subnets in use on your network. It lists the associated vlan, used addresses, devices, and usage statistics.An optional parameter allows you to search for an IP address, and whether the IP is in use or not, it will display the subnet it belongs to.import "@fwd/L3/Interface Utilities";numHostsInSubnetV4(maskLength) = if 2 ^ (32 - maskLength) >= 4 then 2 ^ (32 - maskLength) - 2 else 2 ^ (32 - maskLength);numHostsInSubnetV6(maskLength) = 2 ^ (128 - maskLength);@queryquery(IP_Addresses: List<IpAddress>) = foreach device in network.devices foreach interface in getL3Interfaces(device) let addresses = (foreach address in interface.ipv4.addresses select { ip: address.ip, mask: address.prefixLength }) + (foreach address in interface.ipv6.addresses select { ip: address.ip, mask: address.prefixLength }) let neighbors = (foreach address in interface.ipv4.neighbors

760
AricaFN
Employee
AricaFN
Employee
AricaFNEmployee
published in NQE Discussions
From CLI to NQE: How I Use Forward to Be a More Efficient Network OperatorBeginner

Before I started using Forward Networks, I was deep in the weeds of daily network operations. Like many of you, I relied on the CLI to do everything—whether it was compliance checks, interface audits, or config validation. It worked, but it was slow, manual, and honestly, a bit exhausting. Then I discovered Network Query Engine (NQE), and everything changed. My Background: Life in the CLI Before discovering NQE, I managed networks using CLI commands across dozens or hundreds of devices every day.Logging into individual devices—one at a time   Running the same commands repeatedly (show run | include, show run | section, etc.)   Copying results into spreadsheets to figure out what was going on   Trying to get ahead of issues, but always feeling like I was behind  This approach worked for a while, but it became clear that it couldn’t scale with the needs of a modern network. The Breakthrough: Pattern and Block MatchingWhen I began exploring NQE, I realized I didn’t need to learn everythin

1440
AricaFN
Employee
GTurner
Employee
GTurnerEmployee
posted in NQE Discussions
Normalized Ranking Without Sorting in NQE

 Motivation A customer recently approached me with a challenge: they wanted to feed downstream systems with ordered and banded firewall data. Specifically, they had the following use cases:Identify Top-N firewalls based on configuration complexity and other attributes like greatest number of permissive or shadow rules. Flag percentile-based thresholds for various attributes (e.g., top 10%, bottom 25%) Enable dynamic device selection for exhaustive, compute-heavy rule analysis The challenge?  NQE is designed for efficient set-based analysis, therefore it doesn’t require sorting or ranking functions in general.  Nevertheless, this customer’s use case called for an approach to simulate these behaviors without external processing.So instead of relying on a built-in sort function, we can create a lightweight, math-driven approach that simulates ranking behavior. It’s fast, deterministic, and works entirely inside the NQE layer so that no external processing or comparisons are required.In th

590
GTurner
Employee
I
IvanRamping Up
asked in NQE Discussions
Is it possible to use regex in a pattern block?

I am trying to match against a Palo Alto configuration looking for rules that are using a specific destination object.   Rules are under this structure:config devices  {string}    vsys     {string}       rulebase        security         rules          {rule_name: (string)*} and an example of what I am trying to match is:                 "Example Rule" e32ff2ab-a82f-43b6-953e-7e113v624779 {                  destination [ non-client "External SRC EDL" "Another EDL-wehave"]; First line would be the rule name and the second is where I would really want to do the regex match.  The items past “destination” can be a single entry or multiples within []’s.  If there are spaces in the names then the whole name is confined in “’s.   My goal is to find all rules which have “External SRC EDL” in the destination and I can’t quite figure out how to do it.  Any help would be appreciated.   

682
I
R
Spotter
Rohit_809 KumarSpotter
asked in NQE Discussions
How can i get output in single coloum 

How can i get output in single coloum .  team , i am using below query to get the NTP Server data , however is tried all option to get the output in single coloum , but i am not sucess. NQE Query ciscontppattern=```ntp server {server:string}```;ciscontppattern2=```ntp server {vrf:string} {dir:string} {ser:ipv4Address}```;patternf5 = ```sys ntp    servers { server1:string} {server2:string}```;cisco1(device) =foreach command in device.outputs.commands  let response = parseConfigBlocks(device.platform.os, command.response)  foreach match in blockMatches(response, ciscontppattern)  select match.data.server;cisco2(device) =foreach command in device.outputs.commands  let response = parseConfigBlocks(device.platform.os, command.response)  foreach match in blockMatches(response, ciscontppattern2)  select match.data.ser;getServers(device) =foreach command in device.outputs.commands where command.commandText == "list sys ntp"let filtered_response = replace(command.response, "{", "")let filtered_

696
R
Spotter
S
Driver
SteveBamfordDriver
asked in NQE Discussions
Arista APs Validate only authorised SSIDs have been configured.

This NQE will validate that only the SSID’s in allowedSSID’s can be used, if it does not exists in the list it will fail the query.Taking advice from an earlier post I have used blockMatches this time, there is some tuning required to remove the duplicates as a result of the table have the entry for each /** * @intent Validate that the arista AP's have only the approved SSID's configured * @description This will check each arista AP for the approved SSIDs and violate when ther SSID does not match * the allowedSSID list. * * You will get multiple entries due to the VAPS list having an entry for each frequency. This will be a future * fix to show only once when the unauthoirised SSID exists */pattern = ```VAP-ID : {VAPId:string} ESSID : {SSID:string}```;// Replace the SSID's with your own.allowedSSID = ["ssid1","ssid2","ssid3"];foreach endpoint in network.endpointswhere endpoint.profileName == "Arista Wireless AP's"foreach command in endpoint.cliCommandRespons

160
S
Driver
S
Driver
SteveBamfordDriver
asked in NQE Discussions
Arista WIFI Validate AP Version

Following on from  I thought I would share this NQE if others are using Arista AP’s and want to maintain version numbers across their estate. /** * @intent List all Arista AP's and there software version. * @description List all Arista AP End Points and there software version. */allowedVersion = "18.0.0";foreach endpoint in network.endpointswhere endpoint.profileName == "Arista Wireless AP's"foreach command in endpoint.cliCommandResponseswhere command.command == "show device info"let ParsedResponse = parseConfigBlocks(OS.UNKNOWN,command.response)foreach line in ParsedResponselet modelNo = patternMatch(line.text,`Device Model : {string}`)foreach line in ParsedResponselet software = patternMatch(line.text, `Device Version : {string}`)foreach line in ParsedResponselet serialNo = patternMatch(line.text,`Serial Number : {string}`)where isPresent(modelNo)where isPresent(software)where isPresent(serialNo)select { violation: software != allowedVersion, name: endpoint.name, location

272
S
Driver
cariddir
Spotter
cariddirSpotter
posted in NQE Discussions
Enhancing Inventory with NQE

I have put together a query to enhance inventory by adding LDoS dates and ‘approved software’. It has greatly improved our Life Cycle Mgmt. conversations.  The CSV Files reside separately in a ‘standards’ folder. (there are just too many fields to keep in the same script).The resulting output provides:Vendor | Hostname | Model | Location | Vendor LDoS Date | HW Compliance Date | Current OS | Approved OS | Compliance to OS | Replacement Mode | And more /** * @intent Inventory of all devices in FN * @description Take inventory and then cross check them against the CSV Files for SW/HW info**/ import "Home/Network Standards/01_NetworkVars/99_Support_Detailed";foreach device in network.deviceslet platform = device.platformlet snapshotInfo = device.snapshotInfoforeach entry in deviceSupportDetailwhere entry.Model == platform.modellet LDOS = entry.HW_LDoSlet STATUS = entry.LCMlet comma = ", "let ApprovedSW = entry.SW_N + comma + entry.SW_N1 + comma + entry.SW_N2let Replacement = entry.HW_Repl

3234
RobertWelch
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
asked in Koan Challenges
Play our NQE Koan Challenge - Group People by Age

Hello NQE Enthusiasts, I’ll try to post a new Koan Challenge every two months.  ChallengeThis task is to take the following table and group people by age. Input [{ Name: "Bob", Age: 21 },  { Name: "Sam", Age: 19 },  { Name: "Jill", Age: 18 },  { Name: "Jim", Age: 21 },  { Name: "Sally", Age: 19 } ]; Example Result[{Age: 21, Count: 2}...] Hinthttps://fwd.app/docs/nqe/guides/comprehensions/#group-by-qualifier Contributions: Unclaimed

210
Tyson Henrie
Employee
Christopher
Employee
ChristopherEmployee
posted in NQE Discussions
Using an NQE Query in Inventory+ with Diffs

It is possible to compare the output of an NQE query using the Diffs feature by first adding the NQE query to Inventory+.Consider the following NQE query, which lists all the static routes on all devices. (Note that the next hop is listed in this example provided that the next hop is an IP address. The query could be expanded to handle other types of next hops). getStaticRoutes(routingTable) = foreach ipEntry in routingTable.ipEntries foreach nextHop in ipEntry.nextHops where nextHop.originProtocol == OriginProtocol.STATIC select { prefix: ipEntry.prefix, nextHopType: nextHop.nextHopType, nextHop: ipEntry.nextHops };foreach device in network.devicesforeach networkInstance in device.networkInstanceslet afts = networkInstance.aftswhere isPresent(afts.ipv4Unicast)let ipv4Unicast = afts.ipv4Unicastlet staticRouteCount = length(getStaticRoutes(ipv4Unicast))where staticRouteCount > 0foreach entry in getStaticRoutes(ipv4Unicast)select { Device: device.name, "Network Instanc

420
Christopher
Employee
Tyson Henrie
Employee
Tyson HenrieEmployee
posted in NQE Discussions
Input device under maintenance. Get back the BGP peers and outbound interfaces between the devices.

I provided a query for doing this some time ago.  However, it was written for running where the Data Model did not have as many BGP elements as the current Data Model.  Now that there are more BGP elements in the data model it makes this query much simpler.  Which also means it runs faster.The inspiration for this query was a customer that run BGP between pretty much all devices. This is why it is only based on BGP peers./** * @intent Input the device under maintenance. get the list of BGP peers and outbound interfaces * @description This is a Parameterized Query. You input the devicename string. * it will look for the BGP peers of that devices, plus determine the interfaces that connect the * devices together. This way you can mute the alarms for the BGP peers and links before a maintenance window. */import "@fwd/L3/Interface Utilities"; //getL3Interfaces(device: Device)getPeerInfo(neighbor, sourceRouterId) = max(foreach device in network.devices where device.name == neighbor.

230
Tyson Henrie
Employee
R
Employee
RenataBudkoEmployee
published in NQE Discussions
Enhancing STIG Compliance Checks with Parameterized QueriesIntermediate

When working with STIG compliance checks, a common challenge is that many checks only verify the existence of a control—not whether the configured values align with site-specific requirements. This can be a problem when compliance policies vary across different data centers and locations.With a little work, it is easy to customize the queries. Benefits are apparent. You get: more precision to verify your specific ACL and group names Verifying differing configuration policies across multiple data centers or locations Improved compliance and governance across a variety of configurations and regionsThere are two approaches you can use to customize queries.Copy the query and modify the block match to include the value of your parameter Parametrize the query and use your location-specific string value as a query parameter. Parameterized queries are slightly more complex but make existing STIG checks - and other NQEs - more flexible.Let’s use an example of a library STIG query /Forward Libra

1010
R
Employee
  • Community Contributor
    AricaFNhas earned the badge Community Contributor
  • NQE Collaborator
    gbaronhas earned the badge NQE Collaborator
  • Community Contributor
    CarlBhas earned the badge Community Contributor
  • Community Contributor
    gbaronhas earned the badge Community Contributor
  • Community Contributor
    Christopherhas earned the badge Community Contributor
Show all badges
Terms of UseCookie settings