Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 150 Topics
  • 382 Replies
150 Topics
M
maxkorNew Member III
asked in Private Access for ZTNA
Devcie classification unmanaged

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.   

726
S
Netskope Employee
1 day ago
J
jschueleNew Member III
asked in Private Access for ZTNA
Sign-in Redirect Breaking NPA Browser Access

I have an internal private app configured in NPA to allow Browser Access for a consultant. Everything works fine until it redirects to Google for the login process and we see a Google error message “Access Blocked: This app’s request is invalid”, “Error 400: redirect_url_mismatch”. Any idea’s how to get around this? Thx

60
J
2 days ago
Jais100rbh
Netskope Partner
Jais100rbhNetskope Partner
asked in Private Access for ZTNA
Publisher password reset

Hey Netskope buddies, I’m reaching out for help because I’ve forgotten the passwords for two of my publishers and I’m currently unable to log in. I attempted to use some Ubuntu commands to reset the password, but it’s asking for the current password, which I don’t have.I would greatly appreciate any assistance you could provide in resetting my passwords.

90
Jais100rbh
Netskope Partner
3 days ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA
npa_api_policy_enabled is not enabled

Dear Netskope buddies,  Im trying get the list of npa policies from my tenant through API method and, when i launch the command (im using postman, but the result from the API web Netskope its the same) i get the following message: “NPA policy feature npa_api_policy_enabled is not enabled”Do you know why the tenant its getting me this message?The option /api/v2/policy/npa is allowed in REST API v2 sectionI have searching in the tenant something similar to this, but i didnt find any option to configure this feature.If this feature is configurable, please, could you tell me where can i find it to enable? Thanks in advance,  Best regards,    

313
ejang
Netskope Employee
3 days ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Browser Access Session Limits

After enabling Browser Access for an app behind NPA, I would like to enforce session limits.

171
Rohit_Bhaskar
Netskope Employee
7 days ago
Natedog0024
Natedog0024New Member
asked in Private Access for ZTNA
revoke NPA session

Hello,is there a way to revoke an existing NPA session? Ex. Employee is terminated remotely but has an active NPA session they authenticated to that doesn’t expire for 6 more hours.thanks,Nate

140
Natedog0024
8 days ago
Natedog0024
Natedog0024New Member
asked in Private Access for ZTNA
ZTNA NEXT solution with MECM/SCCM

Hello,has anyone had any experience configuring MECM to work with NetSkopes ZTNA next solution? Right now, we have 99% of our apps being steered through NPA, however, for MECM we would like to use the BWAN because NPA does not create a virtual interface and we’d prefer to use boundary groups in MECM with the a true interface IP rather than the IP of the publishers.  we have all of our hubs created, and I can see bidirectional traffic via TCPDUMP both on the local BWAN client and at the BWAN Hub to/from MECM from the client, but nothing ever comes down. Our desktop engineering team has created the boundary groups and all is good on that end. It just seems to sit on waiting for the client to download the content.  the only thing I can think of is maybe it’s because all our DC traffic is via NPA? 

200
Natedog0024
8 days ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Policy restrict access source country

I have specific NPA policies created that are configured for Client access. However, I would like to also add the Criteria = Source Country option to restrict to clients in the US only, which is possible in my Cloud App policies. This option is currently grayed out and wondering why and will it be available in the future? I can see in the event logs that the POP Name is being registered, so it knows that much at least.. Thx

742
S
Netskope Employee
8 days ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Browser Access Session Limits

After enabling Browser Access for an app behind NPA, is there a way to enforce session limits? Thx

282
J
9 days ago
S
simonmaNew Member
asked in Private Access for ZTNA
Publisher App Reachability

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

671
N
17 days ago
M
matheuspinheiroNew Member
posted in Private Access for ZTNA
WSL dont work with Netskope

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

7102
D
19 days ago
S
sam47New Member
asked in Private Access for ZTNA
Dropped connection as no Publisher is active

HiWe are unable to access website, checked alerts and found connection was dropped as no publisher is active.

140
S
21 days ago
J
JasNew Member
asked in Private Access for ZTNA
Configuration Failed to load

Hello,So we have installed Netskope client on one of our endpoints and during the enrollment process we got an error “ Configuration failed to load” Can anyone let us know the root cause of the problem and its workaround.Thanks. 

