Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 313 Topics
  • 761 Replies
313 Topics
M
Netskope Partner
MuditNetskope Partner
posted in Next Gen SWG
Netskope SSO with Onelogin

Configuration Document for Netskope Tenant SSO with One Login

350
M
Netskope Partner
J
jamesbanNew Member III
posted in Next Gen SWG
Forward proxy authentication with SSL bypass

I am trying to understand how the forward proxy handles user authentication/identification when SSL is set to bypass when there is no agent running on the endpoint. 

1122
zthompson
Netskope Employee
B
Netskope Partner
bradkingNetskope Partner
posted in Next Gen SWG
URL List for Testing

Does Netskope have a list of web site URLs that have been defined for testing policies?

8452
F
Netskope Employee
D
DbrattrbiNew Member
posted in Next Gen SWG
Block page for SSL Decrypt Bypass traffic

I am interested to know how other customers are able to present a block page when a user is browsing from a network segment that has an SSL Decrypt Bypass policy applied.  Currently, users are shown a generic "this site can't be reached" message versus our branded block page.  Netskope Support stated the branded block page (custom User Notification) cannot be displayed since Netskope is not intercepting the traffic due to the SSL Decrypt bypass policy.  Is anybody else experiencing the same issue?

5202
JulieB
edwin_alvarez
Netskope Partner
edwin_alvarezNetskope Partner
asked in Next Gen SWG
APP Google Gmail activity delete

when configuring a CASB  real time policy for the Google Gmail app, is it possible to configure email deletion activity? or how to achieve this

572
bob
Netskope Employee
H
hyunboNew Member
asked in Next Gen SWG
Traffic Steer on Galaxy S8

Hello folks, I'm having difficulties to use traffic steering on my Galaxy S8. Hopefully, I want to know what caused this and if it is what it is, way to configure my Galaxy S8/Android device to use VPN like iOS would be nice.   I've sent invitation to my email account on Security Cloud Platform -> Netskope Client -> Users. Then clicking Android Client link on the mail led me to Google Play Store link. Then Google Play Store Netskope Cloud Directory page appears and I tab install button. Then open. Then Netskope Client says "Client is waiting for configuration". Then nothing. No further progress. In Settings, Organization, Gateway, Gateway IP Address, Steering Configuration, Device Classification are blank.   My other Galaxy Note 10 appears to working fine.   both devices gets link like https://play.google.com/store/apps/details?id=com.netskope.netskopeclient&referrer=utm_source%3Daddon-viccns.goskope.com%26utm_medium%3D7345%26utm_term%3dsfsdfsdE6zBjE5gj2Ib6%26u

2967
H
S
scolemanNew Member III
posted in Next Gen SWG
Allow access to a site that is in multiple categories and one of them is blocked.

In this example, we want to block Streaming and Downloadable Video, and need to: Remove that category from the default steering exceptions to ensure it is steered to the Netskope cloud. Identify which URLs you want to block and which you want to bypass. For mediacompanyabc.com most if not all the actual streaming content is hosted on mediacompanyabc.com/videos, so for our example we are going to create a custom category with an exclusion to accommodate our use case. using mediacompanyabc.com/videos as the exclusion to a custom News and Media category. Create a custom URL list and call it “Streaming and Downloadable Video UL” (UL is for URL List) and add mediacompanyabc.com/videos to it. Create a custom category and call it “News and Media CC” (the CC is for Custom Category) and include the News and Media category and exclude the Streaming and Downloadable Video UL. Create your policies with an allow for News and Media preceding a block for Streaming and Downloadable

6251
J
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
[Getting Started] Best Practice Policies - Inline

Please reference the updated Inline Learning path sections for this content Below is the course order by depth of contentNG-SWG: Introduction and Concepts - Getting StartedBest Practice Policy Strategy - Adoption/Maturing PoliciesBest Practice Use Cases - Specific Use Case Review

9880
jforrest
Netskope Employee
A
Anonymous
asked in Next Gen SWG
Allow automatically VPN Popup via Intune

Hello Community, I have deploy the MacOS agent via Intune, but at the client configuration, the user need to accept to add a Proxy configuration. (like file attached.) I know it's possible to bypass that for Jamf by following this configuration : https://docs.netskope.com/en/deploy-netskope-client-with-jamf.html Anyone of you is in the same situation ? do you have resolve it ?  Thanks for your feedbacks.

1764
M
Netskope Employee
B
bridgeNew Member III
asked in Next Gen SWG
NetSkope SWG and Windows 10 updates failing in Asia

Hi all, wondered if anyone rolling out SWG has had any issues with getting Windows updates to install with SWG enabled in Asia.   I have the same Windows steering bypasses set up for EU users and Asia but for some reason India and HK  users are getting a fail to update on the windows update page unless i disable the netskope client.   My exceptions are below.  I've covered everything MS say i need except go.microsoft.com and its not needed for EU users and just directs to the micosoft buy our devices  page.  Any ideas ?      *.download.windowsupdate.com*.update.microsoft.com*.windowsupdate.com*.windowsupdate.microsoft.comdl.delivery.mp.microsoft.comdownload.microsoft.comntservicepack.microsoft.comr.manage.microsoft.comwindowsupdate.microsoft.comwustat.windows.com

3562
B
C
ccreedNew Member
asked in Next Gen SWG
User Custom Block Pages

Does anyone out there know if you can embed a link into the custom block page messages a user receives?

3404
M
rcanzanese
rcanzaneseNew Member III
posted in Next Gen SWG
Did you know Google Drive and Microsoft OneDrive are the top two sources of malware Downloads?

In our latest Cloud and Threat Report, we breakdown the most significant trends we saw in 2021: Google Drive emerges as the top app for malware downloads Emotet copycats continue to abuse Microsoft Office documents More than half of managed cloud app instances are targeted by credential attacks Rate at which users leave their jobs (and take data with them when they do) doubles   One of the major highlights was the while OneDrive was the top app for malware downloads in 2020, Google Drive took the top spot in 2021, with OneDrive coming in second place.               And then, in our December Threat Labs Report, you will find a detailed view of last month’s threat activity, which shows that even tho Google Drive was at the top for most of the year, it has already begun to fall, being replaced yet again by Microsoft OneDrive.     What is going on here? Well, OneDrive and Google Drive are incredibly popular, so attackers try to abuse th

370
rcanzanese
Zulkifal
ZulkifalExplorer III
posted in Next Gen SWG
Disable/Enable Netskope client from admin console instantly

Environment: Netskope client installed with client configuration "Allow disabling of Clients" disabled Requirement: Need to Disable/Enable Netskope client from admin console instantly.   Hi Folks,   We might have faced an event where we have to enabledisable Netskope client from the admin console, But it takes more than 2-3 minutes to get it reflected on the Client. Sometimes it takes more than 5 minutes to get it reflected on the end-user machine which really makes the troubleshooting duration extended.   Resolution:   1) EnableDisable Netskope client from Security Cloud Platform > Netskope Client > Devices 2) Add some dump changes on Client steering configuration (Security Cloud Platform > Traffic Steering > Steering Configuration)3) Revert the steering configuration changes back.4) Click OK.5) Update the Netskope client configuration. Now Client will be enableddisabled instantly.   eg: Check the attached screenshot. Here I have edited "s" fr

78850
Zulkifal
A
Anonymous
asked in Next Gen SWG
Real-time Protection - Referrer Policy

For some reason I felt that in a recently Netskope release I saw something about a referrer policy.   We have run into issues in our organization with some websites functioning properly as we silently block the "Online Ads" URL category. Often times, a URL may be classified as Online Ads, but may be necessary for the website to function. We have often just created a real-time protection policy to permit the URLs in a URL list and applied this to the appropriate users. I thought I saw something about using a referrer policy in a recent release that if you permitted the main page, any subsequent URLs that were loaded were also permitted. Almost like a parent-child relationship with processes. I may be dreaming, but I could not find anything in the recent release notes or documentation.   If this does not exist, does this functionality exist if Netskope does not have a defined Cloud App that would permit the associated URLs? Would the only action be to create the URL lists as we

5721
jforrest
Netskope Employee
K
Netskope Partner
kameniNetskope Partner
posted in Next Gen SWG
How can I set up Netskope for Android?

Hello community,   Is there anyone who tested Netskope for Android? (Next-Gen SWG, CASB or NPA)  Any idea on how to set it up or any recommendations for articles/KBs ? Thank you!

1271
C
I
infoNew Member
posted in Next Gen SWG
Exporting and importing information

Have placed this under SWG but it applies generally to the GoSkope interface.   Is there a way to export and import data from the various sections into CSV or another format? Or maybe there is some CLI or API?   For example the policies, or traffic steering exceptions, or any of the other sets of data. This will make it easier to collaborate and edit information en masse. At the moment we update each item individually and are stuck with web interface for presenting data.

1072
I
M
Netskope Employee
MM_NSNetskope Employee
posted in Next Gen SWG
Disabling Admin Console Single Sign-on?

Netskope Admin Console can be tied with your Identity Provider (IDP) such as Okta or Azure. It's just a few checkboxes that you would normally enable on Netskope tenant to allow users on IDP to login to Netskope using admin-role attribute for the Role Based Access Control. There are just a few checkboxes and strings you add to the Netskope tenant. Most configuration is done on the IDP. Okta and Azure have an app published for this purposed called "Netskope Admin Console".  Once SSO is enabled users assigned to this app can login by going to your Netskope tenant URL (SP initiated flow) or by going to the IDP and launching Netskope app from there (called IDP initiated flow). While turning this off you would normally uncheck the "Enable SSO" checkbox on Netskope tenant. Just wanted to make you aware that this will turn off the SP initiated flow i.e. Netskope will not redirect you to the IDP. But the users on the IDP may still be able to launch the app and login using IDP initiated flow. T

1090
M
Netskope Employee
H
hexaryNew Member
posted in Next Gen SWG
CID 1172 DisableIPSourceRouting

Hello, I'm looking at deploying a Microsoft group policy for CID 1172  which is : Status of the 'MSS -  (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)' setting. If I'm using a proxy to split http traffic over a SDWAN will this GPO impact my users or the proxy attempting to re-route client traffic? 

540
H
M
Netskope Employee
MM_NSNetskope Employee
posted in Next Gen SWG
How do I create policies with custom URL lists?

Netskope URL Lookup Tool is a handy tool when it comes to creating Netskope web policies or submit mis-categorization requests to Netskope team. https://www.netskope.com/url-lookup This tool is accessible when Netskope client is enabled. From within tenant policies dashboard the tool also gives you other details of significant importance such as which policies or steering exceptions or custom categories the url applies to. Here is a recommend sequence of configuration tasks when creating a custom URL list. 1. Verify if the URL is part of an existing Netskope category, policy or steering using URL Lookup tab2. Create a URL list by going to URL Lists tab3. From custom categories tab attach the custom list to a new or existing custom category as "include" or "exclude" list.4. Apply the category to a Real-time protection policy

2690
M
Netskope Employee
S
Netskope Employee
sshiflettNetskope Employee
posted in Next Gen SWG
Block TeamViewer Using NGSWG

Netskope’s Secure Web Gateway supports HTTP/S traffic on any port.  While Netskope’s Cloud Firewall can control any port and protocol, Secure Web Gateway customers may have use cases to block certain high risk apps that use non-HTTP/S ports and protocols.  For example, TeamViewer uses port 5398 for communication but fails over to port 443 if port 5398 is unavailable.  By default, the Netskope Web Gateway drops non-HTTP/S traffic so administrators can block TeamViewer in its entirety by following the instructions below:   Navigate to Settings > Security Cloud Platform > Steering Configuration. Select the steering config you wish to apply this to.  Click EDIT in the top right corner.  Click the NON-STANDARD PORTS tab. Check the box next to Steer non-standard ports. Create entries and teamviewer.com and *.teamviewer.com with port 5938. Click SAVE. Change to the EXCEPTIONS tab.  Add or edit the TeamViewer Certificate Pinned Application and set the

6490
S
Netskope Employee
mferguson
mfergusonNew Member
posted in Next Gen SWG
Can we block or alert on specific text in Search Engines?

I'd like to look for suicidal thoughts in Search Engines to help me better help students at risk. Is there a way to do this?

240
mferguson
K
kaustavbasuNew Member III
posted in Next Gen SWG
Netskope Web Security for Linux, CentOS, Ubuntu

We have been using Netskope for 3 years now and the journey started off with the CASB product. Since beginning of this year we started using the SWG product as well and honestly it has helped us to reduce the web security risks.   Our environment has mostly Windows and Mac OS endpoints with around 100 devices running on Linux, CentOS or Ubuntu. With the current coverage from Netskope we are not able to ensure similar level of security for these devices.   Is there any plan for extending support for these platforms (Linux, CentOS, Ubuntu, etc.) going forward?

5847
M
Netskope Employee
J
jspmscNew Member
asked in Next Gen SWG
Internal Web Application not accessible from Web proxy(SWG)

Hi,   We have internal web based applications and which is accessible only from allowed ip's. We have whitelisted entire Netskope ip range and still we are not able to access the web application. Is there any option?

893
J
pvilarino
Netskope Employee
pvilarinoNetskope Employee
posted in Next Gen SWG
How to tell which sites a certificate pinned application is trying to get

Certificate pinned applications by definition are not susceptible to ssl interception and without ssl interception we are blind to what is going on. Unfortunately most native applications, those that are running as an executable, are certificate pinned. If you try to intercept ssl traffic from these applications you will break the application. As a result you are forced to bypass traffic from these applications. the problem then arises as to which sites is the application trying to get too. Idealy you just ask the developer, but sometimes this is not an option so as an alternative you can run this simple script to identify the sites that we see the process trying to access  for example in Windows using Powershell: get-content c:userspublic etskope sdebuglog.log -tail 5 -wait | Select-String "slack.exe"   this basically will parse the nsdebuglog.log and pull out whatever matches the process, in this case slack.exe     Once you've identified the sites you can then pl

2470
pvilarino
Netskope Employee
R
rfletcherNew Member III
asked in Next Gen SWG
Steering Configuration - Tunnel Mode

Since the upgrade to version 85, I started to notice it doesn't look as if cert pinned application exceptions recognize or apply tunnel exclusions any more. I'm opening a case with Support but I wanted to reach out here to see if anyone else experienced anything similar first. There is a exception for python.exe and if i use the tunnel settings it'll bypass any connections made to those domains but attempt to intercept everything else.    For Example:Python.exe > Tunnel Mode: pypi.org and Pythonhosted.org 

3675
jforrest
Netskope Employee

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings