Adding Network Targets to Destination Profiles

When adding network targets under Definition in a destination profile, you can use exact or regex patterns for matching. Each line in this list must be a comment or a destination.

Comments

Comments are completely ignored during processing. Note that if a comment is included in the same line as a destination, the entry is invalid. UTF-8 is supported for comments.

To add a comment, start a line with a number sign (#) or semicolon (;). An empty line is also considered a comment. To create a multi-lined comment, add a number sign or semicolon to the start of each line.

Exact Matching

This section describes best practices and supported syntax for exact matching, including examples.

Best Practices for Exact Match

Consider the following best practices when adding destinations for exact matching:

• To match an original URL (e.g., https://www.netskope.com/), enter it in the following syntax: www.netskope.com or *.netskope.com (to match subdomains). While www.netskope.com/ is valid, using this syntax to match is not best practice.
• Add ports only when your policies must target specific ports. For some use cases, using a service profile is more suitable.
• Destination profiles do not support schemes (http:// and https://) and you must specify the port instead. For example, to restrict matches to HTTPS only, add port 443 to the destination (e.g., www.netskope.com:443).
• Add paths to your destinations only when necessary as this limits matches to decrypted traffic.
• Avoid query strings as reordered parameters prevent matching. For query matching, using regex is recommended. Query strings restrict matches to specific URLs if the parameters and order match.

Supported Syntax for Exact Match

Ensure that you use the correct syntax when adding destinations to the destination profile for exact matching.

FQDNs

Enter a valid domain name (e.g., www.netskope.com). This only matches requests to the specified domain and does not match subdomains. International domain name (IDN) encoding is supported.

PQDNs

Enter an asterisk (*) before a valid domain name (e.g., *.netskope.com). This matches requests to the specified top-level domain (TLD) and all subdomains. For example, *.netskope.com matches the TLD netskope.com and all subdomains. IDN encoding is supported.

IPs

Enter a valid IPv4 address (e.g., 163.116.128.1). This matches requests targeting the specified IP address.

CIDR

Enter a valid IPv4 CIDR with the prefix CIDR (e.g., CIDR:163.116.128.1/24). This matches requests targeting the IP addresses in the specified CIDR.

Ranges

Enter a valid IPv4 range with the prefix RANGE (e.g., RANGE:163.116.128.10-163.116.128.19). This matches requests targeting the IP addresses in the specified range.

Ports

(Optional) Add a port to the end of a destination to limit matching to the specified port (e.g., www.netskope.com:80). Valid values for TCP and UDP ports are between 1 and 65535. However, note that port ranges are not supported.

Paths & Queries

(Optional) Add a path or query to the end of a destination to limit matching to the specified path or query (e.g., www.netskope.com/path?q=value).

Special characters are supported for paths and queries:

• The following non-encoded characters are supported: !$&'()*+,-/:;=@[]_~
• The question mark (?) separates the path and query. A query can include an additional question mark.
• A number sign (#) marks a URL segment, which only the HTTP client processes. It isn’t sent to the proxy as destination profiles reject it to prevent misconfiguration.
• Other special characters must be URL encoded.
• The proxy evaluates the exact syntax the HTTP client sends. 

To match a folder, add a trailing slash (/) after the path. For example, www.netskope.com/path/ matches only the path folder such as www.nestkope.com/path/ and www.netskope.com/path/file.html. It doesn’t match the following: www.netskope.com/path or www.netskope.com/path2/. 

In contrast, www.netskope.com/path matches any URL starting with this path such as www.netskope.com/path, www.netskope.com/path/, www.netskope.com/path2/, www.netskope.com/path/file.html, and www.netskope.com/path_description.html.

Examples for Exact Match

The following are examples of valid exact match patterns.

# Examples of destinations supported in Destination Profiles
# Lines starting with # or ; are comments; empty lines are also comments.
# Syntax for exact match: (FQDN|PQDN|IP|CIDR|Range)[:Port][/Path[?Query]]

## Details for the main section (FQDN|PQDN|IP|CIDR|Range)

# FQDN (Fully Qualified Domain Name) matches the exact domain only
www.example.com

# PQDN (Partially Qualified Domain Name) starts with *.
# Matches the top domain and any subdomain
*.example.com

# IP based (also evaluates resolved domain)
163.116.128.80

# Range based (also evaluates resolved domain)
RANGE:163.116.128.10-163.116.128.19

# CIDR based (also evaluates resolved domain)
CIDR:163.116.128.0/17

## Options can be added to the main section

# [:Port] Option: restricts destination to a single port:
www.example.com:8080
*.example.com:8080
163.116.128.80:8080
RANGE:163.116.128.10-163.116.128.19:8080
CIDR:163.116.128.0/17:8080

# [/Path[?Query]] Option: restricts to HTTP Path and Query string
# Warning 1: Path and Query apply only to decrypted HTTP
# Warning 2: Query matches exact parameters in order; best to use regex
www.example.com/path
www.example.com/path?q=value
*.example.com/path
*.example.com/path?q=value
163.116.128.80/path
163.116.128.80/path?q=value
RANGE:163.116.128.10-163.116.128.19/path
RANGE:163.116.128.10-163.116.128.19/path?q=value
CIDR:163.116.128.0/17/path
CIDR:163.116.128.0/17/path?q=value

# Options can be combined, for example
www.example.com:8080/path?q=value
*.example.com:8080/path?q=value
163.116.128.80:8080/path?q=value
RANGE:163.116.128.10-163.116.128.19:8080/path?q=value
CIDR:163.116.128.0/17:8080/path?q=value

Regex

This section describes best practices, supported syntax, and unsupported syntax for regex matching, including examples.

Keep in mind that the regex patterns used for destination profiles are only supported in Netskope Proxy. Additionally, regex only evaluates the URL, not the resolved IP. If the domain is unknown, then the IP serves as the FQDN.

The key differences for evaluation are as follows. Before SSL decryption (with an SSL policy) and when traffic is not decrypted (with a Real-time Protection policy), the regex engine evaluates the FQDN string. After SSL decryption and if the port is standard (i.e., 80 for HTTP or 443 for HTTPS), the proxy evaluates the FQDN, path, and query. Otherwise, the proxy evaluates the FQDN, port, path, and query.

Best Practices for Regex

Consider the following best practices when adding destinations for regex matching:

• Use regex only when exact matching is impossible. For example, to match domains with subdomains, exact match (*.netskope.com) works best. To match requests with paths starting with /search , use exact matching.
• Regex is efficient for matching domains with multiple TLDs and matching query parameters.
• When writing regex, keep in mind that:
  • Periods (.) in domain names must be escaped.
  • Escaping slashes (/ ) in paths is not required.
  • Regex evaluates the full URL, including domain, path, and query parameters. To match only the domain, isolate it in the syntax.

Supported Syntax for Regex

Ensure that you use the correct syntax when adding destinations to the destination profile for regex. Netskope partially supports syntax from PCRE (Perl Compatible Regular Expressions) 8.41 or higher.

Literals & Escapes

Syntax	Description	Example
Literal characters	Plain characters	abc, foo
Escape sequences	Special character escapes	\., \*, \+, \?, \[, \]
Hexadecimal	\xhh	\x41 (character “A”)
Octal	\ooo	\101 (character “A”)
Unicode	\x{hhh...}	\x{1F600} (emoji)
Control characters	\n, \r, \t	\n (newline)

The following are valid examples:

foo\.com          # Matches "foo.com"
\d+\.\d+\.\d+     # Matches IP format
file\x2Etxt       # Matches "file.txt"

Character Classes

Syntax	Description	Example
.	Any character (except newlines)	a.c to abc, a1c
[abc]	Character set	[aeiou]
[^abc]	Negated character class	[^0-9]
[a-z]	Character range	[A-Za-z0-9]
\d	Digit [0-9]	\d+
\D	Non-digit [^0-9]	\D+
\w	Word character [A-Za-z0-9_]	\w+
\W	Non-word character	\W+
\s	Whitespace	\s+
\S	Non-whitespace	\S+
\h	Horizontal whitespace	\h+
\H	Non-horizontal whitespace	\H+
\v	Vertical whitespace	\v+
\V	Non-vertical whitespace	\V+

The following are valid examples:

[0-9]{1,3}\.[0-9]{1,3}    # Matches first two octets of IP
\w+@\w+\.\w+              # Simple email matching
\d{4}-\d{2}-\d{2}         # Date format YYYY-MM-DD

Quantifiers

Syntax	Description	Equivalent
*	Zero or more times	{0,}
+	One or more times	{1,}
?	Zero or one time	{0,1}
{n}	Exactly n times	N/A
{n,}	At least n times	N/A
{n,m}	n to m times	N/A
*?	Non-greedy zero or more	N/A
+?	Non-greedy one or more	N/A
??	Non-greedy zero or one	N/A
{n,m}?	Non-greedy range	N/A

The following are valid examples:

a*                # Matches "", "a", "aa", "aaa"
a+                # Matches "a", "aa", "aaa"
a?                # Matches "", "a"
a{3}              # Matches "aaa"
a{2,4}            # Matches "aa", "aaa", "aaaa"
a*?               # Non-greedy, prefers shortest match
<.*?>             # Matches HTML tags (non-greedy)

Anchors

Syntax	Description
^	Start of a string or line
$	End of a string or line
\A	Start of an absolute string
\Z	End of an absolute string
\z	End of a strict string
\b	Word boundary
\B	Non-word boundary

The following are valid examples:

^https://         # Must start with https://
\.com$            # Must end with .com
\bword\b          # Matches complete word "word"
^[a-z]+$          # Entire string must be lowercase letters

Groups and Alternation

Syntax	Description	Limitation
(abc)	Non-capturing group	This doesn’t capture content.
(?:abc)	Explicit non-capturing	N/A
a|b	Alternation (OR)	N/A
(a|b|c)	Grouped alternation	N/A

The following are valid examples:

(http|https|ftp)://       # Matches multiple protocols
(foo|bar)\.com            # Matches foo.com or bar.com
(?:www\.)?example\.com    # Optional www.

Inline Modifiers

Syntax	Description
(?i)	Case insensitivity
(?-i)	Turn off case insensitivity.
(?m)	Multi-line mode
(?s)	Single-line mode, i.e., . matches a newline.
(?x)	Extended mode, i.e., ignore whitespaces.

The following are valid examples:

foo(?i)bar(?-i)baz      # Only bar is case-insensitive
(?i)case-insensitive    # Entire expression is case-insensitive
(?x) \d+ \. \d+         # Extended mode, spaces ignored

Unicode

Syntax	Description
\x{hhh}	Unicode code point
\p{L}	Unicode letters
\p{N}	Unicode numbers
\p{S}	Unicode symbols
\p{Z}	Unicode separators
\P{L}	Non-unicode letters
HS_FLAG_UTF8	UTF-8 mode

The following are valid examples:

\p{L}+                  # Matches letters in any language
\p{Han}+                # Matches Chinese characters
\x{1F600}               # Matches specific emoji

Special Constructs

Syntax	Description
\Q...\E	Literal block
(?#comment)	Comment

Unsupported Syntax for Regex

The following is not supported in destination profiles.

Syntax	Description
(?=abc)	Positive lookahead
(?!abc)	Negative lookahead
(?<=abc)	Positive lookbehind
(?<!abc)	Negative lookbehind
(abc) capture	Extract matched content
\1, \2	Backreferences
(?<name>...)	Named capturing groups
\k<name>	Named backreferences
\g{n}	Relative backreferences
(?(condition)yes|no)	Conditional matching
(?(1)yes|no)	Group-based conditional
(?(R)yes|no)	Recursion conditional
(?R)	Recurse entire pattern
(?1)	Call subpattern
(?&name)	Call named subpattern
(?P>name)	Python-style recursion
\G	Last match end position
\K	Keep to left side
(*UTF)	UTF mode declaration
(*UCP)	Unicode properties
(*ACCEPT)	Accept match immediately
(*FAIL)	Force failure
(*SKIP)	Skip
(*PRUNE)	Prune
(*COMMIT)	Commit

Examples for Regex

The following are examples of valid regex patterns.

Example Regex Patterns for Multiple TLDs

The following are examples of regex expressions for matching Google searches on any supported TLD from the Google list of supported domains.

Example 1

This is an example of matching to all domains with an OR condition.

^(www\.)?google\.(com|ad|ae|al|am|as|at|az|ba|be|bf|bg|bi|bj|bs|bt|by|ca|cd|cf|cat|cg|ch|ci|cl|cm|cn|cv|cz|de|dj|dk|dm|dz|ee|es|fi|fm|fr|ga|ge|gg|gl|gm|gp|gr|gy|hn|hr|ht|hu|ie|im|iq|is|it|je|jo|ki|kg|kz|la|li|lk|lt|lu|lv|md|me|mg|mk|ml|mn|mu|mv|mw|ne|nl|no|nr|nu|pl|pn|pt|ro|ru|rw|sc|se|sh|si|sk|sn|so|sm|sr|st|td|tg|tl|tm|tn|to|tt|vg|vu|ws|com\.(af|ag|ai|ar|au|bd|bh|bn|bo|br|bz|cu|cy|do|ec|eg|et|fj|gh|gi|gt|hk|jm|kh|kw|lb|lc|ly|mm|mt|mx|my|na|ng|ni|np|om|pa|pe|pg|ph|pk|pr|py|qa|sa|sb|sg|sl|sv|tr|ua|uy|vc|ve|vn)|co\.(ao|bw|ck|cr|id|il|in|jp|ke|kr|ls|ma|mz|nz|th|tz|ug|uk|uz|ve|za|zm|zw))(/|$)

Example 2

This is an example of a broader TLD match.

^(www\.)?google\.(com?\.)?[a-z]{2,3}(/|$)

To match only the /search path:

^(www\.)?google\.(com?\.)?[a-z]{2,3}/search

Example Regex Pattern for Query

This is an example of blocking the keyword forbidden from a Google search.

^(www\.)?google\.(com?\.)?[a-z]{2,3}/search\?([^&]*&)*q=[^&]*forbidden([^&]*)

Example Regex Pattern for Keyword in Domain Name

This is an example of blocking the keyword forbidden anywhere in a domain name.

^[^/?]*forbidden[^/?]*(/|$)