Creating A Regular Expression Class Map - Cisco PIX 500 Series Configuration Manual

Chapter 21 Using Modular Policy Framework
hostname(config)# regex name regular_expression
Where the name argument can be up to 40 characters in length.
The regular_expression argument can be up to 100 characters in length.
The following example creates two regular expressions for use in an inspection policy map:
hostname(config)# regex url_example example\.com
hostname(config)# regex url_example2 example2\.com

Creating a Regular Expression Class Map

A regular expression class map identifies one or more regular expressions. You can use a regular
expression class map to match the content of certain traffic; for example, you can match URL strings
inside HTTP packets.
To create a regular expression class map, perform the following steps:
Create one or more regular expressions according to the
Step 1
Create a class map by entering the following command:
Step 2
hostname(config)# class-map type regex match-any class_map_name
hostname(config-cmap)#
Where class_map_name is a string up to 40 characters in length. The name "class-default" is reserved.
All types of class maps use the same name space, so you cannot reuse a name already used by another
type of class map.
The match-any keyword specifies that the traffic matches the class map if it matches at least one of the
regular expressions.
The CLI enters class-map configuration mode.
(Optional) Add a description to the class map by entering the following command:
Step 3
hostname(config-cmap)# description string
Identify the regular expressions you want to include by entering the following command for each regular
Step 4
expression:
hostname(config-cmap)# match regex regex_name
The following example creates two regular expressions, and adds them to a regular expression class map.
Traffic matches the class map if it includes the string "example.com" or "example2.com."
hostname(config)# regex url_example example\.com
hostname(config)# regex url_example2 example2\.com
hostname(config)# class-map type regex match-any URLs
hostname(config-cmap)# match regex url_example
hostname(config-cmap)# match regex url_example2
OL-12172-03
Configuring Special Actions for Application Inspections
"Creating a Regular Expression"
Cisco Security Appliance Command Line Configuration Guide
section.
21-9