Configure Regular Expressions; Create A Regular Expression - Cisco ASA Series Configuration Manual

Chapter 12 Getting Started with Application Layer Protocol Inspection

Configure Regular Expressions

Regular expressions define pattern matching for text strings. You can use these expressions in some
protocol inspection maps to match packets based on strings such as URLs or the contents of particular
header fields.
•
•

Create a Regular Expression

A regular expression matches text strings either literally as an exact string, or by using metacharacters
so that you can match multiple variants of a text string. You can use a regular expression to match the
content of certain application traffic; for example, you can match a URL string inside an HTTP packet.
Before You Begin
Use Ctrl+V to escape all of the special characters in the CLI, such as question mark (?) or a tab. For
example, type d[Ctrl+V]?g to enter d?g in the configuration.
See the regex command in the command reference for performance impact information when matching
a regular expression to packets. In general, matching against long input strings, or trying to match a large
number of regular expressions, will reduce system performance.
As an optimization, the ASA searches on the deobfuscated URL. Deobfuscation compresses multiple
Note
forward slashes (/) into a single slash. For strings that commonly use double slashes, like "http://", be
sure to search for "http:/" instead.
The following table lists the metacharacters that have special meanings.
Table 12-3
Character Description
.
(exp)
|
?
Create a Regular Expression, page 12-15
Create a Regular Expression Class Map, page 12-17
Regular Expression Metacharacters
Dot
Subexpression
Alternation
Question mark
Notes
Matches any single character. For example, d.g matches
dog, dag, dtg, and any word that contains those
characters, such as doggonnit.
A subexpression segregates characters from surrounding
characters, so that you can use other metacharacters on
the subexpression. For example, d(o|a)g matches dog
and dag, but do|ag matches do and ag. A subexpression
can also be used with repeat quantifiers to differentiate
the characters meant for repetition. For example,
ab(xy){3}z matches abxyxyxyz.
Matches either expression it separates. For example,
dog|cat matches dog or cat.
A quantifier that indicates that there are 0 or 1 of the
previous expression. For example, lo?se matches lse or
lose.
Cisco ASA Series Firewall CLI Configuration Guide
Configure Regular Expressions
12-15