Product Updates for 25.10.0
Released: 2025-10-21We’re happy to announce the immediate release of Forward Enterprise 25.10.0, which introduces major enhancements across NQE, compliance, security, topology, and collector management, along with expanded device modeling and usability improvements.See the full release notes for Forward Enterprise version 25.10.0. What’s New NQE HistoryNQE History adds time-based visibility to Inventory+ queries, allowing users to see how network data evolves across snapshots. When enabled for a query that uses primary-keyed attributes, NQE History tracks when each unique record (such as a device, interface, or IP address) was last observed and shows that information alongside current query results. This capability eliminates the need to manually inspect multiple snapshots to determine when specific data first appeared or disappeared. Historical data is retained according to the configured history retention period. For additional information, visit the Inventory+ documentation page. Collector Management ViewThe new Collector Management View in the Platform section provides a centralized location for managing all collectors across the organization. It displays key details such as: version, IP address, encryption key hash, status, and associated networks. Along with version health indicators like: End of Life, No Support, or Outdated. Administrators can set a default collector for new networks, rename existing collectors, or remove inactive ones, all from a single, unified interface. Remote Collector Support for On-Premises DeploymentsOn-premises environments now support remote collectors, allowing data collection from isolated or segmented zones that cannot be reached directly from the main deployment. Administrators can choose from three modes: Bundled Only, Remote Only, or Both Allowed, and manage all collectors centrally. Remote collectors can be installed directly from the Forward cluster, use version-matching controls, support custom SSL certificates, and can be assigned to networks individually. Security-Focused Path Search ViewPath search now includes a dedicated security view that highlights devices responsible for enforcing access controls or performing IP address translation, while filtering out forwarding-only segments. This view makes it easier to analyze traffic enforcement points, NAT traversal, and exposure paths without distraction from routine forwarding activity. Improved Device Vulnerability MetricsDevice vulnerability dashboards now provide a more actionable overview of security risks. The summary highlights devices with confirmed vulnerabilities and identifies those reachable from the Internet. Each dashboard item is interactive, dynamically updating filters in the vulnerability table and maintaining those filters when users navigate to detailed vulnerability findings. STIG Compliance Refresh (CY25Q3)STIG verification scripts and policy checks have been updated in both the Verifications section and the NQE Forward Library to align with the Q3 2025 DISA STIG benchmark updates, ensuring consistent compliance validation. Parametrized STIGs (Tech Preview)This technical preview introduces parameterized STIG validation through spreadsheet uploads. Administrators can provide organization-specific parameters to evaluate checks that previously required manual review.Supported platforms include Cisco IOS Router NDM, Cisco IOS XE Router NDM, Cisco NXOS Switch NDM, and Cisco ASA NDM. Parameters can be uploaded using the fn-stig-policy.csv template from the Platform > Data Files > Import data file wizard, applying automatically across all networks. Dark Mode (Tech Preview)Dark Mode introduces a low-light interface theme available across most areas of the platform, improving accessibility and visual comfort. Dark Mode can be toggled on or off at any time, with additional support for the NQE Editor, File Viewer, and Topology views planned for a future release. Global Synthetic NodesSynthetic nodes, such as L3VPN, now appear across all connected locations in topology views, similar to the Internet node. This improvement provides a clearer representation of inter-location connectivity and removes the need to manually assign synthetic nodes to specific locations. Public Subnet Exclusion for Internet NodesAdministrators can now define specific public IP subnets to be excluded from the Internet node, allowing those ranges to be treated as internal networks. This ensures proper handling of internal public addresses for routing, location inferences, and path searches. Discovery ExclusionsDiscovery scans can now exclude specified IP addresses or subnets on a per-network basis. This allows administrators to refine scan scope, avoiding unnecessary traffic to sensitive or non-essential devices during automated discovery processes. Host Enrichment with Endpoint and Scanner DataHosts discovered in Topology or Inventory+ are now enriched with endpoint data and vulnerability scanner information,. Enrichment includes hostnames, open ports, and other attributes, improving visibility into network reachability and device relationships. Password Policy Enhancements for SaaS OrganizationsSaaS administrators can now configure password strength and reuse limits, bringing SaaS deployments to feature parity with on-premises deployments. This enhancement improves account security and compliance for managed user access. Modeling and Device SupportThis release adds support for Cisco Firepower FXOS and extends Segment Routing v6 (SRv6) coverage to Cisco IOS-XR, IOS-XE, NXOS, Nokia SR OS, and Juniper JunOS, expanding modeling coverage for advanced routing configurations.
