Next Gen SWG

Hi, all I’m Hiroaki Shimizu, SE of Macncia.I would like to confirm and gather whether there is a demand for the following functions or not.If there is a large demand, we will request it to Netskope.If you agree, please click the Like button.1.What my customer would like to achieveCustomer would like to communicate without SAML authentication for some destinations such as application update communication from a terminal such as a Windows server where the user is not always logged in. 2.Location of the functionSetting -> Security cloud platform ->SAML -> SettingIf the terminal IP is excluded from SAML authentication, the user is not authenticated by that terminal and is recognized as an IP address. 3.Current functionWhen bypassing with "SAML-Forward Proxy",・DOMAIN BYPASS and WEB CATEGORY BYPASS apply to all users・SOURCE/EGRESS IP ADDRESS BYPASS excludes all destinations from the specified IP4.Desired function・The condition of specific IP and specific destination could be set in

Verbally, Netskope indicates that installation of client on servers because the client is dependent on login for policy. I am looking for that documented.   Has anyone seen that?  

HiIs there anyway to block python from access internet to download packages?Whether from VSC or cmdline, etc? thank 

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

Is there a way to dump out the Network Locations and which IP address are contained in each?

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

Good afternoon, thank you for your time and good vibes.I have the following situation:We know that by default at Global level, Netskope, is blocking sites with self signed certificates.In certain cases there are sites we say "known" somewhat controlled, where there are VPN access portals, sites or systems with self-signed certificates, etc..Now the idea is not to apply it globally, but by means of exceptions, so as not to allow all sites with self-signed certificates, but only some based on need and demand.Then I tried to apply a web policy, with action Bypass and it did not work, it still shows the blocking of sites with self signed certificate, as I did not intend to allow it globally, I added a policy, of SSL decrypt, to not make decrypt to a custom web category, that contains these sites, to omit or bypass the blocking. Well this worked, but with this I feel that we lose visibility and inspection to these sites, therefore, please clarify what is the position, recommendation, proced

Hello enthusiasts, I have been configuring the device classification rule for iOS devices with criteria “REQUIRE PASSCODE” only. Although I have removed the passwords in test device (iPad) the Netskope found to be unable to detect the device as “unmanaged” hence the Realtime policy I configured against the “unmanaged devices” did not work as expected. I would request all the folks who have expertise in this matter to help me with your valuable guidance to troubleshoot and fix this. Meanwhile I am testing all the possible scenarios to fix this. Regards,Saifin Thomas

Some context related to user regulation, we found that once users are imported, we can not delete them on the console.We would like to control that only certain users can use Netskope service but integrated idp will have all employee information including ex-employees, so they can still using Netskope SSE and we can only manually set blocking policy to stop their access.In this case, we haven’t come out a way to grant only rightful users to enable Netskope clients, and stop/remove Netskope clients from their byod.Does anyone have any suggestion on this?How can we develop a better user regulation mechanism to enable correct amount of licensed user?Thanks a lot.

Can anyone help me in understanding the below error logs and what could be the issue here.Thank you in advance! User's Netskope client is in disabled state. 2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error NSCom2.cpp:863 NSCOM2 bind failed on sever socket 100132023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:2147 nsAgentSvc Token not found in the client name2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:1225 nsAgentSvc Failed to get session details on NSCom error

Hello Skope community!I hope everyone is doing well.I would like to tell you that I have related IDP configuration with AzureAD for the install via IDP, using reverse proxy for NPA access over Web-browser, among other experiences with Netskope in labs, POC, production environments, among others.Now I have to configure Reverse Proxy for the following environment.-Control access to office 365 suite (Sharepoint, Onedrive, Outlook, etc.)- IDP Azure-AD / Entra ID.Environment with users with Netskope agent, with steering profiles forwarding all office 365 (SSL Exception Pining Apps O365) to Netskope.Environment with users with Netskope agent, with steering profiles with bypass of office 365.What is sought with the use of Reverse Proxy, control access, upload, download, authentication, etc. to Office 365, of unmanaged computers.I have already been in the process of analyzing and reviewing Links to document and be able to read, analyze and acquire information for the configuration.https://docs

when I modify a policy or configuration change it takes a long time to apply the changes and I have to force the client to apply them (deactivating and activating) does anyone know another way to apply them automatically?   attached client screenshot after adding an exception in Security Cloud Platform > Traffic Steering

HiI have a RTP with Source=User.  I input  user email aaa@xxx.com which was from AD via SCIM.When the aaa@xxx.com resigned, will the email be auto remove from the RTP? thank

HalloWhen adding a new Web Access rtp policy the presence of User Alert action depends on the Categories added in the destination.It sems that not all predefined Categories permits User Alert and so User Coaching popups.For example MIscellaneous allows User Alert , but Sports doesn’t.Is there a way or a doc to know in advance which Categories allow User Alert and which not ?best regards 

How can we check which category and URL list a specific URL belongs to?Rest API provides a useful method to extract this information. How to use Rest API:-Go to Settings/Tools/Rest API v2  Select API DocumentationEnsure there is a token which has:- /api/v2/nsiq/urllookupSearch or scroll down to /api/v2/nsiq/urllookupClick to try out the API Edit the text to select the URLs  you want to check for category and URL list Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your API token, and any brackets, or commas in the requested body above. The response will show the categories (pre-defined & Custom) and URL lists To verify the categories are correct, check the tenant UI If you need to modify the URL lists, check out:-https://community.netskope.com/real-time-protection-key-policies-72/how-to-automate-url-list-updates-via-api-7167 

Hi Guys,I was trying to figuring out on Windows Updates or Windows Store failing to check for updates or downloading apps. While i was moving around to check on SkopeIT logs for some clue to it and i could not see anything that shows any failure or etc may i know does SkopeIT do shows any signs of failing SSL inspection or any sort? Because the last resort that i did was to do a bypass on Windows Update’s URL then everything started to work and update can continue, i do see logs only reflecting that it is passing through properly but anything that failed before i applied the bypass is not reflected. Thanks in advance~

Hi,I'm working on implementing Netskope, and I need assistance with configuring an exception for Tailscale VPN. Since Tailscale operates differently from traditional VPNs, I’m facing challenges in setting it up as an exception. Has anyone successfully added Tailscale VPN as an exception in Netskope tenant?

Hi,I’m trying to use /api/v2/adem/deviceoslist on the REST API v2.Before adding the specific permission for the endpoint - I’m getting "You cannot consume this service".After adding it, I’m getting "Unauthorized".Both times the error code is 403.How can I use this Endpoint?Thanks

If you have PAC files or WPAD deployed to user base here are recommended settings:   1. Following traffic needs to go via PAC addon-<TENANT-NAME>.goskope.com     2. Following traffic needs to go DIRECT gateway-<TENANT-NAME>.goskope.com gateway-backup-<TENANT-NAME>.goskope.com dns.google     3. Do not use Netskope consolidated IP ranges in the PAC file. If you add global range the "addon" traffic will also fall under that range.     Sample PAC file:   Here is a typical PAC file syntax. Check what's the ultimate "return" statement. The address "163.116.128.80:8080"  in this PAC file is the Netskope Explicit Proxy over Tunnel IP address.    { <snip> .. .. /* Don't proxy to access to Netskope URLs for clients     */       if (shExpMatch(host, 'gateway-<TENANT_NAME>.goskope.com'))          { return 'DIRECT'; } (repeat for