topic ASA Reg Expression Exact Match in Network Security

ASA Reg Expression Exact Match

HARIS_HUSSAIN — Fri, 21 Feb 2020 16:38:42 GMT

I am trying to build ASA regex which will match only if the URL Is exactly https://yahoo.com

But it is also matching https://yahoo.co or https://yahoo etc

ciscoasa# test regex "https://yahoo.com" "https://yahoo.co"
INFO: Regular expression match succeeded.

ciscoasa# test regex https://yahoo.com https://yahoo\.com
INFO: Regular expression match succeeded.
ciscoasa#
ciscoasa#
ciscoasa# test regex https://yahoo.com https://yahoo\.co
INFO: Regular expression match succeeded.
ciscoasa# test regex https://yahoo.com https://yaho
INFO: Regular expression match succeeded.

Is there way to specify End of String like we can use ^ to specify beginning of string.

Re: ASA Reg Expression Exact Match

balaji.bandi — Wed, 09 Jan 2019 15:11:54 GMT

have you looked at this reference guide :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100535-asa-8x-regex-config.html

https://docs.pexip.com/admin/regex_reference.htm

Re: ASA Reg Expression Exact Match

Collin Clark — Wed, 09 Jan 2019 20:30:45 GMT

Try ^https:\/\/yahoo\.com

Re: ASA Reg Expression Exact Match

Marius Gunnerud — Wed, 09 Jan 2019 21:16:46 GMT

You can use the $ to match end of string.

Re: ASA Reg Expression Exact Match

HARIS_HUSSAIN — Thu, 10 Jan 2019 06:20:49 GMT

Nope Not Working

ciscoasa(config)#
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.com
INFO: Regular expression match succeeded.
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.c
INFO: Regular expression match succeeded.
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.com$
INFO: Regular expression match failed.
ciscoasa(config)# test regex https://yahoo.com ^https://yahoo.com$
INFO: Regular expression match failed.
ciscoasa(config)# test regex https://yahoo.com ^https://yahoo.com\$
INFO: Regular expression match failed.

Re: ASA Reg Expression Exact Match

HARIS_HUSSAIN — Thu, 10 Jan 2019 06:21:41 GMT

@Marius Gunnerud.
Tried with $ but still not working !!

ciscoasa(config)#
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.com
INFO: Regular expression match succeeded.
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.c
INFO: Regular expression match succeeded.
ciscoasa(config)# test regex https://yahoo.com ^https:\/\/yahoo\.com$
INFO: Regular expression match failed.
ciscoasa(config)# test regex https://yahoo.com ^https://yahoo.com$
INFO: Regular expression match failed.
ciscoasa(config)# test regex https://yahoo.com ^https://yahoo.com\$
INFO: Regular expression match failed.

Re: ASA Reg Expression Exact Match

Marius Gunnerud — Thu, 10 Jan 2019 09:51:30 GMT

It looks like you are testing incorrectly. You are changing the regex expression instead of the URL you are matching against.

ASA3# test regex https://yahoo.com ^https:\/\/yahoo\.com
INFO: Regular expression match succeeded.
ASA3# test regex https://yahoo.co ^https:\/\/yahoo\.com
INFO: Regular expression match failed.
ASA3# test regex https://yahoo ^https:\/\/yahoo\.com
INFO: Regular expression match failed.
ASA3# test regex yahoo.com ^https:\/\/yahoo\.com
INFO: Regular expression match failed.

Re: ASA Reg Expression Exact Match

HARIS_HUSSAIN — Thu, 10 Jan 2019 12:50:14 GMT

Dear Marius,

Still the issue is that we cannot define End of String.

So if there is any test after the string still it will match as below.

ciscoasa#
ciscoasa# test regex http://yahoo.com/a "http://yahoo\.com"
INFO: Regular expression match succeeded.
ciscoasa# test regex http://yahoo.com/test "http://yahoo\.com"
INFO: Regular expression match succeeded.
ciscoasa# test regex http://yahoo.co "http://yahoo\.com"
INFO: Regular expression match failed.
ciscoasa#

Re: ASA Reg Expression Exact Match

SgtMike70 — Mon, 24 Aug 2020 06:35:45 GMT

possibly try with an * at the end:

"http://yahoo\.com*"