Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 302 Topics
  • 718 Replies
302 Topics
AllenWu
Netskope Partner
AllenWuNetskope Partner
posted in Next Gen SWG
Can enpoint's local admin be restricted from internet access through AAD integration?

Hello,Does anyone know if Netskope can enforce employees to log in AAD account on their managed endpoints to access internet?If employees don't log in their AD account and use local admin to access internet, can Netskope block their access?I haven't found any related discussion or KB on this. Appreciate if someone has already tried or know the configurations.

460
AllenWu
Netskope Partner
S
SirRobertNew Member
posted in Next Gen SWG
Netskope Agent disabled/Fail Close when AD account is locked out

Hello All,   I was wondering if it is normal for Netskope to go into disabled and then into Fail close if the user account in AD gets locked out.  I don't see anything in our agent arguments that would imply it is installed with fail close.  As well, I have the fail close option unchecked on our client configuration.  The only thing I have read is that I have a password set for tamper proofing, which is a prerequisite for fail close.    Has anyone come across this situation before?

4840
AllenWu
Netskope Partner
farhan
Netskope Partner
farhanNetskope Partner
posted in Next Gen SWG
Netskope Policy migration

Hi team,We migrating policies from Zscaler to Netskope NGSWG with file type url filtering  and cloud apps control. As the categorization is totally different can you please help me out with this migration of policy I need to know the category fall in Zscaler which is fall in Netskope or any docs from your end will help thank you.

1280
qyost
C
ChrisParrNew Member III
posted in Next Gen SWG
How is usage vs. licensing calculated?

How is license consumption worked out for the SWG product? We're currently just syncing groups from Azure AD that contain users based on their office location and the total number of members in those groups is just under what we're licensed for, but want to ensure that we aren't missing anyone. If we sync a catch all group from Azure AD that contains about 3 times as many accounts as we have Netskope licenses what happens to our license consumption? Do we consume licenses equal to the total number of AD accounts that are synced, total number of enabled AD accounts, total Netskope clients seen over a time period, max concurrent connected clients, or something else?

14450
Indu
Netskope Partner
J
jjsarpiNew Member
posted in Next Gen SWG
Problem many disconnections NETSKOPE client on CHROMEBOOK/CHROME OS

Good afternoon,Many of our users on Chromebook/Chrome OS (differents constructors and differents "versions" like "Nami", "Zork", "Octopuss", "Hatch"...) experiment frequent disconnections since earlier version (actual latest version for ChromeOS via Playstore is 107.1.0.1529, published on 2023/08/23), tunnel going up/down in logs, this is very embarrasing for our users. Fixes have been deployed until the latest stable version mentioned above, but the disconnections are persistent, and seems more frequent when users are in homeworking. Does anyone encounters the same kind of issue, please ?Thank you if you can help me. I precise Netskope official support have already been contacted and is aware of this problem.Best regards. 

1200
J
S
SivaExplorer III
posted in Next Gen SWG
Unenroll from command-line

Hello, we have disabled unenroll from client UI through client config. But in some instance need this operation  [eg: IT accidentally enrolled while troubleshooting under user's windows session]. Wondering if this can be done from CLI or manually deleting user level files. 

1710
S
M
mdmeow12123New Member III
posted in Next Gen SWG
Unable to Update Clients

The Netskope clients have not been able to update configuration since September 1st for my tenant.  Netskope said its a known issue. Is there a reason why https://trust.netskope.com/ does not reflect this yet? Thank you. 

11360
S
Netskope Employee
S
SivaExplorer III
asked in Next Gen SWG
URL List being processed in case sensitive mode

Hello,  We configured a URL list to allow certain github repositories and noticing netskope is processing the list in case sensitive mode. Is this the default behavior? Can we have it process in case insensitive mode?  eg: github.com/Azure vs github.com/azure

1290
S
R
rbrussell82New Member
posted in Next Gen SWG
safevisit.online Security Risk - What is it?

We started seeing safevisit.online in our reports within the last week or 2 that this site is being blocked as a security risk.  I've looked online but I haven't found any resources explaining what this site is or why its showing up.  If its a tracker, I'm guessing users are visiting a site that has it embedded.  The domain is less than a year old.

1660
S
Netskope Employee
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
Control Youtube traffic based on channels

Hello Netskope community,    Customers adopt different approaches on how they manage access to Youtube, where some have a more relaxed policy and some are more strict. For customers that need more granular controls over the video giant, controlling based on channel is one of the possible solutions.    Netskope's Instance Awareness feature extracts the channel name every time you visit a page or video so if you browse to the Netskope YouTube channel and check SkopeIT you will see something like this:  (notice the instance ID field populated with "netskope" and that will be true to any other channel on YouTube)    In order to setup a Real Time policy to either blocks a channel or simply allow it, depending on your strategy, create a new instance from SkopeIT by expanding one if these Application events and clicking on "Create New Instance" and just giving it a name.    After that, go to Real Time policies and setup a policy using this newly c

9380
frosa
Netskope Employee
W
wilsonExplorer III
posted in Next Gen SWG
Client version in Advanced Analytics?

Just want someone else to confirm my observation:  While what POP a client software is connecting to is available, what version of the client being used is not.   I was trying to replicate the DEM dashboard, right now I have to download devices into a spreadsheet and then chart it.

1100
qyost
W
wilsonExplorer III
posted in Next Gen SWG
Request for Community Support: NPLAN-112: Apply steering configs based on priority in multi user ma

I am writing to ask that the Community contact their Netskope representative and and indicate your interest the Request to Enhancement that has been stalled:  "NPLAN-112: Apply steering configs based on priority in multi user machines. " You might not have noticed this, but if you have multiple users on one machine, Netskope may not be providing them with the correct steering config.  This is most noticeable when you are in the midst of CASB to SWG, but can occur otherwise too.  In a multi-user deployment mode, if the logged in users belongs to different OUs or user groups, the Netskope Client applies the steering configuration corresponding to the user most recently logged. Ensure all the users belong to a single OU or User Group for a multi-user machine.  https://docs.netskope.com/en/steering-configuration.html#UUID-eae29f38-85d9-fd13-74c9-077e1ef74513_section-idm4585568446828833492110209816 Here is a way to interpret this:   When the client has been installed in multi-user (peruserc

1050
S
C
ccreedNew Member
posted in Next Gen SWG
Windows Linux Subsystem

Has anyone heard how Netskope plans to deal with Windows Linux Subsystems on the Windows 10 and 11 devices. We have several users where I work that are asking question around this.  

10540
P
Deepak_InfoTru
Netskope Partner
Deepak_InfoTruNetskope Partner
posted in Next Gen SWG
Netskope Client Installation on Windows Server 2016

Hi there, One of my client doesn`t want to go other way of steering traffic from Windows Server 2016 to Netskope Cloud so he wanted to use Netskope Client to steer the traffic from the Windows Server 2016. We tried to install, client stays disabled and when checked logs it says the below.Initially we thought it would UPN and EMAIL ID are not matching, but we created separate the account with the same UPN and EMAIL ID, but client still fails to download config branding file and stays disabled. What you suggest next we should do? 2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:6234 Config Branding file downloaded failed for user: Removed the user ID2023/08/09 16:49:23.584 stAgentSvc pcb0 t17b4 error config.cpp:4571 Config Failed to download branding file using UPN2023/08/09 16:49:13.570 stAgentSvc pcb0 t17b4 error config.cpp:8173 Config failed to download UPN hashing config2023/08/09 16:49:13.570 stAgentSvc pcb0 t17b4 info config.cpp:5960 Config UPN encoded for u

6260
S
Netskope Employee
frosa
Netskope Employee
frosaNetskope Employee
posted in Next Gen SWG
Netskope Controlled Domains for URL Category Testing

Hello NS community!   Currently Netskope URL categorization product has 127 categories. Some categories are meant for legitimate traffic such as Financial News, Business, Educations, and some categories are security risk related such as, Security Risk - Botnets, Security Risk - Phishing/Fraud. There are also categories that may not be allowed for work environment such as Gambling, Tobacco or Adult contents. Each customer can create their own policies to allow or block each URL category. In order to test these policies, customer needs to know the URL samples in each category and then performs the test.   Attached you can see an example of these "hardcoded" categories for all our categories so you can test your policy in real-time. Be cautious as clicking in these URLs will generate logs for the Netskope user accessing them so make sure administrators know these tests are being performed.      Update (8/14/23): Updated attachment with latest "Generative AI" categ

6888
frosa
Netskope Employee
shubhamk
Netskope Partner
shubhamkNetskope Partner
posted in Next Gen SWG
Internet Not working on a particular system (working for rest of the systems)

Dear Team, We noticed that the internet is in working condition for every other user, however, it is showing an error of the internet not working on a that particular system.After analysis, we found the below logs, we need your assistance to understand the cause. fileUtil.cpp:45 nsUtils failed to open file for reading: C:ProgramData etskopestagent/eventcache.json, err:2t40a4 info fileUtil.cpp:82 nsUtils failed to open file for reading: C:UsersAppDataRoamingNetskopeSTAgent/data/authtoken.pem, err: 2t2afc error registry.cpp:158 registry RegOpenKeyEx failed, err: 2 Best Regards.

4880
S
Netskope Employee
S
Netskope Employee
sshiflettNetskope Employee
asked in Next Gen SWG
Netskope Next-Gen Secure Web Gateway Controls for ChatGPT

IntroductionChatGPT and other AI chatbots have been getting a lot of attention lately.  They are extremely helpful in getting information, responding to custom queries, and can even be used to write code along with other common daily tasks.  They represent an exciting new digital frontier but from a security perspective, they also represent yet another place for your corporate data to go.  Netskope’s inline Next-gen Secure Web Gateway capabilities can block posting of sensitive data to collaboration tools such as Slack and Teams out of the box.  It got me to thinking that since ChatGPT is essentially a chat system, why can’t we use a similar capability to block posting sensitive information to ChatGPT?  As one quick tangent, I also want to give OpenAI some credit as they also warn the user that it’s not appropriate to put personal data into their platform:   That being said, this is as after I already posted the data and relies on ChatGPT recognizing the

11960
cchessor
Netskope Employee
A
adamssonNew Member III
asked in Next Gen SWG
Whitelist IPs

We’re having an issue with our web server blocking Netskope IPs. Where can I find a list of IPs that I can whitelist?

16670
A
BGT_AKH
Netskope Partner
BGT_AKHNetskope Partner
posted in Next Gen SWG
In need of addressing Google AMP Evasive Phishing Tactic

Hello All,The following articles have come out re: Evasive Phishing that domain front-ends Google to protect potentially malicious or unintended traffic from being picked up by filtering or threat. The following articles address how this works:https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/https://www.malwarebytes.com/blog/news/2023/08/phishing-campaigns-found-to-be-using-amp-urls-to-avoid-detection This means if NGSWG can't categorize the URL is hiding in AMP then it will treat the site as categorized as safe (or likely safe) based on that it is hosted at google, not the real site of xxx.xxx (or whatever malicious site and path is included there). Examples:https://www.google.com/amp/s/xxxxx.xxxx/somesite.html or https://www.google.co.uk/amp/s/xxxx.xxx/badimage.img From a position of making sure this product is competitive in the market, there are some other vendor tools that can granularly expose this hidden URL and site an

995
BGT_AKH
Netskope Partner
S
sattariNew Member
posted in Next Gen SWG
notion.so

We are looking to start using a knowledge sharing platform called notion.so. Does anyone have experience with setting up DLP on this platform?  I'm curious if I can just use the same web policies there.

1670
M
Netskope Employee
W
wilsonExplorer III
posted in Next Gen SWG
Question for academic organizations or anyone that uses SWG forwarding

I have a number- of applications where a corporate IP address allows access without authentication.  For the first 15 or so, we have been 100% successful in using the Forwarder back to corporate and then sending the traffic from here.  However, the most recent set, library resources works some days and don't work on other days.   Has anyone seen this behavior?  

370
W
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Next Gen SWG
Provisioning Users from AWS accounts (Customer manages AWS - business mail service )

Provisioning Users from AWS accounts (Customer manages AWS Amazon WorkMail, for their mail accounts - business mail service). Hello good afternoon, how are you doing? As always, thanks for your cooperation and support as always. I have a question, a customer X, has a mail service on AWS, no Azure AD, no local AD, no google apps. So he only has for his mail accounts AWS - Mail Account - Enterprise Service. Is Netskope compatible, for the moment I have not seen any document, do you know if it is compatible Netskope, to provision fianles users, users to Tenant, by SCIM, LDAP or IDP, against AWS, in order to provision users and groups ? Does anyone have any information, data or details regarding this scope of Netskope ? Thanks, I remain attentive Best regards

490
M
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
posted in Next Gen SWG
Cloud exchange

the way to see the Cloud exchange console is which? Should I open from any browser with the IP where the connector is located or do I have to do it on the client's server where the connector was installed?

570
S
Netskope Employee
R
Netskope Employee
ryansNetskope Employee
posted in Next Gen SWG
[HOW-TO] - Silently Deploy the Netskope Client for MacOS Using Workspace ONE

VMWare's Workspace ONE platform enables IT teams to manage any app on any device by integrating access control, application management, and unified endpoint management. In this guide you will learn how to perform a completely silent installation of the Netskope Client for supported MacOS versions.   High-Level Process From a high-level, the process is as follows: Configure Device Profile to deploy Pre-requisites Configure Workspace ONE Sensor to push pre-install file Push Netskope Client   Before you start, make sure to have Access to a Netskope tenant. Access to a Workspace ONE tenant with Intelligent Hub licensing. A MacOS device running MacOS 11.x or newer that has completed enrollment with Workspace ONE and has the target user's e-mail populated accurately. Downloaded the attached .zip file and extracted the script attached to this post. Downloaded the desired NSClient.pkg file from the Netskope Support Portal (login required).   Now... onto the deploym

15970
R
Netskope Employee
M
marticanyellesNew Member III
asked in Next Gen SWG
Best practice for tagging webpages with Sanctioned

Hello, I am implementing a new proposal for Real Time Policies for Netskope, to follow best practices and reduce the number of polices to the minimum possible. Currently, I propose a structure similar to this (+ other specific policies of allow, block, dlp, threat protection etc..):Allow corporate App InstancesAllow "Sanctioned" AppsBlock not allowed CategoriesAllow allowed Categories But there are webpages that belong to a non-permitted category, but to which access must be allowed. The problem is they are webpages and not applications, I can't apply the "Sanctioned" tag. If I create a custom app with the URL of the webpage, it also does not allow adding the "Sanctioned" tag. What is the best practice recommendation to resolve the situation? I can only think of creating a new policy that is allow access to a custom URL List, but it doesn't seem like a maintainable option over time, if the URL list grows too much. Thank you so much!

2040
aramachandran
Netskope Employee

Badge winners

Show all badges
Terms & ConditionsCookie settings