Coyote Point Systems Equalizer GX Series, Administration Manual

Page: 400 / 866

Working with Clusters and Match Rules
Considering Case in String Comparisons
String comparisons performed by match functions honor the setting of the
ignore case
cluster
parameter: if it is set on the cluster (the default), then all match rule functions used for that
cluster are case insensitive; that is, the case of strings is ignored. For example, the string “ab”
will match occurrences of “ab”, “Ab”, “aB”, and “AB”. If
ignore case is not set on the cluster, then
all string comparisons are by default case sensitive (the string “ab” will match only “ab”).
To override the
ignore case
flag setting on the cluster for a match function or block of functions,
you must logically AND the
observe_case()
or
ignore_case()
functions with the match function or
block. For example, if ignore case is set on the cluster, you would use the following expression to
force the header_substr() function to make case sensitive string comparisons:
(observe_case() and header_substr(\"host\", \"MySystem\"))
Regular Expressions
Some match functions have prefix , suffix , substr , or regex variants. The regex variants interpret
an argument as a regular expression to match against requests. Regular expressions can be very
costly to compute, so use the
prefix , suffix , or substr variants of functions (or Boolean
combinations of prefix and suffix testing), rather than the regex function variants, for best
performance. For example, the following regular expression match:
dirname_regex(\"(two|four|six|eight)\")
Can be replaced by the more efficient:
dirname_substr(\"two\") OR
dirname_substr(\"four\") OR
dirname_substr(\"six\") OR
dirname_substr(\"eight\")
Note that Equalizer match rule expressions support POSIX regular expression syntax only.
400 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.