Regular expression in Data Pattern

[nmarchal]

Hi all,

my Palo don't accept this regex when i try to creta a data pattern: [^d][^2][^t]\.xxxxxx\.fr

can anyone correct me if there is any mistake in this regexp

Thanks

[jnguyen]

what are you trying to capture in data filtering?

[mharding]

Did you get an error like this:

-> pattern -> 3 -> regex '[^d][^2][^t]\.xxxxxx\.fr' is invalid. can't handle two dfas next to each other in pattern '[^d][^2][^t]\.xxxxxx\.fr'

[nmarchal]

yes exactly i get this error

[mharding]

What are you trying to search for? I'm going to guess this is for a custom application.

I think you just need to rework your RegEx.

[nmarchal]

i have this regex in my old proxy and i am trying to implement it in my Palo Alto to block an URL, as URL filtering in Palo Alto don't support the regex i am trying to implement this in data filtering with data pattern.i hope that you see what i mean.

i found the regex in the old proxy and it worked but in the palo i get error.

[mharding]

Can you give an example of that URL you are trying to filter on?

[rmonvon]

Are you trying to match on web domain *.xxxxxx.fr ? 

[nmarchal]

here is the exact regex, the problem is not in the URL it's on the regex:

[^d][^2][^t]\.terra-octet\.fr

[mharding]

Looks like you're trying to block a file sharing website.

Would blocking *.terra-octet.fr in the URL filtering profile not work?

[nmarchal]

I know this can be a last solution and it works of course in the URL block list and this is what i had configuredon my PAN.

it not me who has configured the ironport.

but for me, i'am working on Palo Alto, and when trynig to configure excatly what is configured in the Ironport i have the error on the regex and i am asking why Palo Alto don't support this regex which is already working in the IronPort independtly on what the regex looking for.

i think that Palo Alto don't support all types of regex.

[mharding]

Here's what they say they support from the admin guide:

[nmarchal]

based on your link Palo Alto support [] and ^ but based on the example that i've shared it can't support a mixture of them like this: [^][^]

[rmonvon]

correct, two DFAs [^][^] is currently not supported.