Cloud Firewall

Thoughts on FWaaS Policy  This article assesses some key considerations when constructing a policy for Netskope One Firewall-as-a-Service (FWaaS/Cloud Firewall). FWaaS secures traffic destined for public IP addresses on non-web ports. It should be assumed that the real-time policy table is split into policy groups to aid administrators with the correct placement of their policies. The focus here is the implications of positional placement of policies for Layer 3/4, and Layer 7. This article assumes that the tenant has been enabled for Service and Destination profiles (the equivalent on a legacy tenant would be Custom Firewall Apps). It also assumes that non-web application firewall is enabled for app detection at L7. Netskope evaluates policies using a top-down approach, hence the first policy that matches the traffic flow criteria will apply. Key Points The following are some of the policy objects that can act on traffic processed by firewall and therefore potentially change behaviour

We are deploying the Tanium Client but Netskope prevents the client from peering. Once you disable Netskope Tanium work as expected. There is no documentation on the support portal. 

Note: I understand that traffic to Zoom is generally recommended to be bypassed.If I want to prohibit the use of Zoom's camera and microphone features, what kind of policy should I write?I was under the impression that writing a blocking policy in CFW would be sufficient to block usage, but the traffic does not seem to be getting blocked. Here is the configuration I applied:Under Settings > Security Cloud Platform > App Definition > Cloud & Firewall Apps, I added the following configuration.After that, I created a block policy under Real-time Protection. I expected that Zoom’s camera and microphone functionalities would be disabled as a result of the policy.However, users are still able to use those features.I would appreciate it if you could point out any mistakes or misconfigurations in my setup.

Hi team,We noticed that DNS TXT record response originally includes multiple entries, but after processing through Netskope, only a single entry remains.Not sure if it is because on our tenant DNS Security is enabled. Does anyone also face the same issue?

Hi Team,I have a query regarding one of our customers who is currently using an existing DNS SEC setup for both outbound and inbound traffic. Customer already have NGSWG procured. Their current traffic flow is as follows:[Roaming user] USER Endpoint >>> Active Directory DC >>> DNS Forwarder >>> DNS SEC CLOUD.For Internal their is a differ IP configured for them to resolve but need to connect with Citrix VPN.They want to understand how the traffic flow works with Netskope DNS SEC, which differs as it intercepts DNS queries for inspection.Here’s the scenario: When a user queries a domain, the request first goes to the Netskope cloud for Deep Packet Inspection (DPI). If the domain is malicious, it gets blocked; otherwise, it is allowed and forwarded through the Secure Web Gateway (SWG).My question is: If the user’s machine is configured with the DNS IP of the Active Directory (AD), does Netskope return the allowed traffic back to the client machine and then forw

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

Hello,We have quite a few joint customers who utilize your security solution. Recently, we’ve observed that some of these customers are encountering challenges with server-sent events (SSE) that we employ in our production environment for near real-time communication.Could you kindly clarify if Netskope buffers SSE streams for traffic inspection? If so, is there a recommended configuration or approach to ensure uninterrupted SSE functionality? Thank you for your assistance. Best regards,John

Try to deploy netskope on a server to block internet access  with an exception of  windows updates. I’ve been directed to the Cloud Explicit Proxy documentation but it seems like an overkill to what im trying to achieve.Anyone implemented this ?​​​​​​

Question: how can I allow or block Anydesk using Netskope Cloud Firewall? Create Anydesk Cloud Firewall Application (using the reference from Anydesk) Set up policy for block Try connecting with Anydesk - note this will timeout as there is a block Check Alerts for the block------------------------------------------------------------------------------------------------------Let’s change from block to allow Setup policy for AllowTry connecting with Anydesk Check Network Events for the allowIt’s simple to set up the policy for allowing or blocking the use of Anydesk.

Is there any local distributor/partner in china mainland? Can customers in china place the local order to these distributor/partners (if available) for Netskope services? 

To set up a GRE tunnel between Netskope and a FortiGate firewall and create a second static route with the same distance but lower priority, follow these steps:1. Create the GRE Tunnel in Netskope:  - Navigate to Settings > Security Cloud Platform > GRE.  - Click New GRE Configuration.  - Enter the required details and save the configuration.  - Copy the GRE Gateway IP addresses of the two closest Netskope POPs.2. Configure the GRE Tunnel in FortiGate:  - Use the following CLI commands:   shell     config system gre tunnel         edit "GRE NETSKOPE"             set interface "port1"             set remote gw <Netskope POP IP>             set local gw <Local IP>         next     end     3. Configure the GRE Interface:  - CLI commands:   shell     config system interface         edit "GRE NETSKOPE"             set ip 192.168.254.1 255.255.255.255             set allowaccess ping             set interface "port1"         next     end     4. Create the Static Routes:  -

Hi Guys, Looking if someone can help me with below issue we have.We do have roughly 5-7% of  Windows devices which failed to upgrade Netskope client at some point.These are versions 105.1.0.1406, 106.1.0.1464, 107.0.0.1455, 107.1.0.1529Once trying to uninstall manually it says MSI is missing. Newer msi versions won’t work as well, any way to uninstall/upgrade it without exact MSI version of installer? Al