Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 159 Topics
  • 406 Replies
159 Topics
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
How to create device classification based on Netskope private app registry value

hey all,How to create device classification based on Netskope private app registry value? attached screenshot i want to monitor on these value when private app is connected value device will be managed . thanks

410
dinbarzily
Netskope Partner
3 months ago
C
clnicholsonNew Member
asked in Private Access for ZTNA
NPA Internet Access Issues

I'm doing a deploy of NPA across my environment and hitting a series of snags.  The issue seems to be related to my Mac users having issues with DNS resolution or pages loading failures.  These are largely my SaaS based SSO apps but they can be anything.  We are using Duo Security for MFA but that has been added as an exception.  The problem is intermittent.  Some users experience it all the time, I only experience it periodically though it used to be all the time for me too.  All users are in the same Steering Configuration.   We are all using MacOS Ventura so this may be related to the bug from last year.  

5225
S
3 months ago
N
nesi10062New Member
asked in Private Access for ZTNA
Intermittent failure to access private apps from the Office

When some users are at the office, every now and then they become unable to access private apps Chrome simply hangs.When that happens, if they disconnect and reconnect from Wi-Fi, the issue is fixed, until it breaks again after a few hours/minutes.This doesn't happen when they are working from home.

2543
S
3 months ago
V
vahidNew Member
asked in Private Access for ZTNA
Netskope Publisher Auto Update

Hi,I have a question (or two) about netskope publisher auto update feature.Does this auto-update feature only work i.e. kicks in when there’s a new version of netskope publisher? assuming I set it to latest update on weekly basisLet’s say I’m on version 117.0 and there’s a new version 118.0. This will get updated to 118 during whatever time I configure the auto update.If there’s no new version of netskope publisher, will it still update the underlying OS/system packages?Thanks 

1384
S
Netskope Employee
3 months ago
dinbarzily
Netskope Partner
dinbarzilyNetskope Partner
asked in Private Access for ZTNA
private app access slow connection

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

350
dinbarzily
Netskope Partner
3 months ago
Deepak_InfoTru
Netskope Partner
Deepak_InfoTruNetskope Partner
asked in Private Access for ZTNA
Publisher not able to access private applications but can telnet

We are having an issue where user can`t access a private app via publisher and we have checked all the configuration is correct in Netskope Tenant and the same has been confirmed with Netskope Support engineering as well.However, we can telnet the same application on the same port from publishers itself.Both publishers and private applications are on the same subnet.  When we run a TCPdump on the publishers we can see SYN packet from user`s machine is reaching to the publisher, but publisher is not getting SYN-ACK packet from the private applications. There is no firewall blocking it as publishers and private apps are in the same subnet. Let me know what your thoughts on this. 

633
Deepak_InfoTru
Netskope Partner
3 months ago
S
simonmaNew Member
asked in Private Access for ZTNA
NPA - On-premise Detection Exceptions

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

1434
S
4 months ago
F
fergjaNew Member III
asked in Private Access for ZTNA
Restricting access to home networks with NPA?

What is NPA best practice when it comes to restricting access to home network ranges? Naturally we first thought of creating an RFC 1918 sinkhole app using port 10, however this would restrict access to internal apps as well. If we just carve out and allow our own internal ranges, while sink holing those ranges we don't use, we still allow users access to any home network ranges that are identified as internal. How are other people handling this?

1011
Rohit_Bhaskar
Netskope Employee
4 months ago
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
asked in Private Access for ZTNA
Google Workspace - IDP Client - Google Authenticator

Google Workspace - IDP Client - Google AuthenticatorHello good afternoon community, I hope you are very well.I have a question, regarding the use of MFA or a two-factor authentication for users with the following case:Users with IDP mode installed - Provisioning users to Tenant with Azure-AD . SAML Proxy for IDP - Google Worskpace.Now if a customer wants or needs that apart from the enrollment via IDP, in this case Google Workspace, reauth must be applied at Private Access level so that every so often it performs the reauth.Now thinking if the customer wants that when this reauth occurs, in addition to validate the Google Workspace credentials, use Google Authenticator, this configuration is not specific to Netskope, but in this case the Google Workspace itself? Is this correct?Thank you very much community for your time, advice and collaboration.Best regards

431
S
Netskope Employee
4 months ago
J
jdavilaNew Member
posted in Private Access for ZTNA
how to automatically disable agent npa tunnel, when endpoints are in company internal network?.

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

66716
S
5 months ago
A
aldiazNew Member III
asked in Private Access for ZTNA
Modify keepalive time interval between publisher and private app

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

1954
S
5 months ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Private Access for ZTNA
Netskope Private Access: "Life of a Packet"

IntroductionNetskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Netskope Publisher on the ri

35388
J
5 months ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
NPA: Configuring Wildcard App Entry for Internal Resources

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

982
S
Netskope Employee
6 months ago
E
ElTetuNew Member III
posted in Private Access for ZTNA
NPA Periodic Reauth + Flexible Dynamic Steering

HiI have been able to configure the NPA periodic reauth and the flexible dynamic steering in my netskope settings, but I’d like to “combine” both of them and I’m not sure if that’s possible.I mean, I have configured the dynamic steering so the users Netskope Client will steer traffic to private apps only whten they are off-premise, and the client will disable for private apps when they are on-premise.I have also configured the Periodic Reauth for NPA in my client configuration settings, so it asks for reauthentication after a period of time, but I see that this Periodic Reauth asks for the reauthentication no matter if the user is on-premise or off-premise. As I want the client only to steer traffic to private apps when off-premise, I’d like also that the Periodic Reauth triggers only when the user is off-premise, and not on-premise no matter how many time has passed since last authentication.could this be done? It seems that the Periodic Reauth is a “global” setting and don’t take int

2695
bnorcutt
Netskope Partner
6 months ago
S
SahdevNew Member
asked in Private Access for ZTNA
How can I access authentication and authorization logs/events for applications accessed through Netskope Private Access?

