Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 189 Topics
  • 490 Replies
189 Topics
Z
zmcinroy
asked in Private Access for ZTNA
How do I configure NPA to work with On-Premise DNSSEC

Looking for any information about how to best configure steering for private app access when DNSSEC is enabled on the on prem DNS servers, or if this is even possible.  I have verified my NPA publisher is able to query DNS and get proper RSIG response. However remote clients do not get a valid response from the domain even with the Netskope suggested Active Directory configuration from: Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge PortalAll nslookups come back as unsecured and Non-authoritative

534
J
Netskope Employee
Maho Fujino
Netskope Partner
Maho FujinoNetskope Partner
asked in Private Access for ZTNA
ZTNA is not functioning as expected.

ZTNA is not functioning as expected.Here is what I have done so far: Built the Publisher Registered the Private App Created an RTP policy   2.Here is the configuration of the private app I created.3.Here is the configuration of the RTP policy I created. When I performed troubleshooting for the Private App, I encountered an error.However, the publisher status is shown as "connected."What could be the possible causes? Here is the error message.  Here is the status of the publisher: it is showing as "connected". 

451
G
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Private Access for ZTNA
VNC

Check how the VNC application works through Netskope. Can this application be included in Private Apps to connect via remote desktop to user machines?

181
V
Netskope Employee
cubiaz55
cubiaz55New Member III
asked in Private Access for ZTNA
What happens if I select ALL publishers for a private app?

Howdy!I'd like a breakdown of how publishers make the best determination for traffic that is routed through them. I understand that you need a publisher CLOSET to the source of what you're trying to connect to (destination) however, there isn't anything that prevents me from adding ALL my publishrs to a private app. If I do this though, what happens exactly during the publisher selection? how does the traffic decide what the most efficient route is? What is the logic behind this routing? Also if there’s a “publisher” doc that I just haven't found that someone has, I’ll accept that as well :)  thanks!  

665
cubiaz55
steveMC
Netskope Partner
steveMCNetskope Partner
asked in Private Access for ZTNA
Can Active Directory GPO policies be applied to remote devices using ZTNA?

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

763
N
elawaetz
elawaetzExplorer III
asked in Private Access for ZTNA
How does Publisher perform App Reachability check for UDP?

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

754
elawaetz
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
Avaya Softphone over NPA

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

2843
mlestoquoy
Netskope Partner
J
jschueleNew Member III
asked in Private Access for ZTNA
AWS AMI for Publisher version outdated

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

442
S
Netskope Employee
R
RobinTNew Member
asked in Private Access for ZTNA
Is re-auth feature useful in a windows corporate workstation context

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

512
R
C
ChrisGNew Member
asked in Private Access for ZTNA
Browser access - CNAME change with authentication loop

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

391
S
Netskope Employee
H
hungnn3009New Member
asked in Private Access for ZTNA
Azure Virtual desktop Published App with Netskope

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

360
H
M
maxkorNew Member III
asked in Private Access for ZTNA
Browser Access- Concurrent Users

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

310
M
G
gabrieldmeidaNew Member III
asked in Private Access for ZTNA
ZTNA in SaaS infrastructure

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

521
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Private Access for ZTNA
POP ATL

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

661
zthompsoncr
Netskope Partner
andrea.foppiani
andrea.foppianiNew Member III
asked in Private Access for ZTNA
Time based policies for CFW NPA

Hello Team We identified what’s probably a missing feature for CFW/NPA.https://docs.netskope.com/en/time-based-policies/ are available for SWG but they don’t see to be available in CFW/NPA ? This feature is useful to time bind certain sensitive access for user outside of their working hours.If you have different suggestions on how to achieve the same result please do let us know

401
V
Netskope Employee
H
hims_nzapantaNew Member
asked in Private Access for ZTNA
Rest API V2 - Query publisher ID of a specific publisher

Hi team, is there a way I can query a specific publisher’s publisher ID using Rest API? I am looking to automate the creation of private apps with designated publishers. It looks like publisher ID is required when creating private apps with assigned publishers. Thanks in advance! 

877
H
S
secproceoNew Member
asked in Private Access for ZTNA
NPA Egress Traffic IP

Team,I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Shouldn’t the NPA website URL use the local gateway address for egress traffic? It appears the NPA traffic is using the SWG tunnel.  Thanks. 

737
S
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Private Access for ZTNA
NPA SAML Reverse Proxy Connection failure

At the moment, our client they are using their in-house IdP for SAML auth.For connecting other solution through SAML, they require same information as forward proxy described: ACS URL Entity ID (service metadata)But we failed to find SAML Proxy IdP URL and SAML Proxy ACS URL.Does anyone know if IdP URL here is equal to entity ID? All the best,Allen

382
AllenWu
Netskope Partner
extra_ranch
extra_ranch
asked in Private Access for ZTNA
Prelogon Tunnel / Machine Certificates?

Greetings,We’ve been excited about enabling the prelogon tunnel feature for NPA for some time now, but have been hesitant to do so without properly securing access by machines via the certificate method outlined in the following article: https://docs.netskope.com/en/windows-autopilot-with-private-access-prelogon/Per this article’s “Generate and Distribute Machine Certificates” section, “This section covers an optional but highly recommended set of steps required for machine certificates generation, signing, distribution and enforcement, which improves security and reduces risks associated with unauthorized access over a prelogon tunnel.”It strikes me that the best practice for prelogon enablement would be coupled with Netskope verifying machine certificates as part of its device classification; I went through the steps of setting up the certificate template in our environment, in addition to configuring the Intune Certificate Connector. However, not long after a third-party assessment/

1393
S
Netskope Employee
M
munster
asked in Private Access for ZTNA
Windows Autopilot and Netskope NPA

HI Netskope TeamI was setting up autopilot and NPA, and came across this kb Windows Autopilot with Private Access Prelogon - Netskope Knowledge PortalIn the KB “User Accounts Enrollment and Provisioning with Netskope”, there was linked to https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/netskope-administrator-console-provisioning-tutorial where it reference DIrectory Tool→ SCIM Integration.  However, this info was already EOL. What is the correct steps for “User Accounts Enrollment and Provisioning with Netskope”? thankmunster    

691
Rohit_Bhaskar
Netskope Employee
S
secproceoNew Member
asked in Private Access for ZTNA
NPA Website URL Access IP Egress Traffic

I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Should the NPA web URL use the local gateway address for egress traffic?

847
S
M
matheuspinheiroNew Member
posted in Private Access for ZTNA
WSL dont work with Netskope

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

16063
E
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
NPA Only Use-Case for Andriod and iOS

In preparation for NPA for Android and iOS, we’re facing challenges. we only want to allow/steer the allowed Private Apps in terms of Android and iOS we want the client for reauthentication purposes users leveraging this will be authenticating with the same AD User Names and AD User Groups as they would on their work computers (MS Surface devices) as the bulk of these are personal devices approved/secured for work access, we cannot and do not want to steer, inspect, log any traffic other than Private Apps​@sshiflett ​@smonk 

320
A
B
barrycuda72New Member
asked in Private Access for ZTNA
non company computers

Have Netskope configured with Microsoft Entra and SKIM provisioning.  I deploy the client via intune.I want some 3rd party users to use Netskope to access some onprem applications.We create them an account in entra bob@acme.com since they don't need email they don't specify an email address.I can manually install the client but it fails when trying to register.  Any thoughts? I don't want to waste a full office 365 license just to provide an email address.  I can put bob@hiscompany.com as an email address but that doesn't work. Does the email need to match the upn? 

321
P
E
ElTetuNew Member III
asked in Private Access for ZTNA
MFA for Private Apps on AD on-prem environment

If a customer environment only have an AD on-premises for their users, and want to set a MFA whenever their users try to access a private app, can it be configured somehow, or MFA integration witj Netskope is only supported on cloud IdP environments?

1154
E

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings