Capabilities

Forward AI answers questions by combining a small set of tools that operate on the digital twin. The categories below describe what's in scope, with sample prompts for each.

Ask in plain English; the agent picks the tools.

Connectivity and path tracing

Trace traffic between two endpoints, find what blocks a flow, or compare paths.

Sample prompts

• "Show the path from 10.1.2.3 to 10.4.5.6 for TCP on port 443 and explain where the traffic is being blocked or misrouted."
• "Explain why host-a can't reach 10.4.5.6 and identify the first device or rule that drops the traffic."
• "Can you verify that host-a is able to talk to 10.4.5.6? If not, tell me what's blocking it."
• "Can host-a (10.1.2.3) reach the SQL server at 10.20.5.8 on TCP 1433? If yes, which firewall rules permit it?"

The agent runs the same path-search engine that powers the Search application. The reply summarizes the path; to inspect it, open the Tracing path tool in the Plan & Tools panel and follow its Open in Search page link, which opens the path in Search with the same parameters pre-filled.

Forward AI's path tracing always starts from a specific source, so its path queries are grounded.

Inventory lookups

Resolve a name or identifier into structured details from the snapshot.

Sample prompts

• "What's the configuration of core-rtr-1?"
• "Show interface Ethernet1/1 on core-rtr-1."
• "Tell me about VLAN 100."
• "Which devices are in VRF customer-a?"
• "Where is host 10.1.2.3?"
• "Show details for cloud object vpc-0abc1234."
• "Which backend hosts sit behind VIP 10.50.10.5:443?"

Inventory tools cover devices, interfaces, VLANs, VRFs, hosts, and cloud objects. The agent decides which tool fits the question.

Subnet localization

Find where a subnet is attached in the network: which devices and interfaces serve it.

Sample prompts

• "Where is 10.0.0.0/24 attached?"
• "Which devices are connected to subnet 192.168.50.0/24?"

Vulnerability inquiry

Ask about CVEs in the network, devices affected by a specific CVE, or the riskiest exposures.

Sample prompts

• "What vulnerabilities are on core-rtr-1?"
• "Show devices with CVE-2024-XXXXX and find out if any are exposed to the internet."
• "Are there any vulnerabilities along the path between 10.1.2.3 and 10.4.5.6? If so, sort them by risk."
• "What vulnerabilities in my network pose the highest risk and should be addressed first?"

Vulnerability data comes from the same source that powers the Vulnerabilities dashboard. Replies include CVE identifiers, severity, and the affected devices.

Results that depend on advanced reachability

Some answers draw on advanced reachability analysis for the conversation's snapshot, such as whether a device is exposed to the internet. Forward AI never runs or triggers advanced reachability itself: its path tracing is always grounded, and where a result depends on advanced reachability that hasn't been computed, the agent reports that detail as undetermined rather than computing it. To get those answers, have advanced reachability computed for the snapshot, then ask again.

Open-ended analysis (NQE-backed)

For questions that don't map to a single inventory or path lookup, the agent generates an NQE query, runs it, and summarizes the result.

Sample prompts

• "List interfaces with duplex mismatch."
• "Identify firewall rules that haven't matched a packet in the last 30 days."
• "Show all hosts discovered on the network and the security zones they belong to."
• "Run an audit to find BGP peerings that are configured but currently not established."
• "Find all Cisco devices that don't use SSH."
• "Find ACLs that contain a permit any any rule and which device they're configured on."
• "Which devices still have telnet enabled?"

The NQE tool fetches at most 100 rows per query. The agent summarizes those rows, and the result table shows them. For larger result sets, refine the prompt or open the query in NQE directly.

If a generated query fails to validate, the agent retries automatically before reporting the failure.

Generate an NQE query

When you want a query to review, run, or save yourself rather than an answer, Forward AI generates the NQE query and returns it instead of executing it.

Sample prompts

• "Write me a query that finds down interfaces."
• "Give me an NQE query for unused ACLs."
• "Generate a query that groups devices by OS."
• "Create a query I can save to the NQE Library."

Forward AI opens the generated query in a query panel where you can run it against the conversation's snapshot, copy it, or save it to the NQE Library. Contrast the two approaches: open-ended analysis runs the query and summarizes the result; this returns the query for you to run yourself.

NQE documentation questions

Ask about NQE syntax or functions, and Forward AI answers from the NQE documentation.

Sample prompts

• "What is the syntax of group by?"
• "How does the foreach statement work?"
• "What does isPresent() do?"
• "What does the distinct function do?"

Forward AI grounds each answer in the NQE documentation and includes the sources it used. If the documentation doesn't cover the question, Forward AI says so instead of answering from general knowledge.

On a self-hosted deployment, documentation retrieval is a setting of the model provider. When it is off, Forward AI does not answer NQE documentation questions.

Configuration change history

Ask when a device's configuration changed and what changed, across the snapshots collected up to the conversation's snapshot.

Sample prompts

• "Show me the config change history for core-rtr-1."
• "When did the BGP configuration on core-rtr-1 last change?"
• "What changed on core-rtr-1 since the previous snapshot?"
• "Which commit added VRF prod1 on core-rtr-1, and what else did it change?"

The agent gets the device's configuration history, newest change first, and answers from the diffs. It lists each change with its snapshot and collection time and can show the exact lines added and removed at any change. You don't need to supply snapshot IDs. Forward detects a change only when it collects the device, so the exact time of the edit is unknown, and the reply gives the collection time. If the configuration records its own commit time (such as a Last commit line), the reply reports that time. The history stops at the conversation's snapshot, so changes collected later are not included.

Forward records a change only when the configuration content differs from the previous collection. Forward ignores these lines when it compares the two versions:

Line	Position in the file
Empty or whitespace-only	Any line
Starts with !	Any line
Starts with ntp clock-period	Any line
Starts with ## , such as ## Last commit: ...	Line 1
Starts with Load for	Line 1
Starts with a day of the week (Mon to Sun ), such as Wed Aug 22 10:34:17.379 UTC	Lines 1–2
Starts with Time source is NTP,	Lines 1–2
Starts with Current configuration :	Lines 1–10
Starts with # Exported by	Lines 1–10

The diffs that the agent reads and that the See changes dialog shows include every changed line. When Forward records a change, edits to ignored lines in the same collection also appear in its diff. The history does not show an edit that was made and reverted between two collections.

The Configuration history table in the reply lists the changes. See Inspecting evidence.

Question	Result
One device's configuration changes, optionally scoped to a section or line	Answered
Which devices had configuration changes in a time range, across the network	Out of scope. Use Diffs.
Past state other than configuration, such as last week's routes or interfaces	Out of scope
Whether a later change undid or restored an earlier one on the same device	Answered from the diffs. Forward does not record how a change was made, so a device rollback and a manual edit look the same.
Perform a rollback or revert	Out of scope. Forward AI does not modify the network.

Configuration history needs a setting that Forward enables and base v17 or later. See Configuration history requirements.

Network shape and complexity

Get high-level metrics about the size and complexity of the network.

Sample prompts

• "Summarize the complexity of this network."

Combining categories

Most real questions span multiple categories. The agent plans across tools. This prompt:

"Are there any vulnerabilities along the path between 10.1.2.3 and 10.4.5.6? If so, sort them by risk."

triggers a path search, then per-device vulnerability lookups along the path, then a final ranking. You see each step and its result in the plan & tools panel.

What Forward AI does not do

• It does not modify network state. There is no tool to push configuration, create a snapshot, or trigger a collection.
• It does not answer general IT questions unrelated to your network ("how does OSPF work?"). Those return an out-of-scope reply.
• It does not cross networks. A conversation is anchored to one network and one snapshot.

For details on out-of-scope replies and other boundaries, see Limits and scope.