I'm new to using Netskope Private Access and need some guidance. I want to monitor and review authentication and authorization logs/events info for the applications accessed through this service.Could someone provide detailed steps or direct me to the relevant sections in the Netskope admin console where I can find these logs?Any help would be greatly appreciated!Thank you!

1342
S
6 months ago
pbeyleveld
Netskope Employee
pbeyleveldNetskope Employee
posted in Private Access for ZTNA
Leverage automation to enable business led private application onboarding

Problem Statement:ZTNA requires that all application objects are uniquely and explicitly defined. In large organisations, IT Security teams often do not have insight into all the applications used by business users and neither do they understand which users should have access to these applications.Use Case:Leverage robotic process automation to enable business led application onboarding. Provide a form to business users enabling those users to request a new application. After an approval flow, API’s are then leveraged to provision the application objects in Netskope with the relevant access granted. Proof of concept:The idea is that any business process automation tool like, Microsoft Power Automate, BMC Helix, tine etc. can be used to assist companies to achieve this use case. I leveraged the community version of n8n to build a simple proof of concept and provide insight into how this type of process can be used to simplify the implementation of a zero trust network access strategy.De

00
pbeyleveld
Netskope Employee
6 months ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA
Delete AD Groups or OU

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

1843
danisilfi
Netskope Partner
6 months ago
C
chrisisinclairNew Member III
posted in Private Access for ZTNA
Extremely Slow File Storage Access Speeds?

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

70110
J
7 months ago
E
EleComteNew Member III
asked in Private Access for ZTNA
Detect install type of Netskope Client (single or multi user)

Hi everyone,   Is there a way (prefer. registry key) to determine is a Netskope Client install was single user (default) or multi user mode? This would help in "cleanup" of messed-up installs.   Best regards,   Etienne

5766
S
7 months ago
D
dazmacmainNew Member III
asked in Private Access for ZTNA
Netskope VPN Solution

Hi All, I am new to Netskope.  We are running Netskope as a VPN solution. Can you run another VPN solution on top of this without affecting Netskope.Like Cisco Anyconnect.

1804
zthompsoncr
Netskope Partner
7 months ago
A
AlfaBaneExplorer III
asked in Private Access for ZTNA
NPA: Ivanti Management Console

We are expanding our NPA footprint soon. Several of the users that are about to gain NPA access use the Ivanti Management Console (remote management console) on a daily basis. Attempting to log into the console results in the following error:  Console Initialization Error:  Unable to connect to the database.A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No such host is known.).We have Private apps created for this host and IP already.  Has anyone else configured this successfully for NPA access? 

1182
A
7 months ago
Z
ZulhaideeNew Member III
asked in Private Access for ZTNA
Dedicated egress ip address

Hello, Would like to check the dedicated egress ip address is tied to the ZTNA solution. meaning if you want to use the ZTNA feature on Netskope, then dedicated egress ip address is required for the feature?

7101
S
Netskope Employee
7 months ago
mgoetz
Netskope Partner
mgoetzNetskope Partner
asked in Private Access for ZTNA
Multi tags in NPA Apps with Terraform

Hello,I would like to use multiple tags for private apps.What would be the syntax here?tags { tag_name = "TEST, TEST1, TEST3" } ?I would be grateful for your help.Marco

873
S
7 months ago
A
AlfaBaneExplorer III
asked in Private Access for ZTNA
NPA: managing Periodic Reauthentication on mobile (iOS & Android) devices

For Private Access environments in which users also have mobile (iOS & Android) access to certain Private Apps, what’s the best way to avoid flooding users with daily Periodic Reauthentication on their computers as well as their phones? Maybe a better question would be “what is the expected user experience in terms of Periodic Reauthentication” for users leveraging Private Access on both their work computers and their phones?should users be prompted to reauth on both devices?  is it just whichever device prompts first?  is the expected behavior different for iOS & Andriod? Also, if the reauth period lapses or the prompt is missed or accidentally closed on the phone and private access disables, what is the best way to instruct end-users on restoring Private Access on their phones ? On computers, reauthentication is easily done via the client menu, but I’ve been unable to find any such option on the Netskope client/app on iOS   @sshiflett 

1212
Rohit_Bhaskar
Netskope Employee
7 months ago
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
NPA Periodic Re-authenication: pop-behind causing problems with the user experience

We are reevaluating the NPA Periodic Re-authentication. Previous user experiences were lacking. However, now that we have had support enable the “reauth at log-in/reboot”, things have improved dramatically. The primary downside that is keeping us from expanding this for testing is the pop-behind nature of the reauth prompt. Many users think they “are not being prompted” when in fact they are. Is there anything that can be done to force the prompt to either remain at the forefront until addressed or give the prompt a taskbar presence like applications/browsers/alerts do. Users that lock their device at the end of the day (in their given workspace) rather than logging out/shutting down, have no idea the reauth is open behind the of their apps/browsers at the start of the day due to the pop-behind nature of this prompt. If there is no current solution, is this on the roadmap to fix? If so, when?@sshiflett @rsurya 

2918
E
7 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings