Private Access for ZTNA

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

Hello Team We identified what’s probably a missing feature for CFW/NPA.https://docs.netskope.com/en/time-based-policies/ are available for SWG but they don’t see to be available in CFW/NPA ? This feature is useful to time bind certain sensitive access for user outside of their working hours.If you have different suggestions on how to achieve the same result please do let us know

Hi team, is there a way I can query a specific publisher’s publisher ID using Rest API? I am looking to automate the creation of private apps with designated publishers. It looks like publisher ID is required when creating private apps with assigned publishers. Thanks in advance! 

Team,I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Shouldn’t the NPA website URL use the local gateway address for egress traffic? It appears the NPA traffic is using the SWG tunnel.  Thanks. 

At the moment, our client they are using their in-house IdP for SAML auth.For connecting other solution through SAML, they require same information as forward proxy described: ACS URL Entity ID (service metadata)But we failed to find SAML Proxy IdP URL and SAML Proxy ACS URL.Does anyone know if IdP URL here is equal to entity ID? All the best,Allen

Greetings,We’ve been excited about enabling the prelogon tunnel feature for NPA for some time now, but have been hesitant to do so without properly securing access by machines via the certificate method outlined in the following article: https://docs.netskope.com/en/windows-autopilot-with-private-access-prelogon/Per this article’s “Generate and Distribute Machine Certificates” section, “This section covers an optional but highly recommended set of steps required for machine certificates generation, signing, distribution and enforcement, which improves security and reduces risks associated with unauthorized access over a prelogon tunnel.”It strikes me that the best practice for prelogon enablement would be coupled with Netskope verifying machine certificates as part of its device classification; I went through the steps of setting up the certificate template in our environment, in addition to configuring the Intune Certificate Connector. However, not long after a third-party assessment/

HI Netskope TeamI was setting up autopilot and NPA, and came across this kb Windows Autopilot with Private Access Prelogon - Netskope Knowledge PortalIn the KB “User Accounts Enrollment and Provisioning with Netskope”, there was linked to https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/netskope-administrator-console-provisioning-tutorial where it reference DIrectory Tool→ SCIM Integration.  However, this info was already EOL. What is the correct steps for “User Accounts Enrollment and Provisioning with Netskope”? thankmunster    

I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Should the NPA web URL use the local gateway address for egress traffic?

We work in our environment with Kubernets Cluster administration in Clouds such as AWS and OCI and for administration we use WSL on our Windows stations (10 and 11) but we have faced connection problems, already validating that connection via Telnet at the Windows layer works, however Not within the WSL, could you help me with this issue?

In preparation for NPA for Android and iOS, we’re facing challenges. we only want to allow/steer the allowed Private Apps in terms of Android and iOS we want the client for reauthentication purposes users leveraging this will be authenticating with the same AD User Names and AD User Groups as they would on their work computers (MS Surface devices) as the bulk of these are personal devices approved/secured for work access, we cannot and do not want to steer, inspect, log any traffic other than Private Apps​@sshiflett ​@smonk 

Have Netskope configured with Microsoft Entra and SKIM provisioning.  I deploy the client via intune.I want some 3rd party users to use Netskope to access some onprem applications.We create them an account in entra bob@acme.com since they don't need email they don't specify an email address.I can manually install the client but it fails when trying to register.  Any thoughts? I don't want to waste a full office 365 license just to provide an email address.  I can put bob@hiscompany.com as an email address but that doesn't work. Does the email need to match the upn? 

If a customer environment only have an AD on-premises for their users, and want to set a MFA whenever their users try to access a private app, can it be configured somehow, or MFA integration witj Netskope is only supported on cloud IdP environments?

We checked and found Local Broker is not officially supported for use in deployments within China and the Kingdom of Saudi Arabia (KSA) yet.https://docs.netskope.com/en/local-broker-management/As planning to implement local brokers for internal access regulation in China afterwards, it will be nice to clarify on how licensing on NewEdge China will be affected in advanced.For the moment, we only focus on remote users, but will using local brokers in China region include all users at office, even though their traffic doesn’t really go through NewEdge China DC? 

Does anyone know of a script that makes the process below easier? 😀 I’d like to automate the process as much as possible. Thanks.  

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

Hi guys I need your help, I’ve created an REST API V2 token and added the relevant endpoints as described in this doc: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/after trying every combination to create a new publisher app with the Swagger UI, I get this response:{ "message": "User Portal App cannot be created.", "status": "error"}what am I doing wrong? 😤

Team,Good morning and Happy Friday.I wanted to create a separate topic from my previous question. :)I'm creating a large NPA subnet for my networking and server teams, which will need access to the same resources.Instead of having 50 different subnets that include all servers, routers, switches, etc. I created the configuration below. I will also enable the use “Use Publisher DNS” option.  Question: Should I include the wildcard hostnames of our internal domains? Below is an example.Thanks again for your input.