Understanding Match Objects

05/11/2020 2 3960

DESCRIPTION:

Match objects represent the set of conditions which must be matched for actions to take place. This includes the object type, the match type (exact, partial, regex, prefix, or suffix), the input representation (text or hexadecimal), and the actual content to match. Match objects were referred to as application objects in previous releases.

Hexadecimal input representation is used to match binary content such as executable files, while alphanumeric (text) input representation is used to match things like file or email content. You can also use hexadecimal input representation for binary content found in a graphic image. Text input representation could be used to match the same graphic if it contains a certain string in one of its properties’ fields. Regular expressions (regex) are used to match a pattern rather than a specific string or value and use alphanumeric input representation.

The File Content match object type provides a way to match a pattern or keyword within a file. This type of match object can only be used with FTP Data Transfer, HTTP Server, or SMTP Client policies.

CAUSE:

We have the following Supported Match Object Types:

You can see the available types of Match objects from drop-down menu by navigating to Manage | Objects | Match objects and then clicking on the Add option and selecting Match object.

You can use the LOAD FROM FILE button to import content from predefined text files that contain multiple entries for a match object to match. Each entry in the file must be on its own line. The Load From File feature allows you to easily move App Rules settings from one firewall to another.

Multiple entries, either from a text file or entered manually, are displayed in the List area. List entries are matched using the logical OR, so if any item in the list is matched, the action for the policy is executed.

A match object can include a total of no more than 8000 characters. If each element within a match object contains approximately 30 characters, then you can enter about 260 elements. The maximum element size is 8000 bytes.

Regular Expressions:

You can configure regular expressions in certain types of match objects for use in App Rules policies. The Match Object Settings options provide a way to configure custom regular expressions or to select from predefined regular expressions. The SonicWall implementation supports reassembly-free regular expression matching on network traffic. This means that no buffering of the input stream is required, and patterns are matched across packet boundaries.

SonicOS provides the following predefined regular expressions:

Predefined regular expressions can be selected during configuration, or you can configure a custom regular expression.

NOTE: For more details on the Regex syntax and custom regular expressions, please go through the SonicOS Admin guide for SonicOS Policies available at SonicOS Technical Documentation

Negative Matching:

Negative matching provides an alternate way to specify which content to block. You can enable negative matching in a match object when you want to block everything except content. When you use the object in a policy, the policy will execute actions based on the absence of the content specified in the match object. Multiple list entries in a negative matching object are matched using the logical AND, meaning that the policy action is executed only when all specified negative matching entries are matched.

Although all App Rules policies are DENY policies, you can simulate an ALLOW policy by using negative matching. For instance, you can allow email .txt attachments and block attachments of all other file types. Or you can allow a few types and block all others.

Not all match object types can utilize negative matching. For those that can, you will see the Enable Negative Matching checkbox on the Add/Edit Match Object dialog.

NOTE: Match Objects are used in conjunction with Action Objects to create App rules. Please use the link Most common configurations for App rules to look at the way these Match Objects can be used for specific scenarios.