topic Re: Regex expression to block certain URL's. in Network Security

Regex expression to block certain URL's.

Sundeep Dsouza — Tue, 12 Mar 2019 01:00:06 GMT

Hi,

I am trying to block certain URL paths within a website. For example I would want to block any request to www.asdf.com/test/input.asp, other request like www.asdf.com should be accepted.

I tried building a regex to match test/input.asp and the regex test says match succeeded, however after applying it via service policy the URL still works. The following regex has been applied to match test/input.asp

.+\/test\/input\.asp

Where could I be wrong?

Regards

Re: Regex expression to block certain URL's.

Karsten Iwen — Wed, 13 Feb 2013 07:23:04 GMT

Please paste your complete filtering-config. And be aware that it can't work if you access the site with HTTPS. Are you an the ASA or on an IOS-router?

Sent from Cisco Technical Support iPad App

Re: Regex expression to block certain URL's.

Sundeep Dsouza — Wed, 13 Feb 2013 07:50:52 GMT

Hi Karsten,

The filtering config reads like the following:

regex Block-test ".+\/test\/input\.asp"

access-list outside_mpc extended permit ip any host 2.2.2.2

class-map outside-class

match access-list outside_mpc

policy-map type inspect http Block-test

parameters

match request uri regex Block-test

drop-connection log

policy-map outside-policy

class outside-class

inspect http Block-test

service-policy outside-policy interface outside

Its not an https connection and the configuration is on the ASA.

Regards

Re: Regex expression to block certain URL's.

Karsten Iwen — Wed, 13 Feb 2013 08:32:36 GMT

Your regex has to be the following:

regex Block-test "\/test\/input\.asp"

The URI doesn't include the fqdn. So there is nothing to match before the "/test ..."

And is your asa on version <= 8.2? If not the IP in the ACL has to be the real IP.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Re: Regex expression to block certain URL's.

Sundeep Dsouza — Wed, 13 Feb 2013 09:19:19 GMT

It worked, thanks a lot.

Regards