Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 133 Topics
  • 356 Replies

133 Topics

S
simonmaNew Member
asked in Private Access for ZTNA

NPA - On-premise Detection Exceptions

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

1
S
2 days ago
J
jdavilaNew Member
posted in Private Access for ZTNA

how to automatically disable agent npa tunnel, when endpoints are in company internal network?.

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

16
S
4 days ago
S
simonmaNew Member
asked in Private Access for ZTNA

Publisher App Reachability

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

0
S
5 days ago
A
aldiazNew Member III
asked in Private Access for ZTNA

Modify keepalive time interval between publisher and private app

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

4
S
5 days ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Private Access for ZTNA

Netskope Private Access: "Life of a Packet"

Introduction Netskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Ne

8
J
23 days ago
J
jschueleNew Member III
asked in Private Access for ZTNA

NPA Policy restrict access source country

I have specific NPA policies created that are configured for Client access. However, I would like to also add the Criteria = Source Country option to restrict to clients in the US only, which is possible in my Cloud App policies. This option is currently grayed out and wondering why and will it be available in the future? I can see in the event logs that the POP Name is being registered, so it knows that much at least.. Thx

0
J
1 month ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA

NPA: Configuring Wildcard App Entry for Internal Resources

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

2
S
Netskope Employee
1 month ago
E
ElTetuNew Member III
posted in Private Access for ZTNA

NPA Periodic Reauth + Flexible Dynamic Steering

HiI have been able to configure the NPA periodic reauth and the flexible dynamic steering in my netskope settings, but I’d like to “combine” both of them and I’m not sure if that’s possible.I mean, I have configured the dynamic steering so the users Netskope Client will steer traffic to private apps only whten they are off-premise, and the client will disable for private apps when they are on-premise.I have also configured the Periodic Reauth for NPA in my client configuration settings, so it asks for reauthentication after a period of time, but I see that this Periodic Reauth asks for the reauthentication no matter if the user is on-premise or off-premise. As I want the client only to steer traffic to private apps when off-premise, I’d like also that the Periodic Reauth triggers only when the user is off-premise, and not on-premise no matter how many time has passed since last authentication.could this be done? It seems that the Periodic Reauth is a “global” setting and don’t take int

5
bnorcutt
Netskope Partner
1 month ago
S
SahdevNew Member
asked in Private Access for ZTNA

How can I access authentication and authorization logs/events for applications accessed through Netskope Private Access?

I'm new to using Netskope Private Access and need some guidance. I want to monitor and review authentication and authorization logs/events info for the applications accessed through this service.Could someone provide detailed steps or direct me to the relevant sections in the Netskope admin console where I can find these logs?Any help would be greatly appreciated!Thank you!

2
S
1 month ago
pbeyleveld
Netskope Employee
pbeyleveldNetskope Employee
posted in Private Access for ZTNA

Leverage automation to enable business led private application onboarding

Problem Statement:ZTNA requires that all application objects are uniquely and explicitly defined. In large organisations, IT Security teams often do not have insight into all the applications used by business users and neither do they understand which users should have access to these applications.Use Case:Leverage robotic process automation to enable business led application onboarding. Provide a form to business users enabling those users to request a new application. After an approval flow, API’s are then leveraged to provision the application objects in Netskope with the relevant access granted. Proof of concept:The idea is that any business process automation tool like, Microsoft Power Automate, BMC Helix, tine etc. can be used to assist companies to achieve this use case. I leveraged the community version of n8n to build a simple proof of concept and provide insight into how this type of process can be used to simplify the implementation of a zero trust network access strategy.De

0
pbeyleveld
Netskope Employee
1 month ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA

Delete AD Groups or OU

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

3
danisilfi
Netskope Partner
1 month ago
C
chrisisinclairNew Member III
posted in Private Access for ZTNA

Extremely Slow File Storage Access Speeds?

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

10
J
2 months ago
E
EleComteNew Member III
asked in Private Access for ZTNA

Detect install type of Netskope Client (single or multi user)

Hi everyone,   Is there a way (prefer. registry key) to determine is a Netskope Client install was single user (default) or multi user mode? This would help in "cleanup" of messed-up installs.   Best regards,   Etienne

6
S
2 months ago
D
dazmacmainNew Member III
asked in Private Access for ZTNA

Netskope VPN Solution

Hi All, I am new to Netskope.  We are running Netskope as a VPN solution. Can you run another VPN solution on top of this without affecting Netskope.Like Cisco Anyconnect.

4
zthompsoncr
Netskope Partner
2 months ago
A
AlfaBaneExplorer III
asked in Private Access for ZTNA

NPA: Ivanti Management Console

We are expanding our NPA footprint soon. Several of the users that are about to gain NPA access use the Ivanti Management Console (remote management console) on a daily basis. Attempting to log into the console results in the following error:  Console Initialization Error:  Unable to connect to the database.A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No such host is known.).We have Private apps created for this host and IP already.  Has anyone else configured this successfully for NPA access? 

2
A
2 months ago
Z
ZulhaideeNew Member III
asked in Private Access for ZTNA

Dedicated egress ip address

Hello, Would like to check the dedicated egress ip address is tied to the ZTNA solution. meaning if you want to use the ZTNA feature on Netskope, then dedicated egress ip address is required for the feature?

1
S
Netskope Employee
2 months ago
mgoetz
Netskope Partner
mgoetzNetskope Partner
asked in Private Access for ZTNA

Multi tags in NPA Apps with Terraform

Hello,I would like to use multiple tags for private apps.What would be the syntax here?tags { tag_name = "TEST, TEST1, TEST3" } ?I would be grateful for your help.Marco

3
S
2 months ago
A
AlfaBaneExplorer III
asked in Private Access for ZTNA

NPA: managing Periodic Reauthentication on mobile (iOS & Android) devices

For Private Access environments in which users also have mobile (iOS & Android) access to certain Private Apps, what’s the best way to avoid flooding users with daily Periodic Reauthentication on their computers as well as their phones? Maybe a better question would be “what is the expected user experience in terms of Periodic Reauthentication” for users leveraging Private Access on both their work computers and their phones?should users be prompted to reauth on both devices?  is it just whichever device prompts first?  is the expected behavior different for iOS & Andriod? Also, if the reauth period lapses or the prompt is missed or accidentally closed on the phone and private access disables, what is the best way to instruct end-users on restoring Private Access on their phones ? On computers, reauthentication is easily done via the client menu, but I’ve been unable to find any such option on the Netskope client/app on iOS   @sshiflett 

2
Rohit_Bhaskar
Netskope Employee
2 months ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA

NPA Periodic Re-authenication: pop-behind causing problems with the user experience

We are reevaluating the NPA Periodic Re-authentication. Previous user experiences were lacking. However, now that we have had support enable the “reauth at log-in/reboot”, things have improved dramatically. The primary downside that is keeping us from expanding this for testing is the pop-behind nature of the reauth prompt. Many users think they “are not being prompted” when in fact they are. Is there anything that can be done to force the prompt to either remain at the forefront until addressed or give the prompt a taskbar presence like applications/browsers/alerts do. Users that lock their device at the end of the day (in their given workspace) rather than logging out/shutting down, have no idea the reauth is open behind the of their apps/browsers at the start of the day due to the pop-behind nature of this prompt. If there is no current solution, is this on the roadmap to fix? If so, when?@sshiflett @rsurya 

8
E
2 months ago
A
Netskope Partner
akashsaxenaNetskope Partner
posted in Private Access for ZTNA

Browser Access with Okta

I am unable to access the application without a client. I have Integrated Okta for reverse proxy. Whenever I try to access the application, I am getting an error: 500 : Netskope was unable to process authentication request for tenant:<18507>. couldn't create AUTH URL: runtime error: invalid memory address or nil pointer dereference. 

3
F
Netskope Employee
2 months ago
ssumner
Netskope Employee
ssumnerNetskope Employee
posted in Private Access for ZTNA

VPN elimination and cost to operate [community survey]

Despite the shift to Zero Trust, VPNs are still essential… but at the same time work from home resulted in a permanent jump in VPN user experience issues: help desk tickets increased 4.9x since 2019. To learn more about the “why”, we’re taking a deep dive into the impact of VPNs to bring these insights to our community members.We’re running a global survey to quantify VPN usage, cost, and user impact, where participants will receive complete results within two weeks:No personal information is required to participate It takes less than three minutes to complete the surveyA global peer benchmarkParticipating will let you understand where your company stands vs. your peers re.:VPN use, performance and cost analysis Top apps consuming VPN bandwidth VoIP and remote assistance VPN dependencies VPN’s direct & indirect impact on the help desk Take the Survey  and help us illuminate this subject together. Thanks for your help! If you have any questions, please let me know.Scott

0
ssumner
Netskope Employee
3 months ago
J
jasonbeebeNew Member III
asked in Private Access for ZTNA

Active Directory and DNS with Multiple Regions

My organization has two main regions (USA and India).  I currently have ADDS/DNS servers in both regions.  I have two private apps configured for ADDS.  One of them is directing traffic to the India ADDS servers using the local NPAs, the other is doing the same for USA.I have a prelogin user that has access to both private apps.I also have a DNS private app defined (*._http.domain.local, *._kkdcp.domain.local, etc) but it only uses the USA publishers.With this configuration, our USA users are working fine with very little lag on computer startup and login.  Our India users, however, are experiencing very long startup and login times.My question is, what is the proper way of configuring AD and DNS access for clients when the organization is multi-regional and you want the client to always access the closest ADDS/DNS servers?Some solutions I am considering are:Divide each region’s users into separate groups and give them only access to their local ADDS server.  This however does not solv

2
J
3 months ago
J
juliocondeNew Member
asked in Private Access for ZTNA

IDE IntelliJ(Java and spring) Error NPA resolve name

Hello Community,My developers use the IntelliJ IDE to develop, as our environment is 100% cloud, we use NPA to access the development environments. We use spring as a framework for our applications.My error is the following for some endpoints I simply cannot connect using IntelliJ and spring. If I do a curl or telnet I can access the endpoint normally, only IntelliJ and spring can't. I have openVPN as redundancy and I don't get this error.Has anyone had a similar problem?Below is a simpler application that I can replicate the errorpackage ConnectivityTest;import org.springframework.http.ResponseEntity;import org.springframework.http.client.reactive.ClientHttpConnector;import org.springframework.http.client.reactive.ReactorClientHttpConnector;import org.springframework.web.reactive.function.client.ExchangeStrategies;import org.springframework.web.reactive.function.client.WebClient;import reactor.netty.http.client.HttpClient;public class ConnectivityTest { public static <Objerespon

1
S
Netskope Employee
3 months ago
C
CuriousExplorer II
asked in Private Access for ZTNA

VPN and NPA Not Happy Together

Hi Everyone, Have an issue where remote NS clients have the following environment and in this order:1. IPv4 and IPv6 addresses assigned (eg. from home wifi or mobile hotspot)- The IPv6 address assigned (global internet address starts with 2001:xxx)2. NPA Tunnel is established3. Connect to corporate VPN service4. Clients are then unable to access applications via the VPN NPA applications continue to operate successfully but the NS client service appears to interfere with the VPN tunnel. Stop the NS client service and there is no issue with the VPN. Disable IPv6 and the VPN and NPA work successfully, this is not recommended by Microsoft so not really a desirable option. Have tried to configure clients to 'Prefer IPv4 over IPv6' this was looking promising but not producing reliable results. Issue still appears to randomly occur, still testing this. Anyone else experience this issue?

5
E
3 months ago
A
ajitNew Member
asked in Private Access for ZTNA

how to enable two-way communication through ztna

how to enable two-way communication through ztna

1
ejang
Netskope Employee
3 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings