Skip to main content

Product Updates
Events
Support
FWD.app

Home
Search

Recently active topics

26 Topics

Recently active

Most views Most replies

chrisnaishEmployee

posted in Videos

Is it Possible to See a Full Cloud Inventory in a Single View?

Check out this video from @Mike and myself as we discuss how to efficiently manage cloud inventory across AWS, Azure, and GCP cloud platforms using Forward Networks. Keeping tabs on cloud environments can be an arduous process requiring engineers to log into each cloud to gather inventory data. I show how to create a centralized dashboard with Forward Networks, aggregating and filtering information from all three clouds, allowing users to view data like compute instances, VPCs, and subnets in a single location. We also demonstrate using Network Query Engine (NQE) to audit and perform automated network checks across cloud environments with ease. I share a number of resources available for network engineers to learn Forward's platform, NQE, and multi-cloud networking best practices.

dakotaglorySpotter

posted in Product Discussions

Unable to snapshot; no sources configured when only custom source enabled

Scenario: Disabled all classic and all but one custom source in order to speed up and test an NQE with extractJson on an endpoint for a specific device. Observation: Unable to take a snapshot without at least one Classic source enabled.

dakotaglorySpotter

posted in Product Discussions

Bulk edit for custom sources

The ability to include/exclude custom sources in bulk in the same way as classic sources would be useful if capability is possible. Secondary to an ability to bulk include/exclude custom sources would be the ability to bulk edit custom source profiles, basic authentication, SSL validation, and location. I also noticed when editing custom source that I had to update in phases. I imported csv of devices. I then attempted to update the profile and auth and location but it stated the source already existed and when I exited it only saved one of the settings. I then edited the src again and updated the location. If I recall it was unable to edit the tags at the same time as other config fields as well. No big deal for the few devices in my workspace and I have finished update but wanted to bring to your attention.

dakotaglorySpotter

Convert MicroSeconds in NQE

A custom source API call returns a date field in microseconds format. Does NQE have a built in function to convert? For example, 1725899407, to Sept. 9, 2024. Currently I don’t need the hours and minutes but in the future it may be necessary. I’ve searched “date” and “microseconds” in the documentation and online without success.

dakotaglorySpotter

Do blockMatches require consistent line patterns?

Do patterns need to be standardized or will blockMatches match when lines are missing? pattern=```line one {main:string} sub-line1 may or may not be consistently present sub-line2 may or may not be consistently present sub-line3 {value1:string} is target and sub-line3 will always be there sub-line4 may or may not be consistently present sub-line5 may or may not be consistently present sub-line6 may or may not be consistently present sub-line7 may or may not be consistently present sub-line8 {value2:string} is target and sub-line8 will always be there sub-sub-line9 {value3:string} is target and sub-sub-line9 will always be there sub-line10 may or may not be consistently present sub-line11 may or may not be consistently present sub-line12 {value4:string} is target and may or may not be present sub-sub-line13 {value5:string} is target and sub-sub-line13 will be there if sub-line12 is present sub-line14 may or may not be consistently

kevinbrasherCommunity Manager

posted in Product Discussions

Community Highlight: AI Assist for NQE

We are thrilled to announce the release of AI Assist for NQE! Whether you're new to the platform or a seasoned NQE expert, AI Assist allows you to skip complex syntax and describe what you need in plain English, making it easier than ever to create NQE queries. Generating an NQE query using AI AssistWhat is AI Assist?AI Assist enables you to write NQE queries using everyday language. Instead of manually writing complex queries, you can simply describe what you're looking for, and AI Assist will generate the appropriate NQE query for you. For example, to create a query that lists all CVEs currently impacting devices within a network, you can type, “List CVEs impacting each device,” and NQE AI Assist will instantly translate that into a valid query. How to Use AI AssistUsing AI Assist is easy. Just follow these steps:Log in to Forward Enterprise. Navigate to the NQE Library. Open the query editor by adding a new query. Click the AI Assist button. In the Generate tab, type your natural la

NandSpotter

Nqe query for BGP Admin status id down

Hi All, Can you please help me to write a NQE query for all ip details where BGP Admin status id is showing down.

dakotaglorySpotter

Parse externalSource HttpEndPoint API ResponseBody

Custom source profile with Endpoint that is using “url/path?_return_type=json-pretty” but responseBody is one long line.I attempt to use splitJsonObjects; however, it isn’t returning in a structured layout for me to pattern match.

RobertWelchEmployee

CDP to the Rescue! AKA Search for Duplicate Hostnames and Management IPs with CDP

File this under “ya I’ll never do that again”. We’ve all had at least one “oops” that sticks with us.How does one find Cisco Switches or Routers that just happen to have the same Hostname or the same Management IP Address reported in LLDP and / or CDP? What if those alleged Cisco device just happen to have the same configuration except for the out of band management address? Accidentally of course. Well, this happened during a rapid stand up of two new Cisco routers. (Not me, of course. I learned this lesson many moons ago). To speed up the deployment, a copy / paste of config from one Router to two others occurred. Oh, yes, some nasty stuff happened after this. But that’s not pertinent to the resolution.NQE to the rescue. Since the Management IP addresses were “forgotten” or unknown to those troubleshooting the issue, how does one find these near identical twins? Remember that CDP announces Serial Numbers. LLDP typically does not advertise the device’s Serial Number. Thu

RobertWelchEmployee

A10 Load Balancer Service Group VIP, Virtual Servers, End / Real Host IPs and Status Report

A common debugging method for A10 Load Balancers is the command “show slb virtual-server bind”. This command enumerates the Virtual Server, its IP Address, the VIP Port, the End / Real Host IP Address and State. Let’s create a Custom Command for the A10 ACOS type devices to run “show slb virtual-server bind” and then add to the output of this report where the End / Real Host is connected and if the Host IP is indeed in the Forward Networks Inventory. For the Violation, if the Host IP is not in the Inventory, set a flag of false. Note that this is a third in a series of A10 Load Balancer NQEs. The two posted prior do not rely upon Custom Commands. The simple method of blockMatches is used. It’s a bit tricky to get the match string syntax correct at first. Why shouldn’t the string be parsed post match, for example. In other words, remove the colons, commas, and other characters post blockMatches matching. The A10 output strings like to have colons next to the output string.

RobertWelchEmployee

A10 Real Host Status, Connection, IP Address, Service Group and Virtual Server Report

For A10 Load Balancers, how does one quickly see all of the VIPs, End Host / Real Host IP Addresses, and Service status across all the A10s in one report? (You know the answer is NQE). Note that this is the second post in a series for A10 Load Balancer NQE reports. The first step is to check the status of each End Host / Real Host using the output of “show slb server”. This command is run ever time a Snapshot occurs. The next steps are to scrape the A10 Configurations to find the associated slb service-group, then the slb virtual-server. Along the way, let’s determine the Host Inventory to show the Host MAC, type and the network connection. Using a Violation to state whether the End Host is in the Inventory allows us to determine if the Host is modeled.Someone will probably figure out a method reduce the number of cycles through “foreach device in network.devices” for performance. For this particular immediate need to gather the information, the extra cycles are acceptable. There

RobertWelchEmployee

Show the A10 End Hosts, Status and Connectivity details per the FN Inventory

For A10 Load Balancers there are commands such as “show slb virtual-server bind” that displays the Virtual Server, Real Servers, TCP port and Status. But how do you show additional data and whether the End Host or Real Host is known?In some cases, the Health Check is not configured to ensure that the End Host or Real Server is up. For troubleshooting you would like to know exactly where the Real Server is connected. Or, how about just knowing what the Status is (Up or Down) for all of the VIPs and Real Servers across all of the A10s.This NQE parses the output of the A10 “show slb server” first. (This is not a Custom Command). Then we lookup the configured End Host / Real Host IP Address. And finally, determine if the IP Address is in the Forward Network Inventory.Some of the select statements are commented out. The ability to check the IP Address exists consistently in the “show slb server” output, Configuration lookup, and Inventory are available. Not all are enumerated in the

pjptsujitRamping Up

Split the output string value

foreach device in network.devicesselect { deviceName: device.name}For the above NQE, if I get the device names in the format “aaa_bbb_ccc”, is there a way to split the output based on the string “_” and have three different fields?

Vladi BEmployee

Best way to start writing a Parser - Part 2

In Part 1 of Best way to start writing a Parser I described how you can start writing a parser without running it against a snapshot, which can save a lot of time.I ended it with parsing the interface out of a device output blob.This Article will extend the same NQE, but I will extend the content of the information that we will be parsing for.As a reminder, here the final NQE from Part 1:test_string ="""GigabitEthernet0/0 is up, line protocol is up (connected) MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 1000Mb/s, media type is RJ45 output flow-control is XON, input flow-control is XON ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:00, output 00:00:00, output hang never Last clearing of "show interface" counters 25w3d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: Class-based queueing Output queue: 0/1

Vladi BEmployee

Best way to start writing a Parser - Part 1

Are you new to NQE?Do you need to write a pattern match parser but don't know where to start?Do you want to test your pattern match without running it against your snapshot, because it takes too long for each iteration?Well, I have been there and here's what I've learned.If you start writing a parser, you'll most likely run into multiple iterations that won't give you the desired results. If you're as impatient as me, you'd like to get your test results quickly back so you can adjust the parser.To do this, you can:Take a sample of the config or device output and store it in a variable. Write the parser to run against this sample. Check if the result is what you expect. Modify the parser and run step 3 until you get your expected results.Well, that sounds easy enough! But how do you actually do each of these steps?Here's an example.For example, lets assume you have to lookup information from the "show interfaces" command on Cisco devices, something like this:GigabitEthernet0/0 is up, li

rathidRamping Up

what is format to pass the the path parameter in Path Mtu consistency check ?is it a list of devices ? is it a traceroute ?or source or destination ip ?

ChristopherEmployee

Parameterized NQE query from the API

Suppose we have the following NQE query, which takes a List of Strings as a parameter called “awsRegion”. This NQE query returns a list of all NAT Gateways in AWS that are in a region in the given list.@querynatGatewaysByRegion(awsRegion : List<String>) = foreach cloudAccount in network.cloudAccounts where cloudAccount.cloudType == CloudType.AWS foreach vpc in cloudAccount.vpcs foreach natGateway in vpc.natGateways where natGateway.region in awsRegion select { vpcId: vpc.id, natGatewayId: natGateway.id, region: natGateway.region };In the GUI, you click the Parameters button, enter the region names, click save, and then execute.You can perform this same NQE query from the API.Using the curl command and entering a list of regions with [“us-east-1”, “us-east-2”] as the parameter.curl -X 'POST' \ 'https://fwd.app/api/nqe?networkId=123123' \ -H 'accept: application/json' \ -H 'Authorization: Basic <redacted>' \ -H 'Content-Type: application/json' \ -d '{ "queryId": "Q_1234

alineamorimRamping Up

NQE for OneIP table

How would one replicate the OneIP table with NQE, including info such as IP address, MAC address, vendor, switch name and switch port?

gbaronRamping Up

NQE to state whether NQE is a OS or Config match...or both.

I have an already pretty extensive NQE written to return a half dozen or so fields, but I cant figure out how to differentiate whether the CVE returned is a OS or Config match...or both. Can someone help with that code?

cariddirSpotter

Using NQE to get BGP routes advertised.

Has anyone put together a simple Query to grab the advertised routes to a BGP Peer?I haven’t had much time to try, but maybe someone has done this on side.In summary, I want to try and associate routes to a device/location in our branch environment.foreach device in network.deviceswhere "Branch" in device.tagNames && "WAN" in device.tagNames I thought there would be some simple query in the model to just pull ‘bgp advertised routes’ and I could limit it with the above, and associate that route to that location. But after looking for 10 min, I couldn’t find anything of use. Anyway, if anyone has done something, it would be great to see/try. I saw a very ‘wild’ one on the community @baher , amazing work BTW.But i’m basically looking for the result of the routes advertised to any BGP neighbor.

captainpacketEmployee

published in Videos

Get Visibility Into the Cloud: Craig and Mike Secure the World, One Cloud at a Time

Join @Mike and me, @captainpacket, as we use use Forward Networks to gain visibility into cloud environments and ensure security and audit readiness so Mike can take a vacation with confidence. We demonstrate cloud posture assessments, detect unauthorized traffic paths, and automate checks to quickly identify and fix security issues across the hybrid-cloud.Got questions? Ask them below!Discover expert insights as we tackle the challenge of securing cloud environments. Watch how we explore the lack of cloud visibility and the importance of a comprehensive audit process. See the real-time demonstration of using the Forward Networks platform to assess and visualize cloud security postures across multiple regions. Find out how automated queries can instantly detect security flaws like unauthorized backdoor connections. Learn how to verify if critical traffic is routed correctly through firewalls, avoiding potential security breaches. Witness the ease of generating compliance reports, ens

gbaronRamping Up

NQE > External Sources > SNMP sources > Outputs > rawOidEntries

Hello: I am not sure if this should be a discussion or question so apologies on that. I have an NQE where I am pulling the raw Oid data and displaying the rawValue result as an output. I want to be able to name each of those outputs so that its know to the public what that raw data represents. One such example is a returned value of INV: 2.12 in the rawValue field. But I would like to have know as hardware revision.I did apply names to the Oids in the custom source profile, but its not pulling that. Can this be done?

gbaronRamping Up

asked in Product Discussions

Can I pull the entire CVE database

Is there a way to export all CVEs that the platform is scanning for. We know how to get the ones that are affecting devices, but we want a list of them all, regardless of impact.

Sebastian CorosRamping Up

asked in Product Discussions

How to pull device files from multiple devices at once via the API

Hi Forward Networks team, I am looking at the API, specifically the call to get a device's data files.I can get the files for a single device at a time by just putting in the hostname in the parameters, however I was wondering if there is a parameter which will allow me to pull from multiple devices at once.For example lets say I want to pull from devices ABC, DEF, GHIorI want to pull from every device that starts with ABC*Is this something that can be done?Or would another possibility be to create a separate group of devices which includes all the devices I want to pull from and then just run the GET call on that device group. Kind regards,Sebastian

DannyRRamping Up

asked in Security

DELIVERED_TO_INCORRECT_LOCATION API Status Clarification

Hello,I have a question when using the Search Path API.Could we get an elaboration on the meaning of that “DELIVERED_TO_INCORRECT_LOCATION” forward outcome status, such as why it appears and if there’s anything we can do to address the “INCORRECT_LOCATION” part, if it’s necessary?I presume the status means that somewhere along the routing, it somehow ended up at a destination Forward Networks didn’t expect. But I just wanted to know if there was any more to it.Thanks!

1
2

Page 1 / 2

dakotagloryhas earned the badge NQE Contributor
GaryBhas earned the badge Community Champ Award
AndyLhas earned the badge Community Champ Award
Christopherhas earned the badge NQE Contributor
Tyson Henriehas earned the badge NQE Contributor

Show all badges

Powered by Gainsight

Terms of Use Cookie settings

Sign up

Already have an account? Login

Select a login option:

Register / Login Forward Employee Login

Welcome to the Forward Networks Community

Select a login option:

Register / Login Forward Employee Login

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK