Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 285 Topics
  • 668 Replies
285 Topics
S
sean.clowesNew Member
asked in Next Gen SWG
Agent Deployment after macOS 15+

Hey folks, does anyone have any experience so far deploying Netskope Steering Agent to macOS in versions above 15?  Our Jamf policies that have worked for some time have stopped. Specifically the VPN configuration profile fails to deploy with the error:The ‘VPN Service’ payload could not be installed. The VPN service could not be created. This continues to work on anything below 15. Anyone needed to update their Jamf policies in order to get this to work? And by policies I mean the configuration profiles?

10
S
20 minutes ago
D
drftordieNew Member
asked in Next Gen SWG
Netskope Blocking Dialpad calls in Chrome only on MAC - Help

Hello all,I have a weird issue that I dont know how to fix. The issue is that when using Dialpad (Cloud Phone System) in the Chrome, Safari or the Brave browser on a MAC device (this does not seem to affect Windows) to make calls and or use Dialpads meeting feature something is being blocked. But the kicker is it is not being blocked when using Firefox on the MAC.What happens for calls is I will initiate the call (I used my personal cell for the test) it will not make the default ringing noise we all know and love but the noise that Dialpad makes when starting the call (its like a ding, ding noise idk). Then my cell sees the incoming call, I answer it but neither side can hear the other talking. The call will stay connected but again no one can hear the other person. Then sometimes when I answer the call on my cell it will seem like it connected the call then just hang up the call automatically.I made sure that the domains in the Desktop Native, Mobile, & Browser Applications secti

250
D
7 days ago
S
Netskope Employee
scarlileNetskope Employee
posted in Next Gen SWG
Checking URL for category and URL List using Rest API

How can we check which category and URL list a specific URL belongs to?Rest API provides a useful method to extract this information. How to use Rest API:-Go to Settings/Tools/Rest API v2  Select API DocumentationEnsure there is a token which has:- /api/v2/nsiq/urllookupSearch or scroll down to /api/v2/nsiq/urllookupClick to try out the API Edit the text to select the URLs  you want to check for category and URL list Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your API token, and any brackets, or commas in the requested body above. The response will show the categories (pre-defined & Custom) and URL lists To verify the categories are correct, check the tenant UI If you need to modify the URL lists, check out:-https://community.netskope.com/real-time-protection-key-policies-72/how-to-automate-url-list-updates-via-api-7167 

220
S
Netskope Employee
7 days ago
J
jpiresNew Member
asked in Next Gen SWG
Entra Conditional Access Issue

We have recently enabled conditional access in Entra and ran into a problem.  Our setup says that only machines coming from one of our facilities or a Netskope IP range can access Teams, Outlook, etc.The issue we are having occurs when a user is booting up their machine, Netskope does not enable before Teams and Outlook, causing the user to have to close the apps and click Sign In until a Netskope tunnel is enabled.Is there something from the Netskope tenant we need to adjust to prevent users from having to close all of their programs each time they reboot or is this issue on the Microsoft side?  We considered a GPO for preventing Teams and Outlook from booting to allow Netskope to enable as well.Any information anyone could provide would be appreciated.  Thank you!

521
A
Netskope Employee
11 days ago
M
maxNew Member
asked in Next Gen SWG
Connection closed by client nsClientUI_s1

I’m trying to determine what caused the following chain of actions:2024/11/04 16:00:22.638 stAgentSvc p14d8 tcc0 error NSCom2.cpp:1038 NSCOM2 recv failed 100542024/11/04 16:00:22.638 stAgentSvc p14d8 tcc0 error NSCom2.cpp:783 NSCOM2 startServerMessagePump: Connection closed by client nsClientUI_s1 Then further down in the logs I’m seeing: 2024/11/04 16:00:34.177 stAgentSvc p14d8 t14dc info config.cpp:10145 Config [sessId 1] Marking user config for delete2024/11/04 16:00:34.177 stAgentSvc p14d8 t14dc info npaTunnelMgr.cpp:933 CNpaTunnelMgr Handle session change for NPA active session 1, log off session 12024/11/04 16:00:34.177 stAgentSvc p14d8 t14dc info npaTunnelMgr.cpp:608 CNpaTunnelMgr Set NPA (desired) status from [NPA_TO_STOP] to [NPA_TO_STOP]2024/11/04 16:00:34.177 stAgentSvc p14d8 t14dc info tunnelMgr.cpp:1695 CTunnelMgr Disconnecting tunnel for sessId 12024/11/04 16:00:34.177 stAgentSvc p14d8 t14dc info tunnel.cpp:288 nsTunnel TLS disconnecting nsTunnel, context = NSTUNNEL_DISCO

221
A
Netskope Employee
11 days ago
A
adebrattoNew Member
asked in Next Gen SWG
Real-Time Protection Policy Review

Our organization must review our policies to determine if the existing policies are still valid and need to be retained.  Problem we are having is that “allow” rules do not appear to log anywhere.  Short of turning all “allow” rules to be “alert” rules, does anyone have a way to validation if a web access rule is actually being used and needed to be retained?

362
A
12 days ago
shubhamk
Netskope Partner
shubhamkNetskope Partner
asked in Next Gen SWG
Browser extensions

Dear Team, Could we manage browser extensions (including installation and execution) using NGSWG? Best Regards,Shubham

6165
A
13 days ago
H
Netskope Partner
hshimizuNetskope Partner
asked in Next Gen SWG
Do I get a warning if I exceed the number of registered URLs in my Netskope tenant?

Dear Everyone, The limit for URL lists per tenant is 300 K.Does anyone get an Error in the tenant UI when creating a URL List in a tenant that exceeds 300 K?If anyone has experience creating a ULR List that exceeds 300 K, it would be helpful for me.I would like to know whether tennant UI could inform it to user or not. URL List LimitsCurrently, the total URL List limit per tenant across all URL lists is 300K. The URL List limit using Regex across all URL lists in that tenant is 1K (this 1K count includes only the regex written not the expanded format).https://docs.netskope.com/en/url-list-best-practices/Thank you and Best Regards,Hiroaki.S

382
N
19 days ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
asked in Next Gen SWG
Crashes after Netskope Upgrade - Release 120

Anyone having issues and crashing on Windows NSClient after that was upgrade the Tenant and the Golden Release to the Lastest?We have a customer the MP is located on DE, the users are claiming a lot about crashes in Windows, to the point where it was necessary to force the equipment to be shut down or reset. We are wondering if the problem started after the Tenant Update was made, they were in the release 119 last week, and now they have migrated to 120.I realized that the agent from NSClients with setup to the Last Golden Release right now is the Lasted Release = 120, very interesting… 

1634
thiagofc
Netskope Partner
28 days ago
E
eranNew Member III
asked in Next Gen SWG
REST API V2 - /adem/

Hi,I’m trying to use /api/v2/adem/deviceoslist on the REST API v2.Before adding the specific permission for the endpoint - I’m getting "You cannot consume this service".After adding it, I’m getting "Unauthorized".Both times the error code is 403.How can I use this Endpoint?Thanks

310
E
28 days ago
B
barrycuda72New Member
asked in Next Gen SWG
3rd Party access

We have Netskope authenticating against EntraID using SCIM.  This works great for all our employees.  What I want to do is add some 3rd party contractors so they can access some internal resources.  They have a UPN of Contractor@acme.com but no email address.  Any suggestions?

180
B
29 days ago
M
Netskope Employee
mkoyfmanNetskope Employee
published in Next Gen SWG
Configuring CLI-based Tools and Development Frameworks to work with Netskope SSL Interception

If Netskope is deployed inline (for CASB or Web), some CLI tools will not work because they use certificate bundles distributed with those tools (i.e. Python distribution, for example), and they do not access system certificate store where Netskope client installs Netskope root CA. The guidance below will allow you to enable those tools to seamlessly work with Netskope SSL interception.In order for these tools to trust Netskope-signed certificates, they need to be configured to trust Netskope Certificate Authority (CA). This is typically accomplished by setting certain environment variables to point to Netskope CA to allow for smooth SSL operation.The variables need to be set to point to the following files that contain Netskope CA:On a Mac: /Library/Application Support/Netskope/STAgent/data/nscacert.pemOn Windows: %ProgramData%\Netskope\STAgent\data\nscacert.pemFor example to set REQUESTS_CA_BUNDLE variable on a Mac to point to the Netskope root CA, you can run this command:export REQ

28373
J
29 days ago
E
eranNew Member III
asked in Next Gen SWG
REST API V2 /adem/

Hi,I’m trying to use the /adem/ section of the REST API v2. For example - this endpoint:https://www.postman.com/netskope-tech-alliances/netskope-rest-api/request/bg2unes/get-a-list-of-usersBefore I add a specific permission to use this endpoint, I get a "You cannot consume this service" error message. After I add it, I get an "Unauthorized" error message. Both times the error code is 403.Does this endpoint require a support ticket to use?Thanks!

60
E
1 month ago
E
eldadNew Member III
asked in Next Gen SWG
How to create users group

Hi community,I'm wondering where I can create new users group to use when I create new client configuration. Thanks,

6569
N
1 month ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Next Gen SWG
Netskope - Azure AD - IDP Integration - Enroll & Reauth

Netskope - Azure AD - IDP Integration - Enroll & Reauth Private APPsHello community, hope all is well.I have a doubt with a certain point:In an environment was configured IDP mode against Azure-AD in an environment where users have office 365.1.- The agent installation is done in IDP mode and the IDP mode operates correctly, it enrolls the user, to the user based agent.Now the situation is as follows as it is very but very common and typical in office365/Azure-AD environments users already have their office 365 account logged in, either in your outlook client, in teams, onedrive on the web itself, then what happens when the installation process was performed in IDP mode and the enrollment occurs, this process was practically automatic since the user was already logged in to office 365/azure-ad as discussed above.I understand this is an issue of Office 365/Azure-AD and not of Netskope itself, now what was done to request the credentials, was to unblock the user from all access where

1104
N
1 month ago
M
munster
asked in Next Gen SWG
URL Shortened Coaching

HiI have RTP shortened url category with coaching.When user access the shortened url, a coaching page is shown and user required to click ACCEPT to proceed to actual webpage.By clicking ACCEPT, how can I corelated the actual url with shortened url?You can use https://tinyurl.com/4trp238r for testingThank

342
N
1 month ago
farhan
Netskope Partner
farhanNetskope Partner
asked in Next Gen SWG
Netskope client Citrix supported version

Hi team,Please let us know if the Netskope client is compatible on this citrix version or not.Citrix Virtual Apps and Desktops 7 2203 LTSR CU3 - Virtual delivery Agent.Citrix Workspace Environment Management Agent. 

531
ejang
Netskope Employee
1 month ago
K
KrugerNew Member
asked in Next Gen SWG
email Notifications on changes

Hello,Is there a way to get an email notification for configuration changes to the netskope tenant? ie: any inline policy update or creation etc..  Thanks!

471
N
1 month ago
prajakta.yadav
Netskope Partner
prajakta.yadavNetskope Partner
asked in Next Gen SWG
Cert-pinned application

Hello,Netskope added the cert-pinned applications under steering configuration exception by default.Can we get a list of these applications added by NS?

584
Rohit_Bhaskar
Netskope Employee
1 month ago
Swapnil Sonkar
Netskope Partner
Swapnil SonkarNetskope Partner
asked in Next Gen SWG
india ID Adhaar Block Failed By DLP

Hi i tried several time India ID prof Adhaar card image and the Adhaar number also is not getting  blocked in upload as well as in text message. i also tried by Regex thand also its not Blocking.Kindly please help on this?

211
ejang
Netskope Employee
1 month ago
N
nikunj.godawatNew Member
asked in Next Gen SWG
In what scenarios is a SWG steering bypass required?

In what scenarios is a steering bypass required and recommendation to avoid the steering bypass.

421
J
1 month ago
A
Anonymous
posted in Next Gen SWG
Netskope client supported versions of mac sonoma

Team,Can anyone help me with Netskope client supported version for MAC Sonoma.Is sonoma version 14.3 is supported version.

1873
deonnamireya
1 month ago
N
ndudaExplorer
asked in Next Gen SWG
Crowdstrike MacOS exclusions

Crowdstrike customers, how are you doing the exclusions for MacOS listed here, https://docs.netskope.com/en/netskope-help/netskope-client/netskope-client-interoperability/antivirus-applications/exceptions-for-anti-virus-applications/Specifically, I’d be curious to see what your exclusion patterns are. For paths with spaces (i.e. /Library/Application\ Support/) are you using “/Library/Application\ Support/” or “/Library/Application Support/”. Crowdstrike documentation states we shouldn't need the \ but does that work in practice?

3013
T
2 months ago
S
steff94New Member III
asked in Next Gen SWG
Disable outgoing XFF-Header to hide public ip of clients?

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

2061
Rohit_Bhaskar
Netskope Employee
2 months ago
S
Netskope Employee
sartioliNetskope Employee
asked in Next Gen SWG
Windows 365 or Azure Virtual Desktop and Netskope Client - Best Practices

In order to ensure the correct functioning of the Azure Virtual Desktop or Windows 365 machine when deploying the Netskope Agent on it we have to take care of some Steering Exceptions: MANDATORY: Destination Location Steering Exceptions for Azure Virtual Desktop RDGateways IPs (Remote Desktop Gateways service tags related IPs) OPTIONAL: Destination Location Steering Exceptions for Azure Virtual Desktop Monitoring IPs (Azure Monitor service tags related IPs) OPTIONAL: Application/Process (Certificate Pinned Application) Steering Exceptions for Azure Virtual Desktop agents running on the Virtual Desktop Destination Location Steering Exceptions Microsoft provides a Json file with all the Azure destinations at the address: https://www.microsoft.com/en-us/download/details.aspx?id=56519 Unfortunately though this list contains all the destinations used by the Azure infrastructure, divided by “Service Tags” (services). As we definitely don’t want to exclude all the Azure destination fr

20296
B
2 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings