topic Re: regex expressions in asa in Network Security

regex expressions in asa

suthomas1 — Mon, 11 Mar 2019 18:59:34 GMT

Does default regex in asa 5520 cause problems with any sites. our clients are facing problems with some website. Occurs when some core modules are used.

My asa has regex for aspx . this wasnt configured , but seems to be default.

Appreciate if someone can point on methods to verify the regex doesnt block anything or any other aspect in asa.

TIA.

Re: regex expressions in asa

Maykol Rojas — Mon, 25 Oct 2010 05:12:01 GMT

Hello

Regex are on the configuration but they are not applied, once you apply it under a layer 7 policy map is when they get active, once quick question, Do you have HTTP inspection under the policy map? Does it have drops?

Let me know.

Mike

Re: regex expressions in asa

suthomas1 — Mon, 25 Oct 2010 05:28:44 GMT

http doesnt exist in policy, hence nothing seen.

Re: regex expressions in asa

Maykol Rojas — Mon, 25 Oct 2010 05:46:05 GMT

Hello

Thanks for the reply, I see, do you have any CSC module or Websense configuration? Those are the only things that can be messing with you at this point, have you already identified the type of sites or the websites you cannot access?

Let me know

Mike

Re: regex expressions in asa

August Ritchie — Mon, 25 Oct 2010 05:58:03 GMT

You can do a "show service-policy" to see if drops are incrementing in any of the fields. You can also do a "show asp drop" to see all the reasons and counts that packets are dropping. Could you enlighten us as to what regex configuration you suspect is the issue?

Re: regex expressions in asa

Maykol Rojas — Mon, 25 Oct 2010 06:07:18 GMT

He already said he did not have any

Re: regex expressions in asa

suthomas1 — Mon, 25 Oct 2010 06:09:32 GMT

regex _default_http-tunnel "[/\\]HT_PortLog.aspx

this line in regex put me into thinking. the said website is also aspx , which made me check for any relevance for this.

thanks.

Re: regex expressions in asa

August Ritchie — Mon, 25 Oct 2010 06:10:16 GMT

My asa has regex for aspx

This part confused me, I wasn't sure what was meant by this.

Re: regex expressions in asa

Maykol Rojas — Mon, 25 Oct 2010 06:13:36 GMT

If it is not on a layer 7 policy map, then it is not applied or doing anything, I would suggest you to take a look at any websense configuration, CSC module policy and also to try to hook up a computer outside of the firewall and try to go to these websites and check if you get the same results.

Mike