Creating A Regular Expression Class Map - Cisco FirePOWER ASA 5500 series Configuration Manual

Configuring Special Actions for Application Inspections
Table 21-1
Character Description
\xNN
\NNN
To test and create a regular expression, perform the following steps:
To test a regular expression to make sure it matches what you think it will match, enter the following
Step 1
command:
hostname(config)# test regex input_text regular_expression
Where the input_text argument is a string you want to match using the regular expression, up to 201
characters in length.
The regular_expression argument can be up to 100 characters in length.
Use Ctrl+V to escape all of the special characters in the CLI. For example, to enter a tab in the input
text in the test regex command, you must enter test regex "test[Ctrl+V Tab]" "test\t".
If the regular expression matches the input text, you see the following message:
INFO: Regular expression match succeeded.
If the regular expression does not match the input text, you see the following message:
INFO: Regular expression match failed.
Step 2 To add a regular expression after you tested it, enter the following command:
hostname(config)# regex name regular_expression
Where the name argument can be up to 40 characters in length.
The regular_expression argument can be up to 100 characters in length.
The following example creates two regular expressions for use in an inspection policy map:
hostname(config)# regex url_example example\.com
hostname(config)# regex url_example2 example2\.com

Creating a Regular Expression Class Map

A regular expression class map identifies one or more regular expressions. You can use a regular
expression class map to match the content of certain traffic; for example, you can match URL strings
inside HTTP packets.
To create a regular expression class map, perform the following steps:
Create one or more regular expressions according to the
Step 1
Cisco Security Appliance Command Line Configuration Guide
21-8
regex Metacharacters (continued)
Escaped hexadecimal number
Escaped octal number
Chapter 21
Notes
Matches an ASCII character using hexadecimal (exactly
two digits).
Matches an ASCII character as octal (exactly three
digits). For example, the character 040 represents a
space.
"Creating a Regular Expression"
Using Modular Policy Framework
section.
OL-10088-01