Skip to main content

After some digging and working with other FN personnel, it appears that the above mentioned NQE is missing all 17.12, and all 03. IOS versions in the data model for the OS Support NQE report.  This was determined first by modifying an NQE to run a check against the OS Support and return violations for those IOS that are no longer supported, which would come back as failed.  Good IOS would report as pass.  However, the above mentioned IOSs all returned a value of “Indeterminate”.  Which then made us look at the OS Support NQE itself and the devices associated with the above/below IOS versions are not listed on the report, but they are in the regular inventory.

 

Known Affected IOS (from our known devices):

03.01.01

03.07.04E

03.11.03a

03.11.05

03.11.08

17.12.03

17.12.04

17.12.04a

17.12.04b

@gbaron That is intended by the language of the query.  Apparently we don’t have the info for those OSs.  Whether they don’t exist yet, or we don’t have it.  This is filtered out by the line

    where isPresent(osSupport)

If there is not data, we filter it out.  

I guess you are saying that you don’t want these filtered out.  We would just show “null” or “no value” for these entries….?


In the short term you can try this version of the NQE query where I added if statements.

 

foreach device in network.devices
let platform = device.platform
let osSupport = platform.osSupport
select {
Device: device.name,
Vendor: platform.vendor,
Model: platform.model,
OS: platform.os,
"OS Version": platform.osVersion,
"End of OS maintenance": if isPresent(osSupport) then osSupport.lastMaintenanceDate else null: Date,
"End of OS vulnerability": if isPresent(osSupport) then osSupport.lastVulnerabilityDate else null: Date,
"End of OS support": if isPresent(osSupport) then osSupport.lastSupportDate else null: Date,
URL: osSupport?.announcementUrl,
Location: device.locationName,
Tags: device.tagNames,
"Collection IP": device.snapshotInfo.collectionIp,
"Management IP(s)": platform.managementIps,
Type: platform.deviceType
}

 


What I mean is that they are valid IOSs that should be listed.  Roger opened a ticket about this as well.  Appreciate the short term fix, but it doesnt help any as we are cross-referencing the output of the EOS data in that NQE to populate a STIG NQE, that requires parameters to run, in an effort to show devices passing or failing for an upcoming audit.  So in reality, it doesnt work because the lack of EOS dates/data doesnt allow for a true pass/fail, which leaves us where we are with the Indeterminate outcome.


Reply