Platform Discussions

 Recently, two critical vulnerabilities (CVE-2024-0012 and CVE-2024-9474) were discovered in Palo Alto Networks' PanOS operating system. CVE-2024-0012 lets an attacker gain admin access and exploit other vulnerabilities like 2024-9474. These vulnerabilities allow attackers to gain admin privileges and plant malicious code, potentially giving them deeper access to company networks. The highlights are available below. Watch the video for the full story.Here’s how you can address these threats: Understand the Threat: The vulnerabilities enable unauthorized access, risking the security of your firewalls and networks. CISA has issued directive BOD 23-02. This directive outlines how organizations can reduce their attack surface from misconfigured management interfaces. Leverage Forward for Validation: Identify devices exposed to these vulnerabilities. Filter and prioritize affected devices, especially those connected to the internet The Forward platform provides a nightly update of CVE d

Keeping your network source of truth accurate is critical in cloud environments that evolve rapidly. Forward Networks’ cloud modeling capabilities make it easier to understand your network state, but manual snapshot collections for every change can be time-consuming. To solve this, I recently built an automated workflow using AWS EventBridge to trigger Forward Networks’ cloud snapshot collections for relevant AWS network changes. In this post, I’ll share how to set up this integration, including tips to limit the number of collections and keep costs within the AWS Free Tier. The Challenge AWS environments experience frequent changes, such as:• Creating or deleting VPCs.• Modifying route tables or DirectConnect links.• Updating Elastic Load Balancers. Manually capturing snapshots for every change isn’t practical, and triggering collections for every event might overwhelm your workspace. I wanted a solution that:1. Automates snapshot collection for specific, relevant changes.2. Limits un

How can i add AVI LB on FWN , TO use port https ,443 .?

I have created a synthetic node inside a workspace to run down the various connections for a complex multibranch setup with multiple MPLS vpns and Internet VPNs. Is there a way to move or download the synthetic nodes so I can recreate them inside the parent network now that I have confirmed the accuracy inside the workspace? Note that I am trying to move it from a workspace back to the parent network - otherwise I would just recreate the workspace from the parent and include the synthetic.

How can i add Custom command for fortinet. command that i am looking. show system dns. show system ntp. show system central-management config system central-management. 

is it possible to run NQEs immediately after a snapshot completes?  If Forward can baseline what NQEs are always run after a snapshot completes (possibly this data baseline is based upon a period of time such as 30 days or some admin defined time period).  Administrators can use this baseline data to flag those NQEs of priority to run immediately after the snapshot completes.  in this way, results from priority NQEs are immediately available (from cached results) for applications to use with minimal delay.

Hey, Forward Community Members!We're thrilled to invite you to submit your ideas for network configurations you’d like to see analyzed within our Net3 lab network. Whether it's testing new scenarios, troubleshooting common issues, or exploring unique configurations, we want to know what network setups you’re interested in. Example lab scenarios include:Layer 2  Host-to-Host communication in VXLAN EVPN  fabric based on  Arista STP/RSTP Layer2 pods built  with Cisco or  Arista switches Layer 3 MPBGP with VXLAN EVPN forwarding (Arista vEOS) IPv6/IPv4 Dual stack forwarding using routers/switches by Cisco and Arista, as well as Palo Alto firewalls SD-WAN Viptela/Catalyst SD-WAN As well as other configurations including Network Services - Load-balancer single-arm (SNAT/DNAT): A10 And many others!  What network configuration would you like to see? Our Net3 lab network is constantly expanding with a diverse set of devices, offering a robust environment for analysis and experimentation. H

For reference - we recently were able to get Cisco Firepower ASA operating as FTD and FPRs on IOS FXOS, for the first time.  With that…. Since none of the default commands produce any data in the state files, we are trying to use custom commands.  Right now, when performing a show run, it comes back with 25 lines of configs, but then stops at --More--, which is when a user via cli would would push a button.  We have lots of other devices running custom commands that do not do this, so why is it happening with FXOS and how can we work around it? Also, the FTD devices reporting all state files properly, its just the FPRs that are having issues.

What command can be ran from the CLI to find the postgres version?

I was helping some folks in getting familiar with Forward Networks, we were having trouble in adding in new devices (that already exist in the parent network) in to the already created workspace. The existing options to add devices in the workspace looks to only include ways to create new connections to those devices. But I did not see any way for me to pull in existing devices from the parent network, after the workspace was already created. Does anyone have any insight into this?

We were finally able to configure and get SSO online and operational this past week in our Dev environment, and pushed it in to the production world yesterday.  After running fine for about 10-12 hours, we came in this morning to the following error: SAML validation failed.  Invalid assertion [insert a bunch of random letters and numbers] for SAML response [insert more random letters and numbers]: Assertion IssueInstant was invalid, expiredContact your Org Admin to resolve the issue. I check with the in group that manages SSO and they claim nothing has changed on their end, so now I must ask:  How do we get past this so I can turn SSO back on? P.S. we are on base 11 app version 24.8 (rolling to 24.9 in a couple hours)

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location.  I also noticed when editing custom source that I had to update in phases. I imported csv of devices.  I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that into a valid query. How to Use AI AssistUsing AI Assist is easy. Just follow these steps:Log in to Forward Enterprise. Navigate to the NQE Library. Open the query editor by adding a new query. Click the AI Assist button. In the Generate tab, type your natural la

Is there a way to export all CVEs that the platform is scanning for.  We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

Hi Forward Networks team, I am looking at the API, specifically the call to get a device's data files.I can get the files for a single device at a time by just putting in the hostname in the parameters, however I was wondering if there is a parameter which will allow me to pull from multiple devices at once.For example lets say I want to pull from devices ABC, DEF, GHIorI want to pull from every device that starts with ABC*Is this something that can be done?Or would another possibility be to create a separate group of devices which includes all the devices I want to pull from and then just run the GET call on that device group. Kind regards,Sebastian

Hello,I have a question when using the Search Path API.Could we get an elaboration on the meaning of that “DELIVERED_TO_INCORRECT_LOCATION” forward outcome status, such as why it appears and if there’s anything we can do to address the “INCORRECT_LOCATION” part, if it’s necessary?I presume the status means that somewhere along the routing, it somehow ended up at a destination Forward Networks didn’t expect. But I just wanted to know if there was any more to it.Thanks!

How can i collect below information from Forward Network via API for Network devices. ?• IP address,• MAC address• Interface details• Device Name• Subnet details1.Which API should be used to get the above information? In the documentation, I see an API to get           networks/ Network collection/ devices  ;2.Is there a single API call that can pull the above information, or are there multiple API calls?3.If it's one API call, what's the Max pagination limit?4.Can you please provide a Sample API  or a Postman export to make an API call.

Before we head off into the weekend I was hoping to ask the community what their stance is on schema based network configuration interfaces like NetConf and OpenConfig GNMI. Question 1: Do you currently or plan to use NetConf and/or GNMI to manage policy across your network? Do you leverage this in your automation pipeline? If so, do you find sufficient vendor support?Question 2: If you do leverage NetConf/GNMI for configuration data, do you still want to inspect the policies via CLI?Thanks for your insights.

On May 21st we have shown the integration between Forward and NetBox in a joint webinar. UPDATE: The webinar recording is now available on YouTube:https://youtu.be/TSX14uke1NE.The description includes a link to the webinar slides and the GitHub repository. The integration is part of the NetBox’s Network Automation Architecture framework where Forward provides the Observability and Assurance piece, as shown in the picture below:NetBox Network Automation Architecture The first use case is about onboarding an empty NetBox instance with device data collected by Forward, such as Devices, Interfaces, Vendors, Location, and so forth.Onboarding an empty NetBox instanceThe integration is based on a Python script. It imports the data from Forward using NQE queries via REST APIs, transform the data from the Forward to the NetBox schema and then exports it to NetBoxThe process can be automated using a web-hook so that NetBox is updated every time Forward collects from the network.To run the integr

Happy Thursday All!  I hope you’re having a great week. I know it’s been a busy one so I’ve highlighted this week’s most popular articles and discussions in the community. Did I miss one of your favorites? Add it in the comments below! Here’s the list... @AricaFN ‘s article on extracting data from custom commands is a great discussion for anyone that has to go beyond the data model to tailor the Forward platform to their organization’s specific needs. @Christopher is on fire (hehe) with this new NQE query that uses the Forward Enterprise aclEntry object to provide consistent output from any Firewall vendor. And if you’re interested in automation, @Christopher’s article on interfacing with Forward with API and Python is a great example to follow.  @Mike ‘s complete NQE tutorial video series is the go to for anyone learning NQE or experts brushing up on the finer points.  Building on @cariddir‘s scripts, @RobertWelch create this plug-and-play NQE to unify the Fortinet Version output for

Some customers have asked, “How do I run a custom command on just a few devices, to test if it gives me what I need for an NQE query?” You can do this with a workspace network!First, click the Network drop down and choose Add Workspace network  Add a name for your Workspace and click Next.  Add the device or devices you want to test the custom command(s) on and click Add X devices. Then Next.  Check the custom command group you want to include in the Workspace and click Next and Done. You can also skip this step and add the custom command in the workspace later.  Make sure you are in the new Workspace network in the Network selection drop-down. Go to Settings > Collection Settings > Custom commands and enable the Custom command group.(You can also add a new custom command from this page by editing the command group or adding a new one.) Return to the main page by clicking Search, and then choose Take Snapshot from the snapshot drop-down. This will collect the data using your cust

We have started to do some testing with FN. In our AWS network, we are using Cisco Firepower Threat Defense (FTD) devices managed by Firepower Management Console (FMC). FN is able to connect to an FTD and retrieve device details but does not support retrieval from FMC.In our network, for complicated routing reasons, we can’t easily enable FN to connect to our FTD instances. I can, however, provide a URL that will retrieve all the information from FMC. I would like to configure an “HTTP(S) external source” to provide that info. What I cannot figure out, however, is the required format for the data to that is returned by the URL GET. The document just states that FN will “infer” the schema. In my case, there’s no inference needed. I am writing the code that will return the info. I can format the data however FN needs it.For those who care about the details, the implementation is an AWS Lambda function that connects to the FMC REST API and returns the info. An AWS API gateway provides the

Hi all, We are getting “No processed Snapshot found. Please take a Snapshot and try again.” when trying to hook Forward Network with SNOW CMDB, anyone has any idea why this happen ? ( We do have snapshots already taken and processed) Thank you 

Incident Management: A Proactive Approach to Minimize Disruption Experiencing an incident can be chaotic, with alarms sounding off and urgent communications flooding in, often at the least opportune moments. The key to effective incident management is not just to respond with urgency but to anticipate and mitigate issues before they escalate. The TL;DRTo effectively manage incidents, you must first establish visibility across and baselines of your network. Know what’s normal and what’s not. Ensure robust logs are being collected in a centralized manner, and contain all relevant details to facilitate troubleshooting. Develop your response team. Know their strengths and weaknesses, and ensure everyone on the team has skin in the game. publish playbooks, runbooks, and other procedural documents so everyone knows what is expected of them during an incident. Foster relationships with your peers and other teams long before an incident ever begins. And always strive to improve your incident m