Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 159 Topics
  • 406 Replies
159 Topics
Michael Horne OCD
Netskope Partner
Michael Horne OCDNetskope Partner
asked in Private Access for ZTNA
NPA access without a client from branch sites

Hello,I want to clarify if the Netskope client is required for NPA access for users who are at the office.We have deployed NPA so that we can force an external public Application traffic through a publisher to get a fixed public IP address due to public IP address whitelisting requirements.  As we have IPSec tunnels connecting the site to Netskope cloud,  do we still need to have the client installed on the users device? Do we need to have browser based access configured for this to work?For Zscaler this is not a requirement. We use Zscaler ZPA for another customer to route Guest Wifi clients to the self-registration portal. The Guest traffic goes over IPsec tunnels to the Zsclaer cloud and Zsclaer send to to a ZPA connecter. This allows the routing of Guest traffic without having to send it over the customers internal network.This set up does not seem to work in Netskope.  If application trafic is sent over the IPsec traffic Netskope, it is not sent to the Publisher. It works when the

232
S
Netskope Employee
6 days ago
C
clnicholsonNew Member
posted in Private Access for ZTNA
Communicating to Localhost

Has anyone else had problems with communication failing when running services on localhost or loopback addresses?  I have several developer teams who receive errors when running local web services for testing.  I've added an exception to the Steering Configuration with a Destination Location but that doesn't seem to solve the issue.    

2072
T
26 days ago
NicolaScand
Netskope Partner
NicolaScandNetskope Partner
asked in Private Access for ZTNA
PQDN

Is it possible to allow rdp access to a private app using a PQDN? If so, what steps would have to be implemented to enable this? 

281
N
1 month ago
Natedog0024
Natedog0024New Member
asked in Private Access for ZTNA
revoke NPA session

Hello,is there a way to revoke an existing NPA session? Ex. Employee is terminated remotely but has an active NPA session they authenticated to that doesn’t expire for 6 more hours.thanks,Nate

531
N
1 month ago
Lionel
Netskope Partner
LionelNetskope Partner
asked in Private Access for ZTNA
Make it Possible to Create Steering Profiles via API Call

Hello,In the context of a ZTNA project, we have the option to publish "all ZTNA applications" or only the applications necessary for the user group/OU in the Steering profile. In a ZTNA approach, it seems interesting to publish only the applications necessary for users who are members of a group.Would it be possible to obtain an API Endpoint to automate the creation and assignment of a steering profile with the necessary applications?

231
N
1 month ago
Jais100rbh
Netskope Partner
Jais100rbhNetskope Partner
asked in Private Access for ZTNA
Publisher password reset

Hey Netskope buddies, I’m reaching out for help because I’ve forgotten the passwords for two of my publishers and I’m currently unable to log in. I attempted to use some Ubuntu commands to reset the password, but it’s asking for the current password, which I don’t have.I would greatly appreciate any assistance you could provide in resetting my passwords.

621
N
1 month ago
J
jschueleNew Member III
asked in Private Access for ZTNA
Sign-in Redirect Breaking NPA Browser Access

I have an internal private app configured in NPA to allow Browser Access for a consultant. Everything works fine until it redirects to Google for the login process and we see a Google error message “Access Blocked: This app’s request is invalid”, “Error 400: redirect_url_mismatch”. Any idea’s how to get around this? Thx

381
N
1 month ago
M
maxkorNew Member III
asked in Private Access for ZTNA
Browser access portal

Hi all,When I try to create more than one application this option is not enabled.The browser access portal does not support more than one application? I need to publish 5-6 different apps/services through the portal. How do I accomplish that? 

311
N
1 month ago
A
adebrattoNew Member
asked in Private Access for ZTNA
Breaking out printer traffic - Is this possible?

We are just kicking the tires on the Netskope Private Access functionality.  We are trying to understand if it would be possible to drop certain traffic out of the Netskope tunnel and onto the local wire.  For example, we do not want to send print jobs from the endpoints to the publishers if we can just break that traffic out of the tunnel and drop it right to the printers in office.Any advice?  We have been tinkering with on-premise / off-premise steering configs but cannot put a finger on how this could/shoudl work.

411
N
1 month ago
M
maxkorNew Member III
asked in Private Access for ZTNA
Devcie classification unmanaged

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.   

1399
M
1 month ago
P
pppNew Member
asked in Private Access for ZTNA
Multiple policies to a single App Definition

Hello,Is this allowed to use multiple policies assigned to a single App via tags? Is it possible to predict the behavior in such a scenario?App AServer ABCTag: AApp BServer XYZTag: BApp CServer WWWTag: A, BPolicy AAllow Group AManagedClientTag: APolicy BAllow Group BManagedClientTag: BPolicy A - blockBlock allClientTag: APolicy B - blockBlock allClientTag: BUser A - member of group AUser B - member of group BUser C - member of both group A and B Will users A, B and C be able to reach server WWW?We assume that blocking policies have fewer conditions, so they are processed later.Regards

220
P
1 month ago
P
pppNew Member
asked in Private Access for ZTNA
Problem with auto update

Hello Community,some of our clients stuck on version 114 or 117 - most updated without a problem. Has anyone encountered something similar and maybe solve it? Best regards

