NQE

Hello NQE Enthusiasts, Here is another Koan challenge. The task is to take a list of years and calculate the centuriesInput:[1776, 2001, 1643, 1969];Result[{“Year”: 1776, “Century”: 18}...]Hints:Use string conversions like toString Create a toNumber functionTry not to look at the replies until you have tried the challenge yourself.

I was asked to do pull all the password encryption methods for Cisco (route-switch) devices from our security team.Here are a couple of NQE that I wrote to send off to the security team, hopefully it might be of use to someone else. They are pretty simple but if anyone has recommendations to enhance or combine into a single script, lemme know!Results: Showing IOS/IOS_XE DevicesNexus - ** Add custom command to collection for NX-OS Devicesshow run | grep admin password/** * @intent Show encryption level and method on Cisco NX-OS devices * Test * @description Use CSV table below to match Encryption Level to Method * add custom command for NXOS devices: show run | grep admin password**/Encrpytion = """csvEncryLvl,EncryMeth9,SCRYPT-Hash5,MD54,SHA25610,SHA5127,Cisco_Type7-Algorithm0,No-Encryption""";pattern1 = ```{username:string} {admin:string} {PW:string} {Level:number} {str:string} {role:string} {NA:string}```;foreach device in network.deviceslet platform = device.platformwhere platform

It may be useful to compare the output of a traceroute against the Path Search output from Forward Networks.The following NQE query takes a list of IP addresses as a parameter, and returns a list of devices based on interface IPs.This query could be used while onboarding sources into Forward Networks. If there is no device entry for an interface IP address from this NQE, it could mean that the device with that IP address needs to be added to the collection (to Sources).If there is overlapping IP space in the network - for example, if private IP space for network interface IPs at difference locations is the same - this query will return ALL the devices with a given interface IP.Note that Forward Networks’ Path Search is superior to traceroute in that Path Search will shows layer-2 hops and cloud network objects that don’t respond to traceroute. import "@fwd/Interfaces/Interface IPs";deviceIps = foreach device in network.devices select { device: device.name, ips: (foreach record

how can i get information about device uptime ?

This NQE can be a quick way for you to identify interfaces and subinterfaces with configured ACLs. This could be invaluable from a couple angles: path analysis/troubleshooting and audit.Check it out! Let me know what you think!*I put both where length(acls.inboundAclNames) > 0 && length(acls.outboundAclNames) > 0andwhere length(acls.inboundAclNames) > 0 || length(acls.outboundAclNames) > 0because I feel both can have benefit in their own circumstances.foreach device in network.devicesforeach interface in device.interfacesforeach subinterface in interface.subinterfaceslet acls = subinterface.aclswhere length(acls.inboundAclNames) > 0 && length(acls.outboundAclNames) > 0// where length(acls.inboundAclNames) > 0 || length(acls.outboundAclNames) > 0select { deviceName: device.name, asset: device.tagNames, interfaceName: interface.name, subinterfaceName: subinterface.name, inboundAclNames: acls.inboundAclNames, outboundAclNames: acls.outboundAcl

Team, i am collecting frtianazlyer data from fortinet firewall via custom command , however i tried below query to get the data . pattern_faz =  ```config log fortianalyzer setting  set status enable    set server {faz:string}    ```;foreach device in network.devices/* where device.platform.vendor == Vendor.FORTINET */  let outputs = device.outputsforeach command in outputs.commands   where command.commandType == CommandType.CUSTOM   where command.commandText == "show  log fortianalyzer setting"  let configurations = parseConfigBlocks(OS.FORTINET, command.response) foreach match in blockMatches(configurations, pattern_faz)/* where !matches(device.name, "*_*") */ select {  deviceName: device.name,  SiteName: device.locationName,  "Primary DNS": match.data.faz,}   but unfortunatelly i m getting zero result. can anyone help on this

Discover insightful network performance metrics—without having to write a single character of code. In this article, you'll learn how to quickly check the uptime of your network devices using the Forward Platform. It’s an easy introduction to show you how to extract network insights using Forward’s built-in capabilities.Log in to your Forward Platform In the left navigation, scroll down to the NQE section and click Library. At the top of the query window, click the New query icon When prompted, provide a unique name for your query.  Save time finding scripts - create a folder to store you new scripts in one place Your query is now open and ready to edit. Remember, you’re not writing one character of code.  On the far right side of the window, click the Data Model tab. Type uptime in the search field. This displays elements in the Forward data model that pertain to uptime.    Hover your cursor over the first result - uptime:Duration. A dialogue displays a description of this dat

I have a requirement to look for an IP anywhere in the configurations files that pertain to devices with a specific name.  I tried to use the built in NQE under Forward Library>Device>Config Search, but when I enter the IP in the bottom box of the Parameters section, “Config_Pattern”, the results come back blank.  Yet when I look at the device config, the IP I copied and pasted appears in the actual configuration.  Also, the built in NQE seems picky...as in it wont pick of tacacs+ or acl, will pickup tacacs...and case sensitive as well apparently. For now, im looking for help with the IP search, I just wanted to not other issues with it.

Helper Functions are readily available queries in the Forward Library that you can use to streamline NQEs and save valuable coding time. These pre-built utilities empower users to accomplish intricate tasks without needing to reinvent the wheel.What Are Helper Functions?Helper functions simplify common networking queries. They reduce the need to manually generate code, enabling users to:Extract data with greater ease, including IP addresses and VLAN associations. Identify device types, configurations, or compliance based on standards. Handle complex calculations and data parsing. Combine multiple functions for advanced queries.These functions are continuously maintained by the Forward Networks engineering team, ensuring compatibility with the latest standards and device updates. Key Helper FunctionsSTIG Device Identification:Description: Identifies Cisco and Juniper switches and routers that match the Security Technical Implementation Guide (STIGs), saving time on pattern matching and

When I first started working with Network Query Engine (NQE), I didn’t have a traditional software engineering background and was learning Python and NQE at the same time. I needed to create a custom solution for handling certificate expiration dates across different network devices. The Python part of my brain was hoping to find a traditional for loop capability, and was a bit lost when that didn’t exist. As you may know, you can solve any given problem 10 different ways with NQE. I wanted to write a solution that would be clean, readable, easy to maintain, and share with others without having to provide too much explanation .That’s where the WHEN statement came into play.What is a WHEN Statement?Within the NQE Data Model, there are some data types that have a fixed list of options.The WHEN statement in NQE allows you to evaluate different conditions based on those options. WHEN is like switch or case statements in other programming languages, but it’s more tailored to pattern matchin

How can i get the config register value for cisco devices ?

After spending the last 8 weeks as an intern, I’ve learned a lot about network digital twins and how they enhance visibility, maintenance, and security. You can read more about my experience in this post. Over the last few weeks, I’ve created powerful scripts to answer common security and compliance questions that years ago would have taken hours trying to answer in the CLI. The query I created below identifies Arista devices that have a security vulnerability in their configuration.Benefit of this NQEThis query solves similar issues to those I encountered at previous network admin jobs. This query drastically cut the time I would have otherwise spent investigating issues on individual devices. With a little effort in creating this query, I can now answer these questions in seconds with each new network snapshot.What this NQE doesThe script identifies all Arista devices on the network that are missing the enable password xxxXXX command. This could be a policy driven configuration that

Hi all, I am new to NQE and trying to find out a way to list up all the devices with the EOL/S status.Here is the script which the first phase./*** @intent End-of-life data for operating systems** @description If  EoL data is known for the OS of a device,* then that device shows the respected dates, if not EoS related columns shows null.** Data exists for devices running any of these OSes:* ARISTA_EOS, IOS, IOS_XE, IOS_XR, JUNOS, NXOS, and PAN_OS. */ foreach device in network.deviceslet platform = device.platformlet osSupport = platform.osSupport/* where isPresent(osSupport) */select {  Device: device.name,  Vendor: platform.vendor,  Model: platform.model,  OS: platform.os,  "OS Version": platform.osVersion,  "End of OS maintenance": osSupport?.lastMaintenanceDate,  "End of OS vulnerability": osSupport?.lastVulnerabilityDate,  "End of OS support": osSupport?.lastSupportDate,  URL: osSupport?.announcementUrl,  Location: device.locationName,  Tags: device.tagNames,  "Collection IP": devi

Here is a useful combination of a custom command and an NQE query to show the state of all OSPF neighbors.OSPF data is not collected by default in Forward Enterprise, so we add the custom command "sh ip ospf neighbor"Output data for this command from one device looks like this:Command: sh ip ospf neighborNeighbor ID     Pri   State           Dead Time   Address         Interface10.200.30.42      0   FULL/  -        00:00:35    10.45.6.1    GigE1/0/010.200.30.42      0   FULL/  -        00:00:32    10.45.6.2    GigE1/0/110.200.30.42      0   FULL/  -        00:00:35    10.45.6.3    GigE1/0/210.200.30.42      0   FULL/  -        00:00:31    10.45.6.4    GigE1/0/310.10.10.200      1   FULL/BDR        00:00:03    10.45.6.5    Vlan200This NQE query will list the OSPF neighbors from all devices by parsing the data from the custom command./** * @intent Show OSPF neighbors on all devices collected with custom command 'sh ip ospf neighbor' * @description Show OSPF neighbors on all devices colle

Hello!    We are trying to write a NQE referencing the State File OSPF PEERS, but we cant find anything related to code or the CommandType, or any data really, in the NQE data model.  Can someone please point me in the right direction.

You can use NQE to examine the firewall rules in all firewalls in a network. However, you will need to use a different approach depending on what you want to audit in your security rules.Forward Enterprise collects and parses the ACLs and security rules from all devices: firewalls, routers, switches, and so on. The data is then parsed and normalized. This data is stored in a database in a custom format that allows the Forward application to perform path analysis.The following NQE query uses the Forward Enterprise aclEntry object to provide consistent output from any vendor Firewall. Note that the scope of device types in the output is limited by using the where statement and filtering to DeviceType.FIREWALL.This query will work for every ACL/security rule on any Firewall in the network. However, because the query is working on normalized data, each security rule in a firewall may be broken up into multiple aclEntry objects. The results of this query may therefore have multiple lines wi

If you’re interested in other ways to identify non-compliant devices, check out this article I wrote: The Hardware and Software Compliance Checker is a powerful script designed to ensure all network devices are authorized and operating on approved OS versions. By providing a detailed view of the network inventory, this query identifies devices that either lack approval to be on the network or are running outdated or incorrect software. With its comprehensive approach, this NQE empowers network administrators to maintain compliance, enhance security, and streamline operational workflows.Benefits of Using the Hardware and Software Compliance Checker:Enhanced Compliance: Ensures all devices on the network are authorized and running approved OS versions. Improved Efficiency: Automates the identification of non-compliant devices, saving time and reducing manual effort. Proactive Security: Helps prevent vulnerabilities by identifying and addressing outdated or unauthorized devices.How it Wor

If you’re interested in other ways to identify non-compliant devices, check out this article I wrote:The End-of-Life (EOL) and End-of-Sale (EOS) Checker is a streamlined tool that identifies network devices nearing or past their vendor support lifecycle. By cross-referencing inventory data with a list of outdated devices sourced from vendor sites, such as Cisco’s EOL/EOS database, the query ensures administrators are aware of devices that may pose operational risks. This proactive approach enables organizations to plan replacements, reduce downtime, and ensure ongoing compliance with industry standards.Benefits of Using this NQE:Proactive Replacement Planning: Identifies aging devices before they become liabilities, reducing unplanned downtime. Streamlined Compliance: Ensures devices meet organizational and vendor standards, avoiding security and support gaps. Optimized Team Collaboration: Role-based access and automated alerts keep relevant stakeholders informed and responsive.How the

I am trying to find the specific commandType for the information in the device ‘nat v4’ result. For Cisco devices, it looks like a result of ‘show ip nat statistics’ but I cannot find the specific commandType in the data model documentation. Is there somewhere that can be searched?  

Some output from commands has a comma immediately after the output number: nat-limit statistics: max entry: max allowed 0, used 0, missed 0 I can parse the result as a string, but want to grab the data as a number so I can do other operations (math/comparison/etc). I can remove the comma with a replacement function (thanks ​@GaryB )cleanComma(s) = replaceMatches(s, ",", ""); however the output, even while being a number (0) is still considered a string. Looking at toNumber, the documentation gives the warning it is for IPv4 addresses only. Is there a way to convert a string into a number variable type?

I am using the NQE query to retrieve Fortinet Firewall NTP details. However, I am also receiving details for VDOM (Virtual Context ) or virtual contexts, which I do not want. Could you please assist me in refining the NQE query to exclude these VDOM details?   

Hi Team,I need to obtain a list of devices that have syslog enabled as well as those that do not. I have checked the Forward Library and the community but could not find any relevant queries for this purpose. Could you please assist me in generating the list of devices with syslog enabled and those without it? Thank you!

NQE Query for F5 NTP Server details from config, Please help us to collect this data.

Your Regex Toolkit is Here!Starting with Release 24.10, NQE supports regular expressions (or “regex”), one of the most requested features from our community. Regular expressions are an essential toolkit for working with textual data, and networking often requires us to handle plenty of it. Whether you’re parsing the output of commands like show interfaces brief or making sense of complex device naming conventions, regex in NQE can make these tasks faster and more efficient. Why Regular Expressions Matter in NetworkingRegular expressions provide a powerful way to:Identify patterns within strings, such as determining if a device name follows a specific naming convention or verifying whether a string is a valid IP address. Extract data from network outputs. For example, extracting IP addresses from a configuration file or pulling cell values from an ASCII table. Transform strings. For example, replace all IP addresses in a config file with a redacted indicator or reformat dates from mm/dd

Do patterns need to be standardized or will blockMatches match when lines are missing? pattern=```line one {main:string}    sub-line1 may or may not be consistently present    sub-line2 may or may not be consistently present    sub-line3 {value1:string} is target and sub-line3 will always be there    sub-line4 may or may not be consistently present    sub-line5 may or may not be consistently present    sub-line6 may or may not be consistently present    sub-line7 may or may not be consistently present    sub-line8 {value2:string} is target and sub-line8 will always be there         sub-sub-line9 {value3:string} is target and sub-sub-line9 will always be there        sub-line10 may or may not be consistently present    sub-line11 may or may not be consistently present    sub-line12 {value4:string} is target and may or may not be present         sub-sub-line13 {value5:string} is target and sub-sub-line13 will be there if sub-line12 is present    sub-line14 may or may not be consistently