Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 258 Topics
  • 619 Replies

258 Topics

F
fguerriniNew Member
posted in Next Gen SWG

Google Workspace managed configuration

Hi all, please to meet you! I'm configuring my Google Workspace to distribute the NS app to Android clients with a Managed Configuration to avoid that the users have to make manual configs.It works fine when, in the field "User Email Address" I insert a specific email but, if I leave blank or not configured the field, the app does'nt complete the config. Given that I need to distribute the same config to many devices, I would use a variable in this field, but I can't find the correct one. Is there anyone who has been in my situation and has resolved? Thank you

1
S
Netskope Employee
7 months ago
R
Netskope Employee
rossNetskope Employee
posted in Next Gen SWG

Sonos App on Windows or Mac needs Netskope Client steering exceptions to function

You're a big Sonos fan (like me), and you want to use the Sonos S1 Controller app, or the Sonos S2 app on your Windows or Mac machine with the Netskope Client. Well, you'll find it doesn't work without adding some Netskope Client steering exceptions... When you launch the Sonos app it uses broadcast addresses to seek out Sonos devices on the local network, it can use both 255.255.255.255 (network broadcast address) and also 239.255.255.250 (simple service discovery protocol - SSDP). So these addresses need to be added to a Network Location Profile: Netskope UI -> Policies -> Profiles: Network Location -> New Network Location -> Single Object (see attached screenshot) And you'll need to reference that 'Network Location' as an exception in your steering configuration(s): Netskope UI -> Settings -> Security Cloud Platform -> Traffic Steering: Steering Configuration -> [Your steering configuration] -> Exceptions -> New Exception -> Destination Locations -&g

0
R
Netskope Employee
7 months ago
B
bntrotterNew Member
posted in Next Gen SWG

PROPFIND (webdav) event traffic

Would it possible to have a user click-thru policy in regards to PROPFIND (webdav) event traffic?

0
B
7 months ago
W
wilsonExplorer III
posted in Next Gen SWG

Netskope Upgrade - Release 111 release effect on IPSEC Tunnels.

We are trying in a couple of channels to get an answer, including our Customer Support Manager and our Technical Account Manager.We are a little stressed over the lack of details in the below announcement.For our purposes, it lists three nights of maintenance, but it was unclear what nights, or all of them we should be worried about NYC and IAD where our IPSec tunnels are connected.Has anyone gone through this before? Have they switched their tunnels in preparation?  We are only concerned with the NYC and IAD pops where our IPSec tunnels are connected, and would like to know if there is more specific detail available regarding those POPs and the times they may be affected, and whether or not an advance failover for us is warranted.Thanks, Service ImpactThe Netskope user interface may be unavailable for brief periods of time during the maintenance window. Customers with IPSEC/GRE tunnels may notice a switch to a secondary/backup tunnel.NOTE: The release notes will be avai

1
S
Netskope Employee
7 months ago
M
mdmeow12123New Member III
asked in Next Gen SWG

Offline Agent Reporting

Is there a way to setup a report or alert to capture devices that have not reported traffic in x number of days?It turns out that after an audit, we have quite a few agents where Netskope is installed but not steering any data to the our tenant.  We believe that in these cases the agents subsystems are not fully functioning. The users are not allowed to disable the agents. Thank you. 

4
M
7 months ago
N
nadkickNew Member III
posted in Next Gen SWG

O365 Reverse proxy - how to exclude Windows365

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

2
N
7 months ago
J
JosepNew Member
posted in Next Gen SWG

incident_id value in api_v2

Hello, We are using REST API v2 to get alerts. However, the incident_id value has an error. The last 3 numbers are set to 0. Example,Our incident_id on the netskope dashboard: 5590961107392419317. The incident_id using API v2: 5590961107392419000 How can we avoid this?

1
pvilarino
Netskope Employee
7 months ago
S
steff94New Member III
asked in Next Gen SWG

DNS Policy - Only whitelisted FQDNs or Domain-Wildcards

Hello all,I wanted to ask if there is any way to configure Netskope to block all DNS revolving of public DNS namens by default?We want to manually specify a list of FQDNs or Domain-Wildcards to be allowed to resolve (ie. *.teams.microsoft.com or dns.msftncsi.com). We saw the option to Blackliste a FQDN or Domain-Wildcard in the DNS profile but there seems no option to block ALL except of ... Best regardsStefan

1
S
Netskope Employee
7 months ago
farhan
Netskope Partner
farhanNetskope Partner
asked in Next Gen SWG

Netskope Client in Disable state MAC Installation via Email invite.

Hi Team we are try to install the NS client on Macos 12.3 Macbookpro via email. (POC)We install package successfully but we  tenant and G/w is not display in Configuration of NS client.Lookup the gateway and URL resolution is successful. in Nsdebuglog I can see :   

3
A
7 months ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Next Gen SWG

Godaddy email synchronize mail - users / groups accounts

Godaddy email synchronize mail - users / groups accounts  Hello good afternoon community, thank you for your collaboration and your time.I have a couple of questions: 1.- I have out there some possible client prospect that has his email accounts in Godaddy, is it feasible to synchronize the Godaddy users/groups directory to have those users/groups in netskope for use in the policies. 2.- For the Godaddy mail as such both example the Web/Cloud access to the webmail, as well as the Godaddy mail configuration in example outlook client desktop. Netskope covers this point, this protection ? what is the scope ? I have not found more information regarding Goddady for any of the 2 points. Please support me with your comments, your collaboration and your advice. Thank you Best regards

1
MetgatzNK
Netskope Partner
8 months ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Next Gen SWG

A Multi-phased Approach to Securing Okta Using Netskope

Recently, Okta acknowledged a breach where attackers were able to gain access to customer session tokens, and other sensitive data through HAR captures in their customer support system.  Attackers were then able to use the unexpired session token to access the Administrative API in the customer’s Okta tenant. The Administrative API was accessed via the browser which only requires a session token or cookie unlike the typical approach using a bearer token.  In this case, the attackers were able to gain the initial access to the customer support system via an employee syncing a service account password to their personal Google password manager.    Netskope customers can address and help prevent such exploits through a multi-phased approach. Let’s take a look at the first phase.   Phase 1:  Controlling Personal Google Account Logins Netskope was initially built as a Cloud Access Security Broker (CASB) with an inline proxy capability.   This background pro

0
S
Netskope Employee
8 months ago
W
wilsonExplorer III
posted in Next Gen SWG

Device List duplicatetion- a warning that you data might not be accurate

He is what I understand: During the summer, Netskope implemented a change to address a problem when companies merge.   Apparently if two companies merged but two computers had the same hostname (?) they would have duplicate client ids.   I typically run a report of a month's worth of devices when we upgrade versions.  I run it daily to watch the increase, watch to see version change over time, and to find orphan machines that refused to upgrade their version. After the change, I immediately noticed about 2X the number of computers I have.  It turns out that in addition to changing the ID, they also changed the download options, where before it had dialog option to choose whether you wanted everyone that has logged into a machine or just the last person, now there is no option.  So now when downloading the list of machines, one to use Excel to deduplicate hostnames.  But it still isn't a good solution, as you don't necessarily get the right last reported date. So far Netskope's response

4
W
8 months ago
juergen
Netskope Employee
juergenNetskope Employee
posted in Next Gen SWG

How to enable “Periodic Validation on Device Classification” for NG-SWG

Summary With release R99 Netskope introduced a new feature “Periodic Validation on Device Classification” which is very important to enforce Zero Trust principles. Before that release, Device Classification of the client was only accomplished, when client service was started. With the new feature a validation interval can be configured for more frequent device posture checks. Requirements: NS Client version R99 or later is required. Please contact your Customer Success Manager, Netskope Support or your Account Team to get this feature enabled.  Today this feature is disabled by default!   Tenant Configuration Device Classification Profile The “Device Classification Profile” is a policy about a single or multiple checks, whether a device is compliant or not. This part of the configuration has not changed and will not be covered in detail in this post. Here is the link to public documentation. For testing on Windows a simple profile can be created to check if “notepad.exe” is

2
juergen
Netskope Employee
8 months ago
Jais100rbh
Netskope Partner
Jais100rbhNetskope Partner
posted in Next Gen SWG

Netskope Gateway Slection

Suppose we have two gateways i.e SWG and NPA gateways and both the tunnels are established between respective gateways and the client. How does Netskope client understand where the traffic should be routed?  

2
S
Netskope Employee
8 months ago
A
Anonymous
posted in Next Gen SWG

Android Studio Issues with MAC

Recently observed that Android Studio Issues on MAC devices even after exempted Android Studio from Netskope Proxy. Users using Android Studio are not able to connect to devices on wifi in the application. Is there is any issues with Android Studio with Netskope for MAC devices. 

0
A
8 months ago
K
Netskope Partner
kunalgandhiNetskope Partner
posted in Next Gen SWG

Control download activity for Github application

Hi, I am facing some issues  with Git-hub download activity controlChecking here if anyone have an experience who can put some light and help to find solution Our requirement for Git-hub realtime protection is :-User allow to view any files (any file type)User allow to click on “Raw” and view the details of that fileWhen user click on ‘Download”, this activity should get blocked. Issue :-When user click on ‘Raw”, it is showing activity Download in the Netskope logs and getting blocked. I have checked the logs for both the activities ( when click on Raw Data or  Click on Download ) showing as Download. Any way we can only block the actual download action ( not when users are clicking on Raw data). Thank you in advance.Regards,Kunal Gandhi

1
J
8 months ago
A
Netskope Partner
akashsaxenaNetskope Partner
posted in Next Gen SWG

Client deployment on MAC via sure MDM (42 gears)

How can I deploy clients on Mac devices using Sure MDM? I looked for documentation but didn’t find any.

1
S
Netskope Employee
8 months ago
T
TMRTNew Member
posted in Next Gen SWG

SMTP Proxy Tidbits (SPF and Proofpoint Tweak)

 If you are deploying Netskope SMTP Proxy few notes of interest. (Various screenshots of interest attached). 1. If your upstream has SPF check ensure to add following record to your DNS server  so that the SPF check does not fail _spf.goskope.com 2. To allow Netskope IP's refer to the following list 2.a If you are using Proofpoint as the upstream MTA there is a tweak to allow these IP's.Proofpoint does not accept CIDR ranges. Also adding in CIDR notation e.g. /24 did not help in my case.Use the following format (first 3 octets only) (screenshot attached) 163.116.1288.36.116 NOTE: for complete list of IP's subscribe to this article. There is a table for SMTP Proxy "Netskope Email DLP (SMTP) List for AllowlistingThe following list of IP ranges represents where SMTP traffic may egress from Netskope's NewEdge Security Cloud, and should be used for permitting traffic with upstream email providers. Netskope's recommendation is that customers' add all IP ranges when configuring allowlisting w

2
hhamza
Netskope Partner
8 months ago
E
eranNew Member III
asked in Next Gen SWG

REST API V2

Hi,I'm trying to use the REST API V2. All the documentation I find refers to two REST API options in the Settings -> Tools menu: REST API V1 and REST API V2.However, the Admin console shows (in Setting -> Tools) only one option: "REST API".Is this the REST API V2? If so, where is the Swagger API Documentation (https://docs.netskope.com/en/netskope-help/admin-console/rest-api/rest-api-v2-overview-312207/#swagger-api-documentation)?If not, then how can I create a Token for using REST API V2?Thanks!  

1
zthompsoncr
Netskope Partner
8 months ago
M
mdmeow12123New Member III
posted in Next Gen SWG

Mac OS Ethernet Dongles and Netskope

Hi Folks,We have a few users that have real difficulty with reestablishing connectivity via netskope when their macs come out of sleep/hibernate. The common thread between them is that they are also using dongles with ethernet connections to the internet. One fix that appears to help some users is turning off IPV6 ( changing to link-local) on any ethernet dongle that is attached. Curious if others are seeing this issue. Thanks!

9
R
8 months ago
O
originalsauceNew Member
posted in Next Gen SWG

IOS silent deploy of VPN profile - not working until netskope app opened

Hi all,we are looking to deploy Netskope IOS app to allow access to NPA internal Apps.I'vedeployed the netskpope root/inter certificatesDeployed netskope appnetskope app configurationVPN config profile (for per app vpn)scoped required internal app to use Netskope VPN. the per-app VPN apps selected do not have connectivity using VPN until i open the netskope app first. This is what happens when the netskope app is opened, after this app is opened everything starts working.  Can we make the IOS netskope deployment zero touch?    

0
O
9 months ago
A
Netskope Partner
adityasharma08Netskope Partner
asked in Next Gen SWG

FAIL CLOSE

Hello Everyone,can you please guide me in enabling fail close even when client is not installed and access method is IPsec/Gre. what configuration i need to do on firewall in o

1
S
Netskope Employee
9 months ago
W
wilsonExplorer III
posted in Next Gen SWG

Patient Zero policy Realtime Policy has anyone actually done this?

Netskope Advance Threat Protection does have a sandbox/research feature to investigate files that are downloaded with a sandbox examination, amongst other things.  Having an alert later on that a file is malicious gives a reason for follow-up on that person/computer. They also have a policy suggestion, where novel files are not downloadable until after they pass a sandbox exception.  The devil is in the details "The Netskope advanced threat engines can take up to 10 minutes to analyze the file."  Also, in practice, if you the download just fails for 10 minutes of clicking on it, no pop-up warning you that it is in review. So I am dying to know - has anyone actually done this policy? I am also fascinated by the policy example, where the policy is applied to downloads of Adult Content and Adult Content - Porn.  The net effect would be "As a company it is OK to go to a porn site and download from it, but you have to wait 10 minutes while we check out the

1
S
Netskope Employee
9 months ago
S
StewartNew Member
posted in Next Gen SWG

Netskope Client and Arch Linux

Hi Folks,I have an Arch Linux device which we would like to get behind Netskope. The OS on this device can't be changed and while I am thinking we could take a few different options I thought I would have a crack at convincing the Netskope Client to work.It installs and enrols just fine, however, once running there seems to be an issue between the client and the stAgentSvc. The `nsclient` command will report unable to connect to service. Diving a little deeper with `strace` and I can see a connection reviews to the UNIX socket `~/.netskope/stagent/apps`, which would indicate the stAgentSvc is not in a good state.I have not been able to identify where or what might be the cause of stAgentSvc not working - despite a fair chunk of reviewing debug logs and strace output. Has anyone come across this problem on a Linux device before and resolved it?Thanks in advance for any help.

0
S
9 months ago
A
Anonymous
posted in Next Gen SWG

Bandwidth utilization goes high over netskope tunnel

DC and DR internet links have been choked as there is a heavy utilization over netskope. we raise a ticket over TAC but no resolution found as per my knowledge user client traffic is acting as DPOP traffic where in we are not able to trace out this abnorml

1
S
Netskope Employee
9 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings