topic Re: ASA - Check traffic with regex in Network Security

ASA - Check traffic with regex

Renzo_Orezzoli — Fri, 21 Feb 2020 15:27:34 GMT

I want to check specific ports & protocol messages for their data and only allow that data between two interfaces when it matches any of the conditions.

I built a regular expression class and have it OR match between the different regular expression's (name - value).

I think this is done correctly. But I'm not sure how to apply it to the interface(s).

Re: ASA - Check traffic with regex

Flavio Miranda — Sat, 03 Mar 2018 14:12:09 GMT

You need to add your class inside a policy and apply like this:

service-policy inside-policy interface inside

Refers to this doc:

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100535-asa-8x-regex-config.html

-If I helped you somehow, please, rate it as useful.-

Re: ASA - Check traffic with regex

Renzo_Orezzoli — Thu, 29 Mar 2018 20:51:18 GMT

I've tried to do that via that guide, but it specifies HTTP traffic, what I want to do is only allow certain data through the FW regardless of the port or protocol used. I want to scan the packet data itself for corruption.

Re: ASA - Check traffic with regex

Renzo_Orezzoli — Tue, 03 Apr 2018 14:44:01 GMT

I think I understand now that I need the submodule's help in doing what I want. I'm exploring firepower now to do just that.