Private Access for ZTNA

Hello,I would like to know if it is possible to allow copy and paste when using ZTNA in browser access mode.If yes, could you please provide guidance on how to configure it?Thank you 

Some of my users are reporting errors when trying to connect to a SQL Server over NPA. The connection is successful but is erroring out due to a cert trust issue: The SQL server has forced encryption turned on; I have verified that the remote host is able to connect over the required ports.Is there another configuration that is needed to allow NPA to work with SQL Server Forced Encryption, do I need to deploy the Netskope Cert to the SQL servers? 

Refer to case 00555037. The main reasons we have this requirement is because our IdP domain myid.ladwp.com is within the App Discovery list *.ladwp.com (which allows users access to all internal hosts within this domain). However, the problem is that NPA is steering this myid.ladwp.com domain as a Private App, which causes Okta admins to always see the gateway IP as on-premise. Okta administrators need to see the XFF/Gateway IP. So if a user is working at home or from a remote network, Okta Admins should see that remote network XFF IP address, not our DWP public IP address. When Okta evaluates the IP chain, it uses this XFF IP address to determine whether or not to MFA challenge. At the moment, a remote user always appears to be on-premise from Okta's perspective. This is a problem that we'd like to solve. Hoping you can provide a way to perform NPA bypass similar to how there is steering bypass for SWG/CASB/CFW. Another strong use case is when on-premise detection feature is used, in

I searched and had a hard time finding much on this, but basically, I am deploying NPA across my organization and some server admins (notably using Macs) have run into hostkey mismatches when SSHing into servers behind NPA. Does anyone have experience, specifically, with managing SSH host keys to servers when migrating to use NPA?

Searching the forums and I couldn’t find an answer. We have the need to print, to on-prem printers (via a print server), for remote users.I’ve created the Private App for the Print Server with the following portsTCP 135,137,139,445,631,9100UDP 135,137,139,445,631,9100But it doesn’t seem to be working. Although management (via mmc) of the print server is fine.Any idea?I don’t think I need to create a Private App for the printer(s) themselves, since the Print Server should be the connection manager / proxy for that traffic.

How can i access private applications using enterprise browser? I tried creating a realtime policy with “access method” as one of the criteria but couldn’t find enterprise browser in the option. additionally i tried to create an enterprise browser protection policy for private apps but the option is grayed out.

I think that it would be helpful to have a button (or something) to do a SSH to the publisher directly from the tenant.

Good evening, everyone, I will be using the steering “Specific Private Apps” in my dynamic steering configuration. I usually steer all private apps, but I have a use-case for one application for my on-premises users. Do I need to add the private app to a real-time policy for this to work? It looks like I only need to add the specific private app to the steering configuration. See attached screenshots. Thanks. 

We would like to control the Private application (Client based access) with Time bound & Geolocation for the users.The Client based Private application defined policy doesn’t have the source IP as match criteria for identifying the users Geolocation. The Private Application policy doesn’t have the policy schedule option like the Cloud app or the web access policies.We are expecting whether this can be achieved with the Netskope or addressed by Netskope in the future releases.Thank you.

Hello Netskope Community, we want to use netskope on a azure virtual desktop environment which uses FSLOGIX.But sadly we don’t get it running. We configured the installation of the client in the golden image with the multisuser modecommand:tenant=igz domain=de.goskope.com installmode=IDP mode=peruserconfig enrollauthtoken=*token*enrollencryptiontoken=*token* autoupdate=on /qnthere would be a npavdimode as well but as far as I understood this mode is only needed when all  users should use the same tunnel on the vdi.We want that the user on the vdi needs to logon to the client with his azure user, so he has his personal tunnel up with his own private app permissions. On the first logon on sessionhost A it works without any problems.If I relogon and get on sessionhost B my npa will not connecting anymore. We think that on the first logon my client genereates an encryption key to safe the client settings. And on sessionhost B this wont match anymore.we are getting the following errors in t

It would be great if Multi Factor Authentication Integration will be provided for Manage Engine. Our corporation is using Manage Engine for multiple applications for Multi Factor Authentication. If Integration of Netskope for Manage Engine will be supported/ provided, then we would be leveraged to use the same solution for Multi Factor especially for NPA. For NPA all forum & Garner suggest for enabling multi factor for best security strategy. 

If I look at the instructions for configuring prelogon, then this seems to require a reinstall of the client with the correct “prelogonuser=<user>@prelogon.netskope.com” command line parameter.The “nsdiag” command does have a few extra things up its sleave, including update of the secure enrollment tokens.Is there a (hidden) option to also allow adding a prelogon user to an already installed client? --Erik

Hello all,I’d like to check if someone recently enabled the Session Recording feature in Browser Private Access.Additionally, could someone please explain how this feature works and what exactly is being recorded?  Thanks in advance 

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

Echo on this requests 2 years ago, Netskope finally officially shared this feature lately on knowledge base. However, we haven’t seen it is available yet.Has anyone tested this feature yet?We would like to see if we can block file being downloaded from private application to client-installed endpoints installed, or does anyone have other alternatives to do so? Add Threat Protection for Private Appshttps://docs.netskope.com/en/create-a-real-time-protection-policy-for-private-apps/#add-threat-protection-for-private-appsNetskope One Private Access (NPA) allows organizations to apply Threat Protection to web traffic (ports 80 and 443) for private applications, ensuring files are scanned for malware in real-time. When using Threat Protection with NPA, note that this feature:Requires Client as the Access Method. Scans all web traffic on HTTP (80) and HTTPS (443). Applies real-time scanning to protect private app access from malware and other advanced threats.Netskope One Private Access now a

Hi Netskopers, For those of you which have published Active Directory via NPA, using the following guide...Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge Portal The Windows client can then always connect to and authenticate with AD (since its always available via NPA). Due to this, Windows is always applying the less restrictive Domain Firewall Profile even when the remote device is connected to an untrusted network (home wifi, public cafe etc). Normally the more restrictive Public Firewall Profile would be applied. Is this a concern for others?Have you solved this somehow?Are there any other options other than make the Domain Profile more restrictive.

I have configured Dynamic Steering.Here are the steps I took: In the Client Config, I specified the internal web server (192.168.10.156). In Traffic Steering, I enabled the Dynamic Steering option. However, after completing the above configurations, when I check the configuration of a server located in the same network as the web server set in step 1, it shows On-premises check: Remote.Could you please advise on how to resolve this issue? Step1  Step2  It shows On-premises check: Remote 

Looking for any information about how to best configure steering for private app access when DNSSEC is enabled on the on prem DNS servers, or if this is even possible.  I have verified my NPA publisher is able to query DNS and get proper RSIG response. However remote clients do not get a valid response from the domain even with the Netskope suggested Active Directory configuration from: Netskope Private Access for Microsoft Active Directory Domain Services - Netskope Knowledge PortalAll nslookups come back as unsecured and Non-authoritative

ZTNA is not functioning as expected.Here is what I have done so far: Built the Publisher Registered the Private App Created an RTP policy   2.Here is the configuration of the private app I created.3.Here is the configuration of the RTP policy I created. When I performed troubleshooting for the Private App, I encountered an error.However, the publisher status is shown as "connected."What could be the possible causes? Here is the error message.  Here is the status of the publisher: it is showing as "connected". 

Check how the VNC application works through Netskope. Can this application be included in Private Apps to connect via remote desktop to user machines?

Howdy!I'd like a breakdown of how publishers make the best determination for traffic that is routed through them. I understand that you need a publisher CLOSET to the source of what you're trying to connect to (destination) however, there isn't anything that prevents me from adding ALL my publishrs to a private app. If I do this though, what happens exactly during the publisher selection? how does the traffic decide what the most efficient route is? What is the logic behind this routing? Also if there’s a “publisher” doc that I just haven't found that someone has, I’ll accept that as well :)  thanks!  

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated?