topic Regular expressions in URL filtering in General Topics

Regular expressions in URL filtering

nftechservices — Thu, 25 Mar 2010 21:03:24 GMT

Any chance there will be support for regular expressions in URL block/allow lists and custom URL groups? It is annoying to have to enter both a base domain name and the domain name with "*." to completely allow/deny a domain.

It would be much preferred if I could put a single line that covered both "exampledomain.com" and "www.exampledomain.com" and gain the additional ability to do something like allow/deny exampledomain.com/examplepath[0-9]/* should I want to do so.

From my understanding this isn't currently implemented, but I would love to see it as a feature in the future.

Re: Regular expressions in URL filtering

swhyte — Thu, 25 Mar 2010 22:27:22 GMT

Hello,

currently there is no support for regualar expressions in url filtering.

There is also not a plan to support regular expressions in url filtering as it would be very resource intensive/expensive.

thanks

Re: Regular expressions in URL filtering

rps — Fri, 26 Mar 2010 05:04:29 GMT

What about making the PAN to automatically include subdomains when you create the basedomain in the urlfilter?

So you only have to write:

youtube.com

instead of:

youtube.com

*.youtube.com

Re: Regular expressions in URL filtering

kbernard — Tue, 12 Oct 2010 19:15:59 GMT

I agree with rps... We have a huge list of custom URL's that we want to block and it would make it twice as huge to have to write both the domain name and the wildcard for the subdomains.

Re: Regular expressions in URL filtering

rroberts — Wed, 30 Mar 2011 22:39:17 GMT

I'm resurrecting this post as this is something that has always bothered me about PAN OS.

@kbernard Sometimes it doesn't only double. As an example, I've seen content delivery networks and many popular social networking sites that have a ridiculous amount of nested sub domains. In these cases you will find yourself creating multiple "per period delimited wildcard" entries for every child of a zone. As an example consider the following:

pdf.downloads.cd.foo.com

To ensure you allow each sub domain that could potentially exist as a descendant of foo.com you would need the following:

foo.com

*.foo.com

*.*.foo.com

*.*.*.foo.com

As a suggestion to Palo Alto Networks, Why not follow the RFCs that govern DNS, they certainly seem applicable in this situation.

When dealing with wildcard resource records, the "*" label will match any descendant of <anydomain> while not affecting <anydomain> itself.

@swhyte The "limited wildcard" delimited by a period label "." seems unnecessary and TBH more resource intensive/expensive than the alternative.

Re: Regular expressions in URL filtering

kbernard — Wed, 30 Mar 2011 22:51:50 GMT

@rroberts - I agree about moving to the RFC standard. When we used Websense we just entered the root domain and the product took care of the primary domain and all subdomains automatically. I know this could be potentially problematic if you wanted to block the main domain only, or some combination of it and some of the subdomains, but this can easily be worked around with exceptions/whitelisting.

Re: Regular expressions in URL filtering

support6 — Wed, 27 Jul 2011 15:18:46 GMT

Is there a way around this?

what we see is that when we block *.*.foo.com - All surfing over the internet is being blocked.

Re: Regular expressions in URL filtering

pkruse — Mon, 08 Aug 2011 20:43:39 GMT

The multi wildcard in a *.* format is unsupported and it would block all raffic if added to a block list.

The example you gave shold be *.foo.com

~Phil