432
J
24 days ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
asked in Private Access for ZTNA
Question about a standard scenario for a Dial-up IPSEC/SSL VPN-RA

In a standard scenario for a Dial-up IPSEC/SSL VPN-RA we have:A DHCP IP-Pool is set up on the VPN Gateway to assign IP addresses to clients. The DNS resolver is also configured, usually using the Active Directory (AD) DNS for these assignments. The internal/remote networks that will be advertised in the VPN clients' routing table for split-tunnel access are defined.By default, a Windows interface has NetBIOS over TCP (ports 137/138) enabled.So, when connecting to the VPN, a typical SMB access like \\AD-Domain\C$ (using ports 445 and 139) for file sharing works successfully. In other words, with the old VPN model, resources can be accessed without much firewall configuration or concerns about application ports or DNS resolution.In a ZTNA/NPA environment, I’d like to better understand the precautions I should take in the same scenario. Here, we have a remote machine properly joined to the AD Domain. When it connects to the VPN, it receives its internal-use IP and internal DNS. With this

222
thiagofc
Netskope Partner
29 days ago
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
How to create device classification based on Netskope private app registry value

hey all,How to create device classification based on Netskope private app registry value? attached screenshot i want to monitor on these value when private app is connected value device will be managed . thanks

280
dinbarzily
Netskope Partner
1 month ago
C
clnicholsonNew Member
asked in Private Access for ZTNA
NPA Internet Access Issues

I'm doing a deploy of NPA across my environment and hitting a series of snags.  The issue seems to be related to my Mac users having issues with DNS resolution or pages loading failures.  These are largely my SaaS based SSO apps but they can be anything.  We are using Duo Security for MFA but that has been added as an exception.  The problem is intermittent.  Some users experience it all the time, I only experience it periodically though it used to be all the time for me too.  All users are in the same Steering Configuration.   We are all using MacOS Ventura so this may be related to the bug from last year.  

4305
S
1 month ago
N
nesi10062New Member
asked in Private Access for ZTNA
Intermittent failure to access private apps from the Office

When some users are at the office, every now and then they become unable to access private apps Chrome simply hangs.When that happens, if they disconnect and reconnect from Wi-Fi, the issue is fixed, until it breaks again after a few hours/minutes.This doesn't happen when they are working from home.

2143
S
1 month ago
V
vahidNew Member
asked in Private Access for ZTNA
Netskope Publisher Auto Update

Hi,I have a question (or two) about netskope publisher auto update feature.Does this auto-update feature only work i.e. kicks in when there’s a new version of netskope publisher? assuming I set it to latest update on weekly basisLet’s say I’m on version 117.0 and there’s a new version 118.0. This will get updated to 118 during whatever time I configure the auto update.If there’s no new version of netskope publisher, will it still update the underlying OS/system packages?Thanks 

1104
S
Netskope Employee
1 month ago
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
slow connection - private app

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

430
dinbarzily
Netskope Partner
1 month ago
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
private app access slow connection

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

290
dinbarzily
Netskope Partner
1 month ago
Deepak_InfoTru
Netskope Partner
Deepak_InfoTruNetskope Partner
asked in Private Access for ZTNA
Publisher not able to access private applications but can telnet

We are having an issue where user can`t access a private app via publisher and we have checked all the configuration is correct in Netskope Tenant and the same has been confirmed with Netskope Support engineering as well.However, we can telnet the same application on the same port from publishers itself.Both publishers and private applications are on the same subnet.  When we run a TCPdump on the publishers we can see SYN packet from user`s machine is reaching to the publisher, but publisher is not getting SYN-ACK packet from the private applications. There is no firewall blocking it as publishers and private apps are in the same subnet. Let me know what your thoughts on this. 

503
Deepak_InfoTru
Netskope Partner
1 month ago
S
simonmaNew Member
asked in Private Access for ZTNA
NPA - On-premise Detection Exceptions

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

1044
S
2 months ago
F
fergjaNew Member III
asked in Private Access for ZTNA
Restricting access to home networks with NPA?

What is NPA best practice when it comes to restricting access to home network ranges? Naturally we first thought of creating an RFC 1918 sinkhole app using port 10, however this would restrict access to internal apps as well. If we just carve out and allow our own internal ranges, while sink holing those ranges we don't use, we still allow users access to any home network ranges that are identified as internal. How are other people handling this?

771
Rohit_Bhaskar
Netskope Employee
2 months ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Private Access for ZTNA
Google Workspace - IDP Client - Google Authenticator

Google Workspace - IDP Client - Google AuthenticatorHello good afternoon community, I hope you are very well.I have a question, regarding the use of MFA or a two-factor authentication for users with the following case:Users with IDP mode installed - Provisioning users to Tenant with Azure-AD . SAML Proxy for IDP - Google Worskpace.Now if a customer wants or needs that apart from the enrollment via IDP, in this case Google Workspace, reauth must be applied at Private Access level so that every so often it performs the reauth.Now thinking if the customer wants that when this reauth occurs, in addition to validate the Google Workspace credentials, use Google Authenticator, this configuration is not specific to Netskope, but in this case the Google Workspace itself? Is this correct?Thank you very much community for your time, advice and collaboration.Best regards

361
S
Netskope Employee
2 months ago
J
jdavilaNew Member
posted in Private Access for ZTNA
how to automatically disable agent npa tunnel, when endpoints are in company internal network?.

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

57516
S
3 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings