topic Re: Regular expression in Data Pattern in General Topics

Regular expression in Data Pattern

nmarchal — Tue, 29 Nov 2011 15:21:08 GMT

Hi all,

my Palo don't accept this regex when i try to creta a data pattern: [^d][^2][^t]\.xxxxxx\.fr

can anyone correct me if there is any mistake in this regexp

Thanks

Re: Regular expression in Data Pattern

jnguyen — Tue, 20 Dec 2011 05:22:45 GMT

what are you trying to capture in data filtering?

Re: Regular expression in Data Pattern

mharding — Tue, 20 Dec 2011 14:05:57 GMT

Did you get an error like this:

-> pattern -> 3 -> regex '[^d][^2][^t]\.xxxxxx\.fr' is invalid. can't handle two dfas next to each other in pattern '[^d][^2][^t]\.xxxxxx\.fr'

Re: Regular expression in Data Pattern

nmarchal — Tue, 20 Dec 2011 14:42:24 GMT

yes exactly i get this error

Re: Regular expression in Data Pattern

mharding — Tue, 20 Dec 2011 15:03:07 GMT

What are you trying to search for? I'm going to guess this is for a custom application.

I think you just need to rework your RegEx.

Re: Regular expression in Data Pattern

nmarchal — Tue, 20 Dec 2011 15:17:24 GMT

i have this regex in my old proxy and i am trying to implement it in my Palo Alto to block an URL, as URL filtering in Palo Alto don't support the regex i am trying to implement this in data filtering with data pattern.i hope that you see what i mean.

i found the regex in the old proxy and it worked but in the palo i get error.

Re: Regular expression in Data Pattern

mharding — Tue, 20 Dec 2011 17:39:50 GMT

Can you give an example of that URL you are trying to filter on?

Re: Regular expression in Data Pattern

rmonvon — Tue, 20 Dec 2011 20:58:52 GMT

Are you trying to match on web domain *.xxxxxx.fr ?

Re: Regular expression in Data Pattern

nmarchal — Wed, 21 Dec 2011 07:18:00 GMT

here is the exact regex, the problem is not in the URL it's on the regex:

[^d][^2][^t]\.terra-octet\.fr

Re: Regular expression in Data Pattern

mharding — Wed, 21 Dec 2011 13:58:05 GMT

Looks like you're trying to block a file sharing website.

Would blocking *.terra-octet.fr in the URL filtering profile not work?

Re: Regular expression in Data Pattern

nmarchal — Wed, 21 Dec 2011 14:23:34 GMT

I know this can be a last solution and it works of course in the URL block list and this is what i had configuredon my PAN.

it not me who has configured the ironport.

but for me, i'am working on Palo Alto, and when trynig to configure excatly what is configured in the Ironport i have the error on the regex and i am asking why Palo Alto don't support this regex which is already working in the IronPort independtly on what the regex looking for.

i think that Palo Alto don't support all types of regex.

Re: Regular expression in Data Pattern

mharding — Wed, 21 Dec 2011 14:28:05 GMT

Here's what they say they support from the admin guide:

Re: Regular expression in Data Pattern

nmarchal — Wed, 21 Dec 2011 14:41:20 GMT

based on your link Palo Alto support [] and ^ but based on the example that i've shared it can't support a mixture of them like this: [^][^]

Re: Regular expression in Data Pattern

rmonvon — Wed, 21 Dec 2011 14:50:53 GMT

correct, two DFAs [^][^] is currently not supported.