Regular expression in Data Pattern

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Regular expression in Data Pattern

Not applicable

Hi all,

my Palo don't accept this regex when i try to creta a data pattern: [^d][^2][^t]\.xxxxxx\.fr

can anyone correct me if there is any mistake in this regexp

Thanks


13 REPLIES 13

L3 Networker

what are you trying to capture in data filtering?

L4 Transporter

Did you get an error like this:

-> pattern -> 3 -> regex '[^d][^2][^t]\.xxxxxx\.fr' is invalid. can't handle two dfas next to each other in pattern '[^d][^2][^t]\.xxxxxx\.fr'

yes exactly i get this error

What are you trying to search for? I'm going to guess this is for a custom application.

I think you just need to rework your RegEx.

i have this regex in my old proxy and i am trying to implement it in my Palo Alto to block an URL, as URL filtering in Palo Alto don't support the regex i am trying to implement this in data filtering with data pattern.i hope that you see what i mean.

i found the regex in the old proxy and it worked but in the palo i get error.

Can you give an example of that URL you are trying to filter on?

Are you trying to match on web domain *.xxxxxx.fr ? 

here is the exact regex, the problem is not in the URL it's on the regex:

[^d][^2][^t]\.terra-octet\.fr

Looks like you're trying to block a file sharing website.

Would blocking *.terra-octet.fr in the URL filtering profile not work?

I know this can be a last solution Smiley Happy and it works of course in the URL block list and this is what i had configuredon my PAN.

it not me who has configured the ironport.

but for me, i'am working on Palo Alto, and when trynig to configure excatly what is configured in the Ironport i have the error on the regex and i am asking why Palo Alto don't support this regex which is already working in the IronPort independtly on what the regex looking for.

i think that Palo Alto don't support all types of regex.

Here's what they say they support from the admin guide:

based on your link Palo Alto support [] and ^ but based on the example that i've shared it can't support a mixture of them like this: [^][^]

correct, two DFAs [^][^] is currently not supported.

  • 5144 Views
  • 13 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!