450
P
1 month ago
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
slow connection - private app

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

901
N
2 months ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
Avaya Softphone over NPA

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

2222
aludovico
Netskope Partner
2 months ago
aplaza
Netskope Employee
aplazaNetskope Employee
published in Private Access for ZTNA
Uncover why traditional VPNs fall short in meeting the demands of modern remote access

See a live demo, discover what sets Netskope apart, and hear success stories of transformation! Join us as we explore the pitfalls of sticking with traditional VPNs and discover a cloud-based remote access solution that meets today’s needs and tomorrow’s challenges. Key Topics Covered: Criteria for selecting a new remote access solution, including application support and unified security policies Advantages of a universal zero trust policy for seamless local and remote access How Netskope’s ZTNA Next solution enables full VPN replacement, even for legacy apps Live demo showcasing what sets Netskope apart Success stories of transformation that illustrate real-world impact To learn more about how Netskope's cloud-based remote access solution can replace outdated VPNs and elevate your security strategy, register for our upcoming webinar below:   Elevate Your Remote Access: Transform Your VPN with SASE and Zero Trust Americas Europe, Middle East, and Africa Asia-Pa

170
aplaza
Netskope Employee
2 months ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA
npa_api_policy_enabled is not enabled

Dear Netskope buddies,  Im trying get the list of npa policies from my tenant through API method and, when i launch the command (im using postman, but the result from the API web Netskope its the same) i get the following message: “NPA policy feature npa_api_policy_enabled is not enabled”Do you know why the tenant its getting me this message?The option /api/v2/policy/npa is allowed in REST API v2 sectionI have searching in the tenant something similar to this, but i didnt find any option to configure this feature.If this feature is configurable, please, could you tell me where can i find it to enable? Thanks in advance,  Best regards,    

513
ejang
Netskope Employee
2 months ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Browser Access Session Limits

After enabling Browser Access for an app behind NPA, I would like to enforce session limits.

261
Rohit_Bhaskar
Netskope Employee
2 months ago
Natedog0024
Natedog0024New Member
asked in Private Access for ZTNA
ZTNA NEXT solution with MECM/SCCM

Hello,has anyone had any experience configuring MECM to work with NetSkopes ZTNA next solution? Right now, we have 99% of our apps being steered through NPA, however, for MECM we would like to use the BWAN because NPA does not create a virtual interface and we’d prefer to use boundary groups in MECM with the a true interface IP rather than the IP of the publishers.  we have all of our hubs created, and I can see bidirectional traffic via TCPDUMP both on the local BWAN client and at the BWAN Hub to/from MECM from the client, but nothing ever comes down. Our desktop engineering team has created the boundary groups and all is good on that end. It just seems to sit on waiting for the client to download the content.  the only thing I can think of is maybe it’s because all our DC traffic is via NPA? 

620
Natedog0024
2 months ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Policy restrict access source country

I have specific NPA policies created that are configured for Client access. However, I would like to also add the Criteria = Source Country option to restrict to clients in the US only, which is possible in my Cloud App policies. This option is currently grayed out and wondering why and will it be available in the future? I can see in the event logs that the POP Name is being registered, so it knows that much at least.. Thx

982
S
Netskope Employee
2 months ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Browser Access Session Limits

After enabling Browser Access for an app behind NPA, is there a way to enforce session limits? Thx

392
J
2 months ago
S
simonmaNew Member
asked in Private Access for ZTNA
Publisher App Reachability

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

1031
N
2 months ago
M
matheuspinheiroNew Member
posted in Private Access for ZTNA
WSL dont work with Netskope

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

9602
D
2 months ago
S
sam47New Member
asked in Private Access for ZTNA
Dropped connection as no Publisher is active

HiWe are unable to access website, checked alerts and found connection was dropped as no publisher is active.

310
S
2 months ago
J
JasNew Member
asked in Private Access for ZTNA
Configuration Failed to load

Hello,So we have installed Netskope client on one of our endpoints and during the enrollment process we got an error “ Configuration failed to load” Can anyone let us know the root cause of the problem and its workaround.Thanks. 

1782
J
2 months ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
asked in Private Access for ZTNA
Question about a standard scenario for a Dial-up IPSEC/SSL VPN-RA

In a standard scenario for a Dial-up IPSEC/SSL VPN-RA we have:A DHCP IP-Pool is set up on the VPN Gateway to assign IP addresses to clients. The DNS resolver is also configured, usually using the Active Directory (AD) DNS for these assignments. The internal/remote networks that will be advertised in the VPN clients' routing table for split-tunnel access are defined.By default, a Windows interface has NetBIOS over TCP (ports 137/138) enabled.So, when connecting to the VPN, a typical SMB access like \\AD-Domain\C$ (using ports 445 and 139) for file sharing works successfully. In other words, with the old VPN model, resources can be accessed without much firewall configuration or concerns about application ports or DNS resolution.In a ZTNA/NPA environment, I’d like to better understand the precautions I should take in the same scenario. Here, we have a remote machine properly joined to the AD Domain. When it connects to the VPN, it receives its internal-use IP and internal DNS. With this

262
thiagofc
Netskope Partner
3 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings