Automating Network Compliance with NQE: The Power of Intent-Based Validation

Manually auditing DNS configuration across a large network is slow, tedious, and error-prone. Engineers are often forced to comb through thousands of lines of device configuration to confirm that every router, firewall, and switch is pointing to the correct name servers. By the time the audit is complete, parts of the network may already be out of compliance again.

With Forward Networks’ Network Query Engine (NQE), this kind of validation can be automated and continuously enforced using a simple, declarative query that evaluates the entire network model at once.

Why this matters

DNS is a foundational service. A single misconfigured device can:

• Break application connectivity

• Bypass security monitoring by resolving through an untrusted resolver

• Violate regulatory or internal policy that mandates use of controlled DNS infrastructure

What this NQE checks

This query verifies that every monitored device is configured with the approved internal DNS servers—and only those servers.

In this example, the organization has standardized on two authorized DNS IP addresses:

• 2.2.2.2

• 1.1.1.1

The NQE script inspects each device’s DNS configuration and flags any of the following conditions:

• A device is missing one or both required DNS servers

• A device is using an unapproved DNS server

• A device’s DNS configuration does not exactly match the approved pair

By expressing this requirement as network intent in NQE, you move from periodic, manual audits to continuous, automated compliance validation. Any drift from the approved DNS standard is immediately visible, searchable, and reportable across the entire digital twin of your network.

Explanation of the NQE components (scroll down for complete script):

/**
* @intent Enter your intent here (one line, 50 characters max)
* @description Checks for DNS servers for standard IOS DNS configuration
*/


expectedDns = [ipAddress("2.2.2.2"), ipAddress("1.1.1.1")];




/*The following pattern is intended to matches the following config line:
ip name-server 1.1.1.1
ip name-server 2.2.2.2 */


configPatternIOS = ```
ip name-server {dnsservers:(ipv4Address*)}
```;


/*The following pattern is intended to match the following config lines:
ip name-server 1.1.1.1 2.2.2.2
*/
configPatternNxosXe =
 ```
ip name-server {(!ipv4Address string)*} {dnsservers:(ipv4Address*)}
```;


/* The following pattern is inteded to match the folllowing config lines:
 config system dns
   set primary 53.188.5.254
   set secondary 53.186.5.254 */


configPatternFortinet =
 ```
 config system dns
   set {string} {dnsservers:(ipv4Address*)}
```;


//Get DNS Server Function
getdnsservers(device, pattern) =
 foreach match in blockMatches(device.files.config, pattern)
 foreach dnsserver in match.data.dnsservers
 select dnsserver;


/************************* Main Function********************/
foreach device in network.devices
let platform = device.platform
//Filters OS types with DNS Configured
where platform.os == OS.IOS || platform.os == OS.IOS_XR ||
     platform.os == OS.IOS_XE ||
     platform.os == OS.FORTINET ||
     platform.os == OS.NXOS
//Selects pattern based on OS
let pattern = if platform.os == OS.IOS
             then configPatternIOS
             else if platform.os == OS.FORTINET
                  then configPatternFortinet
                  else configPatternNxosXe
//Gets DNS servers in the configuration
let servers = getdnsservers(device, pattern)
//Get the incorrectly configured DNS Servers
let unexpectedDns = servers - expectedDns
//Get DNS servers that should be configured
let missingExpectedDns = expectedDns - servers
select {
 violation: length(unexpectedDns) != 0 || length(missingExpectedDns) != 0,
 device: device.name,
 Servercount: length(servers),
 "Missing Expected Dns": missingExpectedDns,
 "Unexpected DNS": unexpectedDns,
 "DNS Servers": (foreach x in servers
                 select x),
 OS: platform.os,
 Version: platform.osVersion
}

Sample output: