Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 278 Topics
  • 659 Replies
278 Topics
shubhamk
Netskope Partner
shubhamkNetskope Partner
asked in Next Gen SWG
Browser extensions

Dear Team, Could we manage browser extensions (including installation and execution) using NGSWG? Best Regards,Shubham

5212
N
8 months ago
M
munster
asked in Next Gen SWG
How to BLOCK non-tenant M365

Hi User can only access corporate M365 tenant. To prevent data leakage,  we will like to block M365 non-tenant access such onedrive, sharepoint, email, etc?  How can I do config it? thankMunster

8723
ejang
Netskope Employee
8 months ago
M
munster
asked in Next Gen SWG
Uncategory Domains

Hi There are predefined list such as abortion, etc.  How can I block domain that has NOT been category yet? thankMunster

3934
N
8 months ago
V
viniciuslehmannNew Member
asked in Next Gen SWG
Netskope not working with nginx docker

I'm having trouble accessing Nginx locally, which is running with Docker and Netskope client enabled.I need to use the Nginx Docker image for development on some machines; however, when the Netskope client is enabled, I can't access the web server via http://127.0.0.1:8080. When I disable the client, access works fine. Has anyone experienced a similar issue?

7483
J
8 months ago
M
mbradfordNew Member
asked in Next Gen SWG
All microsoft delivery optimization - regex....

We block the download of certain files, such as msi, and exe.  Microsoft delivery optimization uses random IPs within the URL to download these updates, and some IPs might not even be owned by Microsoft.  Below is an example of a download: 151.139.71.28/filestreamingservice/files/814b848b-a4e4-48f7-9dc0-b18b57f6c9f3?P1=1707275479&P2=404&P3=2&P4=XS3dTPEuizRfF1O1rjyxG4xt4%2f7vGGgU0h4OKnajgEDC0tollwGtN5fmEf1kuPFohFTDKuVPTCg9zrAoEck6sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.comWe would like to include a regex or some sort of wild card to allow these.  The URL always seems to include: delivery.mp.microsoft.com When we allow URLs, we add the URLs to a URL list, which is tied to category.  I see we can use regex, but I am not certain if the URL needs the hostname???  I am also not sure how the regex would look.  I opened a case with support, but they referenced me to regex101 website, but that was really it, so hoping the Netskope community might be able t

8312
N
8 months ago
monika
Netskope Partner
monikaNetskope Partner
asked in Next Gen SWG
URL white listing

Can we allow only specific URL and block every other web application in browser using NG SWG solution??If yes, how do we set a policy??

1971
qyost
8 months ago
B
bhennrelNew Member III
asked in Next Gen SWG
Why are we blocking DNS over HTTPS again?

I understand the underlying premise for Netskope's recommendation for blocking DNS over HTTPS, to mitigate exfiltration risk, etc. However, with the industry push to move to DOH, won't we need to allow DOH traffic at some point? Most of our users browsers are configured to try DOH first, and some of them seem to be running into issues if DOH is not available and falling back to traditional udp 53 fails. I also don't understand why Netskope says they don't support DOH traffic steering. (See https://docs.netskope.com/en/netskope-help/data-security/real-time-protection/best-practices-for-real-time-protection-policies/best-practices-for-utility-policies/#recommended-utility-policy-2-1) It would seem Netskope DOES support it since we ARE steering DOH traffic to Netskope, Netskope identifies the DOH traffic, and then blocks it with the Block DOH real time protection policy. So what does Netskope mean when they say "DNS over HTTPS is not a supported protocol for Netskope steering (C

20784
jforrest
Netskope Employee
9 months ago
A
Anonymous
asked in Next Gen SWG
Netskope DLP user coaching for sensitive data move to Whatsapp, Telegram Desktop Apps

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You

3522
Y
9 months ago
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Blocking Microsoft Co-Pilot

This content can be found on the Netskope Support portal https://support.netskope.com/s/article/Blocking-Microsoft-Co-Pilot

2821
matt-frank
Netskope Partner
9 months ago
M
munster
posted in Next Gen SWG
Block All Executable Files From Download and Upload

Hi  I have created a rule to block download and upload executable with ===========Category : 138 categoriesActivities: Upload, DownloadActivity Constraint: Filetype = Binary and Executable=========but can't seem to get it working. Any advise ?

7156
qyost
9 months ago
H
hobyNew Member
asked in Next Gen SWG
Netskope SWG and Onenote

While we have the normal exceptions in place for MS 365 and the likes, we seem to have users including myself that can't get Microsoft Onenote to sync unless we disable the endpoint client. Has anyone seen this or have an idea on how to solve? Thanks! 

1895
qyost
9 months ago
K
klcantrellNew Member
posted in Next Gen SWG
How do I access KB articles in the support portal?

I'm unable to get to the KB article at this this link. Do I need a special Support Portal login? My community login isn't working there, and I do not see a way to create a support portal login. I'm trying to solve the same issue that this community member ran into, and getting to the KB article seems to be the key.

911
zthompsoncr
Netskope Partner
9 months ago
M
munster
posted in Next Gen SWG
Checking Media Type

HiWhere can I configure to check media type header, eg application/winword? Thank

471
ejang
Netskope Employee
9 months ago
A
AlanNew Member
posted in Next Gen SWG
Uninstalling netskope

How to uninstall netskope via command line that has a password ?

14591
ejang
Netskope Employee
9 months ago
C
cswordNew Member III
posted in Next Gen SWG
AWS CLI SSL Certificate Errors on macOS

Has anyone had issues resolving AWS CLI certificate errors when the Netskope Client is enabled? Multiple developers in our org have followed the steps in https://docs.netskope.com/en/netskope-help/traffic-steering/netskope-client/addressing-ssl-error-while-accessing-aws-services-via-the-aws-cli-with-the-netskope-client-enabled/ for AWS CLI V2 and have even tried the older configure_tools.sh file that configures Netskope certs for common tools including AWS CLI. We have not had success in getting this to work. 

7483
K
9 months ago
W
wilsonExplorer III
posted in Next Gen SWG
IPSEC SSL Decryption vs. IPSEC non SSL decryption policy report

Does anyone know a way to write a report and see whether a particular IP address in IPSEC tunnel to Netskope (non Netskope client computers).   Failing that, is there a way to dump what IP addresses are in the Network Locations per Network Location? We have nonclient machines converted over to IPSEC content management via Netskope.  We are taking a asset/application group at a time and applying a SSL Decryption policy using Network locations  in order to weed out applications that don't like to be decrypted.   Ideally, I would like to write an Advanced Analytics report that shows whether a set of IP address are are are not part of an SSL Decryption policy and/or Network Location Group.  I would settle for a dump of what IP addresses are in each of my Network locations.  

500
W
10 months ago
B
bdowdNew Member
posted in Next Gen SWG
Uninstsall Netskope via script Mac

I am trying to uninstall Netskope using a script via Kandji. I was able to find the script set up to uninstall with jamf. Is there any script that will work with Kandji or how can I modify the jamf script to make it work?

1431
S
Netskope Employee
10 months ago
M
munster
posted in Next Gen SWG
Managed Access by User-Agent

Hi  Can SWG manage web access by "User-Agent" header? Thank

1092
M
10 months ago
S
SivaExplorer III
posted in Next Gen SWG
Citrix XenApp / vApps

Hi There,  What is the recommended deployment method for Citrix XenApp / vApps where multiple users log onto the same server concurrently. (Multiple users sharing same IP)

2668
S
10 months ago
F
fguerriniNew Member
posted in Next Gen SWG
Google Workspace managed configuration

Hi all, please to meet you! I'm configuring my Google Workspace to distribute the NS app to Android clients with a Managed Configuration to avoid that the users have to make manual configs.It works fine when, in the field "User Email Address" I insert a specific email but, if I leave blank or not configured the field, the app does'nt complete the config. Given that I need to distribute the same config to many devices, I would use a variable in this field, but I can't find the correct one. Is there anyone who has been in my situation and has resolved? Thank you

891
S
Netskope Employee
10 months ago
R
Netskope Employee
rossNetskope Employee
posted in Next Gen SWG
Sonos App on Windows or Mac needs Netskope Client steering exceptions to function

You're a big Sonos fan (like me), and you want to use the Sonos S1 Controller app, or the Sonos S2 app on your Windows or Mac machine with the Netskope Client. Well, you'll find it doesn't work without adding some Netskope Client steering exceptions... When you launch the Sonos app it uses broadcast addresses to seek out Sonos devices on the local network, it can use both 255.255.255.255 (network broadcast address) and also 239.255.255.250 (simple service discovery protocol - SSDP). So these addresses need to be added to a Network Location Profile: Netskope UI -> Policies -> Profiles: Network Location -> New Network Location -> Single Object (see attached screenshot) And you'll need to reference that 'Network Location' as an exception in your steering configuration(s): Netskope UI -> Settings -> Security Cloud Platform -> Traffic Steering: Steering Configuration -> [Your steering configuration] -> Exceptions -> New Exception -> Destination Locations -&g

1190
R
Netskope Employee
10 months ago
B
bntrotterNew Member
posted in Next Gen SWG
PROPFIND (webdav) event traffic

Would it possible to have a user click-thru policy in regards to PROPFIND (webdav) event traffic?

220
B
10 months ago
W
wilsonExplorer III
posted in Next Gen SWG
Netskope Upgrade - Release 111 release effect on IPSEC Tunnels.

We are trying in a couple of channels to get an answer, including our Customer Support Manager and our Technical Account Manager.We are a little stressed over the lack of details in the below announcement.For our purposes, it lists three nights of maintenance, but it was unclear what nights, or all of them we should be worried about NYC and IAD where our IPSec tunnels are connected.Has anyone gone through this before? Have they switched their tunnels in preparation?  We are only concerned with the NYC and IAD pops where our IPSec tunnels are connected, and would like to know if there is more specific detail available regarding those POPs and the times they may be affected, and whether or not an advance failover for us is warranted.Thanks, Service ImpactThe Netskope user interface may be unavailable for brief periods of time during the maintenance window. Customers with IPSEC/GRE tunnels may notice a switch to a secondary/backup tunnel.NOTE: The release notes will be avai

901
S
Netskope Employee
10 months ago
M
mdmeow12123New Member III
asked in Next Gen SWG
Offline Agent Reporting

Is there a way to setup a report or alert to capture devices that have not reported traffic in x number of days?It turns out that after an audit, we have quite a few agents where Netskope is installed but not steering any data to the our tenant.  We believe that in these cases the agents subsystems are not fully functioning. The users are not allowed to disable the agents. Thank you. 

1154
M
10 months ago
N
nadkickNew Member III
posted in Next Gen SWG
O365 Reverse proxy - how to exclude Windows365

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

1622
N
10 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings