Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 193 Topics
  • 492 Replies
193 Topics
C Vinothkanna
Netskope Partner
C VinothkannaNetskope Partner
asked in Private Access for ZTNA
Matching Criteria limitation and Policy schedule option is not available for the Private application policies

We would like to control the Private application (Client based access) with Time bound & Geolocation for the users.The Client based Private application defined policy doesn’t have the source IP as match criteria for identifying the users Geolocation. The Private Application policy doesn’t have the policy schedule option like the Cloud app or the web access policies.We are expecting whether this can be achieved with the Netskope or addressed by Netskope in the future releases.Thank you.

50
C Vinothkanna
Netskope Partner
M
maxkorNew Member III
asked in Private Access for ZTNA
Browser Access- Concurrent Users

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

601
M
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Private Access for ZTNA
How to Add Threat Protection for Private Apps

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) allows organizations to apply Threat Protection to web traffic (ports 80 and 443) for private applications, ensuring files are scanned for malware in real-time. When using Threat Protection with NPA, note that this feature:Requires Client as the Access Method. Scans all web traffic on HTTP (80) and HTTPS (443). Applies real-time scanning to protect private app access from malware and other advanced threats.Netskope One Private Access now a

250
AllenWu
Netskope Partner
C
CuriousExplorer II
asked in Private Access for ZTNA
Which Windows Firewall Profile is selected when Publishing Active Directory

Hi Netskopers, For those of you which have published Active Directory via NPA, using the following guide...Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge Portal The Windows client can then always connect to and authenticate with AD (since its always available via NPA). Due to this, Windows is always applying the less restrictive Domain Firewall Profile even when the remote device is connected to an untrusted network (home wifi, public cafe etc). Normally the more restrictive Public Firewall Profile would be applied. Is this a concern for others?Have you solved this somehow?Are there any other options other than make the Domain Profile more restrictive.

340
C
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in Private Access for ZTNA
Dynamic Steering

I have configured Dynamic Steering.Here are the steps I took: In the Client Config, I specified the internal web server (192.168.10.156). In Traffic Steering, I enabled the Dynamic Steering option. However, after completing the above configurations, when I check the configuration of a server located in the same network as the web server set in step 1, it shows On-premises check: Remote.Could you please advise on how to resolve this issue? Step1  Step2  It shows On-premises check: Remote 

541
rodborges
Netskope Partner
Z
zmcinroy
asked in Private Access for ZTNA
How do I configure NPA to work with On-Premise DNSSEC

Looking for any information about how to best configure steering for private app access when DNSSEC is enabled on the on prem DNS servers, or if this is even possible.  I have verified my NPA publisher is able to query DNS and get proper RSIG response. However remote clients do not get a valid response from the domain even with the Netskope suggested Active Directory configuration from: Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge PortalAll nslookups come back as unsecured and Non-authoritative

804
J
Netskope Employee
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in Private Access for ZTNA
ZTNA is not functioning as expected.

ZTNA is not functioning as expected.Here is what I have done so far: Built the Publisher Registered the Private App Created an RTP policy   2.Here is the configuration of the private app I created.3.Here is the configuration of the RTP policy I created. When I performed troubleshooting for the Private App, I encountered an error.However, the publisher status is shown as "connected."What could be the possible causes? Here is the error message.  Here is the status of the publisher: it is showing as "connected". 

741
G
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Private Access for ZTNA
VNC

Check how the VNC application works through Netskope. Can this application be included in Private Apps to connect via remote desktop to user machines?

381
V
Netskope Employee
cubiaz55
cubiaz55New Member III
asked in Private Access for ZTNA
What happens if I select ALL publishers for a private app?

Howdy!I'd like a breakdown of how publishers make the best determination for traffic that is routed through them. I understand that you need a publisher CLOSET to the source of what you're trying to connect to (destination) however, there isn't anything that prevents me from adding ALL my publishrs to a private app. If I do this though, what happens exactly during the publisher selection? how does the traffic decide what the most efficient route is? What is the logic behind this routing? Also if there’s a “publisher” doc that I just haven't found that someone has, I’ll accept that as well :)  thanks!  

925
cubiaz55
steveMC
Netskope Partner
steveMCNetskope Partner
asked in Private Access for ZTNA
Can Active Directory GPO policies be applied to remote devices using ZTNA?

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

973
N
elawaetz
elawaetzExplorer III
asked in Private Access for ZTNA
How does Publisher perform App Reachability check for UDP?

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

924
elawaetz
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
Avaya Softphone over NPA

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

2943
mlestoquoy
Netskope Partner
J
jschueleNew Member III
asked in Private Access for ZTNA
AWS AMI for Publisher version outdated

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

512
S
Netskope Employee
R
RobinTNew Member
asked in Private Access for ZTNA
Is re-auth feature useful in a windows corporate workstation context

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

642
R
C
ChrisGNew Member
asked in Private Access for ZTNA
Browser access - CNAME change with authentication loop

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

521
S
Netskope Employee
H
hungnn3009New Member
asked in Private Access for ZTNA
Azure Virtual desktop Published App with Netskope

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

470
H
G
gabrieldmeidaNew Member III
asked in Private Access for ZTNA
ZTNA in SaaS infrastructure

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

601
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Private Access for ZTNA
POP ATL

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

961
zthompsoncr
Netskope Partner
andrea.foppiani
andrea.foppianiNew Member III
asked in Private Access for ZTNA
Time based policies for CFW NPA

Hello Team We identified what’s probably a missing feature for CFW/NPA.https://docs.netskope.com/en/time-based-policies/ are available for SWG but they don’t see to be available in CFW/NPA ? This feature is useful to time bind certain sensitive access for user outside of their working hours.If you have different suggestions on how to achieve the same result please do let us know

501
V
Netskope Employee
H
hims_nzapantaNew Member
asked in Private Access for ZTNA
Rest API V2 - Query publisher ID of a specific publisher

Hi team, is there a way I can query a specific publisher’s publisher ID using Rest API? I am looking to automate the creation of private apps with designated publishers. It looks like publisher ID is required when creating private apps with assigned publishers. Thanks in advance! 

897
H
S
secproceoNew Member
asked in Private Access for ZTNA
NPA Egress Traffic IP

Team,I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Shouldn’t the NPA website URL use the local gateway address for egress traffic? It appears the NPA traffic is using the SWG tunnel.  Thanks. 

947
S
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Private Access for ZTNA
NPA SAML Reverse Proxy Connection failure

At the moment, our client they are using their in-house IdP for SAML auth.For connecting other solution through SAML, they require same information as forward proxy described: ACS URL Entity ID (service metadata)But we failed to find SAML Proxy IdP URL and SAML Proxy ACS URL.Does anyone know if IdP URL here is equal to entity ID? All the best,Allen

442
AllenWu
Netskope Partner
extra_ranch
extra_ranch
asked in Private Access for ZTNA
Prelogon Tunnel / Machine Certificates?

Greetings,We’ve been excited about enabling the prelogon tunnel feature for NPA for some time now, but have been hesitant to do so without properly securing access by machines via the certificate method outlined in the following article: https://docs.netskope.com/en/windows-autopilot-with-private-access-prelogon/Per this article’s “Generate and Distribute Machine Certificates” section, “This section covers an optional but highly recommended set of steps required for machine certificates generation, signing, distribution and enforcement, which improves security and reduces risks associated with unauthorized access over a prelogon tunnel.”It strikes me that the best practice for prelogon enablement would be coupled with Netskope verifying machine certificates as part of its device classification; I went through the steps of setting up the certificate template in our environment, in addition to configuring the Intune Certificate Connector. However, not long after a third-party assessment/

1813
S
Netskope Employee
M
munster
asked in Private Access for ZTNA
Windows Autopilot and Netskope NPA

HI Netskope TeamI was setting up autopilot and NPA, and came across this kb Windows Autopilot with Private Access Prelogon - Netskope Knowledge PortalIn the KB “User Accounts Enrollment and Provisioning with Netskope”, there was linked to https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/netskope-administrator-console-provisioning-tutorial where it reference DIrectory Tool→ SCIM Integration.  However, this info was already EOL. What is the correct steps for “User Accounts Enrollment and Provisioning with Netskope”? thankmunster    

861
Rohit_Bhaskar
Netskope Employee
S
secproceoNew Member
asked in Private Access for ZTNA
NPA Website URL Access IP Egress Traffic

I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Should the NPA web URL use the local gateway address for egress traffic?

977
S

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings