Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 285 Topics
  • 668 Replies
285 Topics
D
DanielVdNew Member
asked in Next Gen SWG
Can netskope work without the cloud part?

Good morning,in order to understand how to administratively place the purchase of Netskope I am being asked to understand if Netskope can in any way function if the Netskope Client is unable to contact the gateway in the cloud or if, as I imagine it is, all traffic goes through the firewall.

811
zthompsoncr
Netskope Partner
8 months ago
P
patrickmendosaNew Member
posted in Next Gen SWG
Issues with Facetime

Re: Support Case00347414 I am having issues with Facetime when Netskope is enabled. I am steering "All Traffic" I have created a certificate pinned app for the facetime process and bypassed * all domains from steering config.  Whether this cert pinned app is enabled, or not - the issue persists. I have ALLOW-ALL rules set for cloud apps, all web traffic, and cloud firewall. I also have numerous Apple domains set to Do Not Decrypt in SSL Decryption policy.  Looking for assistance from others who may have encountered this in there deployment.  @sshiflett any ideas? NS Debug Logs with Cert Pinned App disabled: 2023/11/20 11:36:43.519144 stAgentNE p2668 t18363 info tunnel.cpp:873 nsTunnel DTLS [sessId 120352348] Tunneling flow from addr: 1.0.0.1:51979, process: facetime to host: gateway.icloud.com, addr: 17.248.193.19:443 to nsProxy 2023/11/20 11:36:43.652241 stAgentNE p2668 t9523 error nsClientFlow.mm:200 nsClientFLow Find UDP flow id

3023
P
9 months ago
jonathanpereira-claro
jonathanpereira-claroNew Member
asked in Next Gen SWG
Filter google workspace traffic based on tenant ID or similar

Hi guys! Just a quick question since a requirement from senior management just arrived:Is it possible to filter (allow / deny) web traffic to google workspace services based on domain or tenant id?The idea is to allow only some tenants or domains to access google workspace resources (and denying all personal services) via SWG configuration. Best regards to all!

941
ejang
Netskope Employee
9 months ago
T
Netskope Partner
tamNetskope Partner
posted in Next Gen SWG
stAgentSvc NSCOM2 bind error

Can anyone help me in understanding the below error logs and what could be the issue here.Thank you in advance! User's Netskope client is in disabled state. 2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error NSCom2.cpp:863 NSCOM2 bind failed on sever socket 100132023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:2147 nsAgentSvc Token not found in the client name2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:1225 nsAgentSvc Failed to get session details on NSCom error

6514
N
9 months ago
M
munster
posted in Next Gen SWG
Log All Activities

Hi What is your best practice?  Do you block ALL and allow as require? Or Allow ALL and block as require?How do I log all web access activity whether is blocked or allowed?  Eg, do a google search, go to new site, upload file to storage etc.  Do I need to write policy to do it? ThankMunster

1531
S
Netskope Employee
9 months ago
M
Netskope Employee
MM_NSNetskope Employee
posted in Next Gen SWG
How to view actual identifiers of a DLP policy violation on Netskope tenant

In order to view actual policy violating identifiers such as SSN, Credit Card numbers, First / Last Names you must create a Forensic Profile on a supported repository such as Azure Blob, Sharepoint https://docs.netskope.com/en/netskope-help/data-security/forensics/

912
M
Netskope Employee
9 months ago
M
munster
posted in Next Gen SWG
SSL Host Error Bypass

Hi I have issue uploading file to a storage site that has "Host Name Mismatch" error. Further troubleshooting, it was related to "Security Cloud Platform-> Traffic Steering-> Steering Configuration-> MANAGE ERROR SETTINGS-> SSL Host Mismatch" which was set to "BLOCK".  Hence, a) Where can I find the 'SSL Host Mismatch" error in Skope-IT?b) How can I exclude this storage site from the above 'SSL Host Mismatch" Block setting?  Thank

13274
N
Netskope Employee
9 months ago
R
Rakoon007New Member
asked in Next Gen SWG
Administration - Audit Logs: Not able to view comments/notes in the Audit log module

Hi,Not sure if there's already a similar question posted somewhere, In the Administration > Audit Log section:When clicking on the gear, the options to select are "User, Severity, Activity" .  There is no option to show comments/notes entered for a specific activity logged. Is there a way to add another column in the Audit Log that can show the comments that were entered when adding/modifying a policy/persona/rule?  It seems odd that while add/changing/modify/removing a rule/policy, you're prompted to add (which is optional) a comment/note before saving/applying a change to an activity performed but never can locate or view the comments in the Audit log.Are the comments details located in another section of Netskope? Are they retrievable?  if yes, will the notes/comments still be linked to the very activity event that was performed at the time when the comments were entered? orIf not, could this be a consideration as an additional enhancement in the next release/upgrade/patch to the

1266
R
9 months ago
M
munster
asked in Next Gen SWG
How to BLOCK non-tenant M365

Hi User can only access corporate M365 tenant. To prevent data leakage,  we will like to block M365 non-tenant access such onedrive, sharepoint, email, etc?  How can I do config it? thankMunster

9233
ejang
Netskope Employee
9 months ago
M
munster
asked in Next Gen SWG
Uncategory Domains

Hi There are predefined list such as abortion, etc.  How can I block domain that has NOT been category yet? thankMunster

4114
N
9 months ago
V
viniciuslehmannNew Member
asked in Next Gen SWG
Netskope not working with nginx docker

I'm having trouble accessing Nginx locally, which is running with Docker and Netskope client enabled.I need to use the Nginx Docker image for development on some machines; however, when the Netskope client is enabled, I can't access the web server via http://127.0.0.1:8080. When I disable the client, access works fine. Has anyone experienced a similar issue?

8023
J
9 months ago
M
mbradfordNew Member
asked in Next Gen SWG
All microsoft delivery optimization - regex....

We block the download of certain files, such as msi, and exe.  Microsoft delivery optimization uses random IPs within the URL to download these updates, and some IPs might not even be owned by Microsoft.  Below is an example of a download: 151.139.71.28/filestreamingservice/files/814b848b-a4e4-48f7-9dc0-b18b57f6c9f3?P1=1707275479&P2=404&P3=2&P4=XS3dTPEuizRfF1O1rjyxG4xt4%2f7vGGgU0h4OKnajgEDC0tollwGtN5fmEf1kuPFohFTDKuVPTCg9zrAoEck6sQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.comWe would like to include a regex or some sort of wild card to allow these.  The URL always seems to include: delivery.mp.microsoft.com When we allow URLs, we add the URLs to a URL list, which is tied to category.  I see we can use regex, but I am not certain if the URL needs the hostname???  I am also not sure how the regex would look.  I opened a case with support, but they referenced me to regex101 website, but that was really it, so hoping the Netskope community might be able t

8812
N
9 months ago
monika
Netskope Partner
monikaNetskope Partner
asked in Next Gen SWG
URL white listing

Can we allow only specific URL and block every other web application in browser using NG SWG solution??If yes, how do we set a policy??

2021
qyost
9 months ago
B
bhennrelNew Member III
asked in Next Gen SWG
Why are we blocking DNS over HTTPS again?

I understand the underlying premise for Netskope's recommendation for blocking DNS over HTTPS, to mitigate exfiltration risk, etc. However, with the industry push to move to DOH, won't we need to allow DOH traffic at some point? Most of our users browsers are configured to try DOH first, and some of them seem to be running into issues if DOH is not available and falling back to traditional udp 53 fails. I also don't understand why Netskope says they don't support DOH traffic steering. (See https://docs.netskope.com/en/netskope-help/data-security/real-time-protection/best-practices-for-real-time-protection-policies/best-practices-for-utility-policies/#recommended-utility-policy-2-1) It would seem Netskope DOES support it since we ARE steering DOH traffic to Netskope, Netskope identifies the DOH traffic, and then blocks it with the Block DOH real time protection policy. So what does Netskope mean when they say "DNS over HTTPS is not a supported protocol for Netskope steering (C

22244
jforrest
Netskope Employee
9 months ago
A
Anonymous
asked in Next Gen SWG
Netskope DLP user coaching for sensitive data move to Whatsapp, Telegram Desktop Apps

Dear All Does Netskope’s SSE solution can coach if sensitive data gets moved into Whatsapp, Telegram, desktop apps? If yes, from where I can define the (Whatsapp/Telegram) desktop application to be use on the real-time policies? Thank You

3602
Y
9 months ago
jforrest
Netskope Employee
jforrestNetskope Employee
posted in Next Gen SWG
Blocking Microsoft Co-Pilot

This content can be found on the Netskope Support portal https://support.netskope.com/s/article/Blocking-Microsoft-Co-Pilot

2921
matt-frank
Netskope Partner
9 months ago
M
munster
posted in Next Gen SWG
Block All Executable Files From Download and Upload

Hi  I have created a rule to block download and upload executable with ===========Category : 138 categoriesActivities: Upload, DownloadActivity Constraint: Filetype = Binary and Executable=========but can't seem to get it working. Any advise ?

7666
qyost
10 months ago
H
hobyNew Member
asked in Next Gen SWG
Netskope SWG and Onenote

While we have the normal exceptions in place for MS 365 and the likes, we seem to have users including myself that can't get Microsoft Onenote to sync unless we disable the endpoint client. Has anyone seen this or have an idea on how to solve? Thanks! 

1975
qyost
10 months ago
K
klcantrellNew Member
posted in Next Gen SWG
How do I access KB articles in the support portal?

I'm unable to get to the KB article at this this link. Do I need a special Support Portal login? My community login isn't working there, and I do not see a way to create a support portal login. I'm trying to solve the same issue that this community member ran into, and getting to the KB article seems to be the key.

911
zthompsoncr
Netskope Partner
10 months ago
M
munster
posted in Next Gen SWG
Checking Media Type

HiWhere can I configure to check media type header, eg application/winword? Thank

471
ejang
Netskope Employee
10 months ago
A
AlanNew Member
posted in Next Gen SWG
Uninstalling netskope

How to uninstall netskope via command line that has a password ?

15961
ejang
Netskope Employee
10 months ago
C
cswordNew Member III
posted in Next Gen SWG
AWS CLI SSL Certificate Errors on macOS

Has anyone had issues resolving AWS CLI certificate errors when the Netskope Client is enabled? Multiple developers in our org have followed the steps in https://docs.netskope.com/en/netskope-help/traffic-steering/netskope-client/addressing-ssl-error-while-accessing-aws-services-via-the-aws-cli-with-the-netskope-client-enabled/ for AWS CLI V2 and have even tried the older configure_tools.sh file that configures Netskope certs for common tools including AWS CLI. We have not had success in getting this to work. 

7773
K
10 months ago
W
wilsonExplorer III
posted in Next Gen SWG
IPSEC SSL Decryption vs. IPSEC non SSL decryption policy report

Does anyone know a way to write a report and see whether a particular IP address in IPSEC tunnel to Netskope (non Netskope client computers).   Failing that, is there a way to dump what IP addresses are in the Network Locations per Network Location? We have nonclient machines converted over to IPSEC content management via Netskope.  We are taking a asset/application group at a time and applying a SSL Decryption policy using Network locations  in order to weed out applications that don't like to be decrypted.   Ideally, I would like to write an Advanced Analytics report that shows whether a set of IP address are are are not part of an SSL Decryption policy and/or Network Location Group.  I would settle for a dump of what IP addresses are in each of my Network locations.  

500
W
10 months ago
B
bdowdNew Member
posted in Next Gen SWG
Uninstsall Netskope via script Mac

I am trying to uninstall Netskope using a script via Kandji. I was able to find the script set up to uninstall with jamf. Is there any script that will work with Kandji or how can I modify the jamf script to make it work?

1481
S
Netskope Employee
10 months ago
M
munster
posted in Next Gen SWG
Managed Access by User-Agent

Hi  Can SWG manage web access by "User-Agent" header? Thank

1192
M
10 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings