Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 292 Topics
  • 695 Replies
292 Topics
L
LockdownNew Member
asked in Next Gen SWG
Secure Web Gateway (SWG) Slow Download Speeds

We recently enabled SWG, and file transfer download speeds are extremely slow. Is anyone else having this issue? We enabled DTLS as recommended by Netskope, but that did not fix the problem.

4320
L
1 year ago
C
ChrisParrNew Member III
posted in Next Gen SWG
Steering Bypass for sites using cloud load balancers/traffic managers not working

We have some sites we need to bypass so that the traffic comes from our own IP address ranges. When those sites are behind AWS Elastic Load Balancers or Azure Frontdoor we're suffering frequent steering failures. E.g.User tires to access OurSite.Example.com from our office LANOurSite.Example.com is a CNAME record that resolves to ELB-Frontdoor-Unique-ID.CloudService.com, ELB-Frontdoor-Unique-ID.CloudService.com itself resolves to a generic ELB-Frontdoor.CloudService.com address, and ultimately ends up with one or more IP addresses.OurSite.Example.com is in our bypass list.Hosting systems that provide OurSite.Example.com have filters/firewall rules configured to prevent access to the site unless the source IPs are ones assocaited with our office LAN.Client logs show OurSite.Example.com is bypassed.When it works that's all that shows in the logs.When it fails the logs then show that the traffic to ELB-Frontdoor-Unique-ID.Cloud.com is getting tunnelled and going via the Net

2020
S
Netskope Employee
1 year ago
N
ndudaExplorer
posted in Next Gen SWG
UBA for Bulk Upload

How are other customers tuning the UBA Bulk Upload (and Download)? These 2 policeis seem to be the noisiest and have the most "false positives". There is no way that I can tell to have an exception for specific apps. For example, the Brave sync applications. This local app is constantly uploading small data about its browser (for sync purposes). I would love to exempt that from the Bulk Upload UBA policy.

1320
S
Netskope Employee
1 year ago
Jais100rbh
Netskope Partner
Jais100rbhNetskope Partner
posted in Next Gen SWG
Netskope Client installation process

Just want to know how the Netskope certificates get installed on the system automatically by any backend mechanism and how the system knows that the installed certificates in from Netskope. This would be very helpful for me to know the backend mechanism.  

3740
Jais100rbh
Netskope Partner
1 year ago
NicolaScand
Netskope Partner
NicolaScandNetskope Partner
posted in Next Gen SWG
Problem with NS client for Android after shutdown

Hi Team, I have a problem with the android client:if I turn off the phone and turn it back on the NS client does not activate automatically but it is necessary to click on the application to start the VPN profile. Is it expected behavior? Thanks,Nicola

700
B
Netskope Employee
1 year ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Next Gen SWG
Installation on cell phones of Netskope client ( IOS and Android )

Installation on cell phones of Netskope client ( IOS and Android ) Hello community, good afternoon: A question, can you support me with the following points please, thank you for your time. Android --For the installation of the Netskope client, on Android phones is completely transparent ? that is to say you install the application, you accept that the VPN profile is generated and everything is transparent for the blocking of websites on the cell phone is executed ? or you must manually install a certificate ? if you have to install it from where you download ? or should be completely transparent to complete the installation process and is ready for use, once connected ? IOS--For the installation of the Netskope client, in IOS cell phones it is totally transparent ? that is to say you install the application, you accept that the VPN profile is generated and everything is transparent so that the blocking of cell phone websites is executed ? or you must manually insta

2840
B
Netskope Employee
1 year ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Next Gen SWG
Netskope Client iOS and Android Apps

Netskope Client iOS and Android Apps  Hello community, how is everything going ? As always, thanks for the collaboration and good vibes.I have some issues with a couple of apps. 1.-Whatsapp App:Whatsapp App from IOS and Android, I performed the installation of the client, profile, etc all good all operating correctly for both IOS and Android. By Netskope Whatsapp is not an app qualified as certificate pinning at least not by default or suggested to add.The issue arises in the case of sending images, chats and messages, links all OK in both cases IOS and Android, the problem arises with sending files and images, when you try does not allow it. There is no blocking or impediment at the level of policies, permissive policies are generated to the APP and URLs, but the issue remained the same. Reviewing the domains in the CCI I noticed the domains whatsapp.com and whatsapp.net. When generating an exception at Steering level for the domain whatsapp.com the issue remained total

6130
B
Netskope Employee
1 year ago
R
Netskope Employee
ryansNetskope Employee
posted in Next Gen SWG
[HOW-TO] - Configure Tenant SSO with PingOne

Ping Identity’s PingOne platform provides the ability to define a SAML-compatible application that can be used for granting access to the Netskope Admin Console. This guide will walk you through the steps for creating a custom application to meet this use case.   Ping does not provide a pre-built application for SAML SSO - a custom application is required Ping One does not support SCIM for User and Group provisioning - you will need Ping Federate with the SCIM SaaS Provisioner integration.   Instructions Follow the below steps to create the custom SAML integration. The high-level process is to a) define a custom attribute that will contain the Netskope Admin Role; b) create the custom SAML application; and c) configure the Netskope tenant for SSO with Ping One. Login to the Ping console Click on your target Environment     Expand Identities and click on Attributes Click the Plus sign to add a new attribute Choose Declared as the Attribute Type and click Nex

1900
R
Netskope Employee
1 year ago
B
btokuyoshiExplorer III
posted in Next Gen SWG
New Intro to Cloud Firewall Video

Netskope Next Gen SWG helps organizations take back control over user->cloud activity that firewalls either miss or can't understand.  Cloud Firewall complements Next Gen SWG to address the non-web apps. Check out our new video to explain what a Cloud Firewall does, and let me know if you have any questions   https://community.netskope.com/t5/Video-Library/Introduction-to-Netskope-Cloud-Firewall/ba-p/4829  

920
B
1 year ago
K
kalikinkarNew Member
posted in Next Gen SWG
netskope 102 is not getting uninstalled.

netskope 102 is not getting uninstalled from the machine nor with the cleaner.

570
Rohit_Bhaskar
Netskope Employee
1 year ago
D
deepakkNew Member III
asked in Next Gen SWG
How Netskope is categorizing the URL's?

Just to check how Netskope is categorizing the URL's Malicious? just want to understand backend Technology and the process around it. Are you using any third-party Intelligence  or own AI/ML technologies.

1130
msouza
Netskope Employee
1 year ago
M
mpochanNew Member III
posted in Next Gen SWG
Google Docs Latency and Loading Issues

Has anybody else observed latency and loading issues with Google Docs for Mac/Chrome users who are accessing them via the Netskope Client via the SWG? We're seeing sporadic behavior where documents shared with users will take 3-7 minutes to load, comments will fail to post, and sometimes pages just age out. This is not isolated to a specific region or POP, but disabling the Netskope client immediately resolves the issue.  It's become enough of a problem that we are considering putting in an ssl decryption or steering exception for Google Docs. This behavior will manifest for several hours, go away, and then reappear. Just curious if anyone else has seen it and/or has any suggestions on any potential fixes. 

1610
aramachandran
Netskope Employee
1 year ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Next Gen SWG
Multi-user in non-AD environments - Users in Google and Okta

Multi-user in non-AD environments - Users in Google and Okta Hello, good afternoon, I hope all is well. I have the following question. In an environment where you have users with Okta and others from Gmail, for user accounts, how would you do in environments where you do not have Active Directory for multi-user workstations ? I mean example: We have approx 30 workstations shared, by 3 or 4 people, where different people login to that workstation in different work shifts, with different local account on those workstations.So these machines use local accounts but I need to differentiate the access privileges of each of those 4 people/accounts to different access level for Netskope policies. How do I use multi-user or Multi-User Mode in this kind of environment? Is it possible to do it IDP-like with Okta accounts as with Google Workspace accounts ? Thank you for your time and your collaboration Best regards

4140
S
Netskope Employee
1 year ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Next Gen SWG
Synchronize users from Google Apps/Workspace and Okta for user/group provisioning and Admin Console

Synchronize users from Google Apps/Workspace and Okta for user/group provisioning and Admin Console SSO Hello good afternoon, thank you for your support, for your collaboration and for your valuable time.Is it possible to synchronize users/groups from Google Apps/Workspace accounts ? in order to provision user/groups for policy management ? Can I synchronize users from Okta and users from Google Apps/Workspace at the same time?Is it possible to use SSO for the use of Google Apps/Workspace user credentials for the Tenant Admin Console? Thanks for your time, good vibes and your collaboration. I remain attentive Best regards

3890
S
Netskope Employee
1 year ago
aramachandran
Netskope Employee
aramachandranNetskope Employee
posted in Next Gen SWG
Vulnerabilities in Browsers ? Yup! Advanced Analytics and NG-SWG policies to the rescue !

Browsers with Zero-Day Vulnerabilities ? What am I talking about you might think -   Well, it happened with Chrome recently -  for the third time this year - CVE-2023-3079  released earlier this month affects Google Chrome prior to 114.0.5735.110 by allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)    Sounds serious? Oh you bet - a CVSS Base Score: 8.8 HIGH is not something I'd want to ignore - NIST metrics below indicating a low level attack complexity is all you need to know here to ensure your fleet gets updated ASAP.       Where I'm getting at is that monitoring versions of critical pieces of software like your users browsers is very important. The question becomes, how? Of course, most admins may rely on a software deployment tool to track this - JAMF, SCCM etc. But did you know that Netskope, since it is widely used as a NG-SWG/CASB 'inline

1180
Zulkifal
1 year ago
xavy2310
Netskope Partner
xavy2310Netskope Partner
posted in Next Gen SWG
Google Chat

I am creating a DLP rule where I place the Post activity and the Block activity but it does not perform the action that is allowed, on the contrary if I select Teams there it does block the same policy.

1214
ppasseri
Netskope Employee
1 year ago
Carlos1
Netskope Partner
Carlos1Netskope Partner
posted in Next Gen SWG
CA certificates with MDM WorkspaceOne Android

Hello!I´m preparing test environment to make support for Customer with Workspace One and Android Device.The applications installs OK! But the certificates is not present in the work "container". In personal conteiner, I installed the certificates manually from Settings (upload CA) and works fine with the browser  access (Tested with Deny Category, notifications show me this block)But in the work profile, this settings is not working.Does anybody knows how to install certificates with MDM WorkspaceOne in the work space? (container Work space) Thank you very much!

880
Carlos1
Netskope Partner
1 year ago
hhamza
Netskope Partner
hhamzaNetskope Partner
posted in Next Gen SWG
Email Notification for User Justification Reason

Hi, we are stumbled upon a use case where when a user is presented with justification reason box for "Policy Violation" they are required to input the reason and this should generate an email notification to our dropbox that will generate a ticket in our ticketing system (connectwise)  However, even though we configured the ticket orchestrator on cloud exchange we are able to get the "alerts" with the help of plugins notifier, netskope ITSM CTO's. This set up is not creating any tickets as you can see from the screenshot attached.  We are looking for a way for the users when they justify the reason to use blocked page, this should generate an email notification to our dropbox. We have tried adding the email to the individual policy email notifications but this does not provide us with user justification reasons.

3918
matt-frank
Netskope Partner
1 year ago
farhan
Netskope Partner
farhanNetskope Partner
posted in Next Gen SWG
Reverse Proxy Limitations

Hi Team, Greeting  We are having a customer requirement regarding an Private application/Custom Application which SaaS based application. Like HRMS so I need to know the R-proxy part as the we can able to done reverse proxy in NG-SWG as client want a visibility to there pvt app/custom app for unmanaged user accessing the Application. I got confused a little bit here. Does R proxy able to support the custom or pvt apps or just support the known business' usage application in R proxy like 0365 Gsuite. Salesforce etc. Can i do reverse proxy integration with Custom apps and Pvt app we approaching the NPA CASB but due to some commercial they want to try it on NGSWG. 

2350
matt-frank
Netskope Partner
1 year ago
F
Netskope Partner
FaizNetskope Partner
posted in Next Gen SWG
Internet slowness issue

Hello Members   Need a help.   if any user is facing internet Speed issue or slowness issue.  what might be cause..? Any specify troubleshooting for that..? .

4230
sumit_infotrust
Netskope Partner
1 year ago
embentil
Netskope Partner
embentilNetskope Partner
posted in Next Gen SWG
Client Affecting User Activities

 When the client is installed, the end user is unable to reach certain sites like cisco.com.Meanwhile, no policies have been applied to the user.I was going to ask them to check their firewall, but this issue occurs even at home without connecting VPN.

330
S
Netskope Employee
1 year ago
aramachandran
Netskope Employee
aramachandranNetskope Employee
posted in Next Gen SWG
Google's new TLD Mayhem - SWG Policy Recommendations

A long time ago, Google applied for the .zip Top Level Domain(TLD) to ICANN and their application was granted. Recently, Google (Google Registry to be specific) announced that these TLDs will be available for use. These include domains like .Foo, .Zip, .Mov etc. Whilst they may seem innocuous on first glance, there is a big risk for malice when it comes to these top level domains. Let's say I write an email/blog/slack message that references a file abcd.zip. abcd.zip would never have been considered an 'internet bound link' back in the day.Of course, one ought to never blindly click on such links and ought to identify the 'linked' destination.<cough> Internet Security Awareness </cough>. But this is no longer the case with Google's announcement.  A threat actor could register the domain abcd.zip and point the file to a malsite abcd.zip, and subsequently, if a user were to click on such a link, trigger the auto download of a malicious file.This calls for enter

1130
aramachandran
Netskope Employee
1 year ago
M
mochiNew Member III
posted in Next Gen SWG
bypassAppMgr Blocking UDP against Exception specified IP

Hi,Kindly advise me that we set "Exceptions" registration on certain IP,and the bypass setting seems working on TCP request, but UDP ones are blocked as below. [log said:]bypassAppMgrUDP.cpp:219 BypassAppMgr Blocking UDP connection from process: google chrome helper, dest IP:xx.xx.xx.xx(we set one on Exceptions) Do we need another setting on UDP? kindly advise me!

6700
M
1 year ago
A
Netskope Partner
aatienzaNetskope Partner
posted in Next Gen SWG
Netskope Agent - pac file - explicit proxy over ipsec

Hi all,   I have a customer that uses pac file mandatory, for users with the agent installed and users who don't have agent, and can't differentiate between them, therefore all the pc's use pac file.   With non-Netskope explicit proxies over ipsec, this pac file configuration does everything works ok. addon-customer1.goskope.com -> proxy*.goskope.com -> direct   When the proxy is a Netskope explicit proxy over ipsec, the agent is disabled.   Is there a way to change the behavior so that the pac file can coexist with Netskope explicit proxy ipsec without the agent not being automatically disabled?   Thanks!!  

3060
A
Netskope Partner
1 year ago
farhan
Netskope Partner
farhanNetskope Partner
posted in Next Gen SWG
SWG SSE and Netskope NGSWG

Hi Netskope team, Congratulations on the leadership in Magic Quadrant in SSE. Please help me with my below query. As Netskope offers NGSWG, can you let me know the features of NGSWG provided in detail?As I know this includes WebDLP, URL filtering, SSL inspection, Authentication, and In-line CASB Content filtering. It's the combination of DLP SWG and CASB. Can you please let me know the limitations of DLP and CASB in NGSWG and the traditional SSE SWG and Netskope NGSWG?  

770
S
Netskope Employee
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings