topic Using regex in defining a group address object in General Topics

Using regex in defining a group address object

OPinchasof — Mon, 10 Jun 2019 14:42:57 GMT

I'm defining a new group address object which should include addresses of several different tags (e.g. "Tag_1", "Tag_2", etc.).

When trying to define the match field I cannot find a way to actually do that. I'm not sure it's even supported. Whatever pattern I use, no address object is assigned to the group.

I've tried patterns in the following style:

'Tag_.*', Tag_.*

and some more.

Does anyone know what's the correct syntax for that or whether it's supported?

Thanks

Re: Using regex in defining a group address object

reaper — Wed, 12 Jun 2019 18:55:39 GMT

single quotes and an operator (and, or)

eg: 'cloudflare' or 'google'

Re: Using regex in defining a group address object

OPinchasof — Wed, 12 Jun 2019 22:01:36 GMT

Thanks.

My question though was whether I can use a regex for that. I understand that what you wrote is actually the only option?

Re: Using regex in defining a group address object

jvalentine — Wed, 12 Jun 2019 22:20:42 GMT

You can use the CLI (and API) as well. Here's the documentation for the CLI commands:

- https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/cli-commands-for-dynamic-ip-addresses-and-tags.html

Like the GUI, the CLI commands also use equal/not-equal and expect a single tag or list of tags. In order to leverage a regular expression for your use-case, the regex would have to run "off-box" - and then you'd have to ingest that data into PAN-OS via API, Python, CLI, etc.

I could see where this might be useful. You may want to reach out to your Palo Alto Networks SE and file a feature request.

Re: Using regex in defining a group address object

OPinchasof — Thu, 13 Jun 2019 05:38:10 GMT

Thank you.

I'll definitely try to have this implemented in the firewall. It is a very useful feature in our scenarios, given that we add new tags from time to time and prefer not to update the group address objects every time.