Regex

Hi pulc001,

Thank you for reaching out to the Community! 

Please check out the following document for more info: Sophos UTM / Sophos XG Firewall: Regular expressions for defining URL patterns.

Thanks,

Hi Harsh Patel,

I actually built the regex in my previous thread using that article and also tried to use quick regex.   Not a regex expert myself, hence why I posted to the community for some help :)

Hi pulc001,

With the regex you configured, are you able to access the other pages on Facebook? 

How about adding the following entry? 

• ^([A-Za-z0-9.-]*\.)?facebook\.com/xxx

Can you provide the entire URL for the page you’re trying to configure the exception? 

Thanks,

Hi pulc001,

With the regex you configured, are you able to access the other pages on Facebook? 

How about adding the following entry? 

• ^([A-Za-z0-9.-]*\.)?facebook\.com/xxx

Can you provide the entire URL for the page you’re trying to configure the exception? 

Thanks,

Hi Harsh Patel,

The entire url is https://www.facebook.com/FinductiveLtd

I have tried ^([A-Za-z0-9.-]*\.)?facebook\.com/FInductiveLtd however this is still not being exceptioned.  

Try out

• ^([a-zA-Z0-9.-]*\.)?facebook\.com\.?/FinductiveLtd*

Also, are you doing TLS Decryption ? If you're not decrypting the traffic, the firewall won't be able to do this exception.

@prism we are not decrypting the traffic.  Then this must be the root cause.  

Well, that explain why your exceptions didn't worked before.

Without decrypting the traffic the firewall will only be able to see the SNI "www.facebook.com", in order to see the full URL Path you will need to decrypt the TLS connection.

Are you on v18 or v17.5 ?

we are on SFOS 18.0.4 MR-4.  The issue with decryption is that all internet traffic was being returned

as NET::ERR_CERT_AUTHORITY_INVALID

You need to import the Certificate Authority on every machine where TLS traffic will be decrypted.

You can get more information on this Article.

Also, if all machines are connected to Active Directory, you can import to all of them at the same time. (I believe the Article also covers this.)