Skip to main content
  • EN

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 158 Topics
  • 402 Replies
158 Topics
A
Anonymous
posted in Private Access for ZTNA
NPA Detailed Architecture

Hi Team ,    Can anyone help me the Detailed Architecture for NPA traffic starting from user device till it access the application including the auth type,Identification, Encryption , tunnel that exist all across the traffic flow.

3811
kvarshney
11 months ago
C
clnicholsonNew Member
posted in Private Access for ZTNA
Communicating to Localhost

Has anyone else had problems with communication failing when running services on localhost or loopback addresses?  I have several developer teams who receive errors when running local web services for testing.  I've added an exception to the Steering Configuration with a Destination Location but that doesn't seem to solve the issue.    

1720
C
11 months ago
aplaza
Netskope Employee
aplazaNetskope Employee
posted in Private Access for ZTNA
Recap: Time to Give Your VPN a Reboot

Curious about how to make the leap to Zero Trust Connectivity?    Discover the limitations of traditional VPNs and learn how to migrate from VPN to ZTNA Next from a Netskope customer—Jeff Wehrman (@jwehrman), Sr. Staff Cybersecurity Engineer, at Dexcom in this webinar recap! The recording, slide deck and a summary of the Q&A can be found below:   Watch on-demand   Q: Netskope is not a total replacement for VPN, which means not supporting server to client flow. How can we overcome this? A: You bring up an important point. Most ZTNAs do not support server-initiated but Netskope ZTNA Next supports both client and server-initiated flows. Q: When within your office, is Netskope Private Access (NPA) engaged or does it go offline? A: Short answer is it stays engaged. The Netskope Client, which steers user traffic, is always on whether in office or remote. It can be configured to steer that traffic to the Netskope Cloud or a local ZTNA Broker ad

1930
aplaza
Netskope Employee
1 year ago
aplaza
Netskope Employee
aplazaNetskope Employee
posted in Private Access for ZTNA
Time to Give Your VPN a Reboot

Tired of outdated VPNs? Discover how to make the leap to Zero Trust Connectivity from a Netskope customer! Jeff Wehrman, Sr. Staff Cybersecurity Engineer, at Dexcom will share how he successfully retired their VPN with ZTNA Next in this webinar.   November 15th - 8am PST November 16th - 3pm AEDT   What you will learn: Hear about the major ways that remote access has evolved over the past three decades Learn deployment lessons from a Netskope customer who has successfully retired their VPN Witness Netskope ZTNA Next in action with a live demo

460
aplaza
Netskope Employee
1 year ago
J
jschueleNew Member III
asked in Private Access for ZTNA
Clientless access to private app

We have an internal AWS hosted app, thats not reachable from the internet, and we need to provide access to an external partner that doesn't have the NS Client. Can I use NPA and configure a new private app with Allow Browser Access enabled to do this? Or, what are other good options? Thx

6111
matt-frank
Netskope Partner
1 year ago
Zulkifal
ZulkifalExplorer III
asked in Private Access for ZTNA
Does NPA support IPv6 DNS servers?

Hello Team, Users can't use the NPA Application when the DNS server is set to IPv6. It appears that NPA can't work with IPv6 DNS queries to match the SRP installed. I found some community posts for MAC OS where users recommended turning off IPV6. Does NPA work with IPV6 DNS servers, or are there any limitations?

3112
Zulkifal
1 year ago
E
elawaetzExplorer III
posted in Private Access for ZTNA
NPA Terraform - failing to loop over multiple maps

I'm trying to build a module (currently just playing with locals directly in main.tf) which will build an instance of a private app. for each DC and tie it to the local publishers in that DC. That part is working, but I am failing to also tie the protocols fields correctly in and iterate over those as well, as the attached code will fail if either of the protocol ports fields are empty (in the case where an app only has tcp or udp ports defined). @sshiflett ?

371
S
Netskope Employee
1 year ago
T
TjhiaSNew Member
posted in Private Access for ZTNA
Netskope Client with Azure AD Conditional access

Has anyone have a setup where you roll out Netskope client to all your endpoints and configure Azure AD conditional access to allow connections to Microsoft services if they come via Netskope IP? we are doing this as part of our own ZTNA setup to only allow trusted devices/location.  The setup works well with one minor problem. Netskope will have occasionally tunnel down/up (e.g. switching from LAN/docked to Wifi, etc) and that causes netskope to disabled momentarily before re-enabling again. (which means momentarily it shows attempting connection from non netskope IP) This then lead to services e.g. teams, outlook etc require authentication immidiately which is not the best end user experience.  Has anyone encounter this and able to suggest solution/workaround? I dont want to change trusted location to country based as that defeat the purpose of the ZTNA we are doing.

6204
T
1 year ago
E
elawaetzExplorer III
posted in Private Access for ZTNA
NPA Terraform Provider - how to query Publisher tags, and how to get to them in the GUI?

I'm using the Netskope Provider version 0.2.5 for NPA to query for a list of Publishers based on a site code.netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform RegistryAccording to version 0.2.4 of the provider, I can filter on stuff in the query:netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform Registry This simple query for site code (=key) works well:data "netskope_publishers" "all" {        for_each = toset(keys(local.datacenters))        filter = "publisher_name sw ${each.key}"} However, I'd like to match also on "tags" which is a list of strings, and I'm failing to get that query right. I have also tried deploying a Publisher with a tag via the provider, but is there any way I can display that tag in the GUI?

1853
E
1 year ago
S
scolemanNew Member III
posted in Private Access for ZTNA
Best Practice for Netskope Private Access - Updating the Netskope Client

It is recommended to ensure the Netskope Client is running the latest Gold Release.   Steps to Maintain Latest Release: Using Desktop Application tools like SCCM/IBM tools OR Use Netskope's Auto-Upgrade option to Latest Golden Release  

1502
matt-frank
Netskope Partner
1 year ago
S
Netskope Employee
sshiflettNetskope Employee
posted in Private Access for ZTNA
Optimizing Identity Provider Settings for NPA Periodic Reauth

Netskope Private Access (NPA) is a Zero-Trust Network Access solution that provides seamless access for users accessing applications.  One of the Zero-trust capabilities within NPA, Periodic Reauthentication, is based on an integration with your enterprise Identity Provider (IDP) such as Azure AD or Okta.   This capability allows the Netskope client to challenge the user via your Identity Provider for credentials and MFA to maintain or activate access to internal applications.  Administrators configure intervals for groups or OUs based on the security posture required.  For example, the below configuration would require a user to authenticate to my IDP every 12 hours with a 1 hour grace period before access would be revoked:   Depending on your enterprise’s security requirements, you may wish to always enforce MFA or specific access requirements.  This becomes a challenge if your Identity Provider caches sessions for a period of time which is increasingly common.  The mini browser used

16386
S
1 year ago
T
Netskope Partner
TiagoBigodeNetskope Partner
posted in Private Access for ZTNA
Problem with DNS

Hi đŸ™‚Â In my laboratory I did the configuration to be able to resolve names.At first it worked, I was able to access the application by name/FQDN via HTTPS, network sharing and gpupdate. It stops working out of nowhere, sometimes when restarting the NPA it starts working again and sometimes it doesn't even restart. I stopped the service, stopped the process, renamed the logs folder, to only have new logs.I enabled debug, reproduced the error and got the logs.I found error message 11001 and several other errors.Has anyone seen this error? Any tips?

6623
S
Netskope Employee
1 year ago
C
csowellNew Member III
asked in Private Access for ZTNA
Netskope ZTNA in Office

Hello, I am noticing that when we have users in office connected to our Wi-Fi on site, Netskope is saying they are remote. Netskope Configuration shows "Private Access: Connected". My current user that is experiencing this is showing an on-prem IP address though. Has anyone experienced this?

1391
Zulkifal
1 year ago
J
jschueleNew Member III
posted in Private Access for ZTNA
NPA & Mac Config Guide

We recently retired our VPN infrastructure and are using NPA for all private apps. I have attached a PDF that shows the configuration changes required on Mac systems for NPA to function properly. This covers disabling Secure DNS, Privacy & Security settings, disabling IPv6, disabling the QUIC protocol in Chrome, public DNS servers. Enjoy 😉

2562
J
1 year ago
farhan
Netskope Partner
farhanNetskope Partner
posted in Private Access for ZTNA
Need specific group of users to use NPA features only and AZURE AD.

Hi team, I have a query regarding the NPA the customer wants to segerate the group of user traffic should be steer in NPA. Like they only want the specific group of users. use NPA services I checked the same in steering configuration option i didnt get it please let us know if we can acheive this use cases kindly find the below questions from client end. Also please let me know what limitations we get in Azure AD license. Like what netskope suggest to purchase the license so we can configure SAML SSO. 1.In AD, do we need create a separate security group for SWG,CASB and add few user in the group and test for couple weeks.2.In AD ,do we need a separate security group for NPA and add few users in the group who will access  

831
J
1 year ago
M
mpochanNew Member III
posted in Private Access for ZTNA
Request for Enhancement for NPA SAML Re-auth Using System Default Browser

Apologies if this has already been requested, but are there any plans to support the system default browser for SAML re-authing for private app access? Right now, whether authenticating via SAML for enrollment or after the time period configured for private app access, we are redirected to our idp via an embedded browser. This defeats the purpose of SSO since it doesn't use the system native browser. If users are already auth'd to the IDP in their system default browser (such as chrome) then launching it in chrome wouldn't require any additional auth, SSO would just kick in. 

810
M
1 year ago
farhan
Netskope Partner
farhanNetskope Partner
posted in Private Access for ZTNA
Network drive access & Auth prompt

Hi team, I looking for a configuration where the user try to access the prvt apps whenever they tried the user get auth prompt for the Pvt apps only please let me know if it's possible to do so as I'm currently doing one POC so i get this requirement from customer end. Also please let us know the configuration to access network drive with the help of NPA.The user access the folders like go to THISPC on upper side bar write //x.x.x.10 IP e.g and access the network share folder I want this to acheive by Netskope I do follow the steps of SMB configuration but required a details regarding this please help me out with this configuration.

3087
S
Netskope Employee
1 year ago
A
AlfaBaneExplorer III
asked in Private Access for ZTNA
NPA policy source: "all users" vs "'Domain Users' AD group"

We recently attempted to set our NPA policies to our "Domain Users" (in our case "corp.alfacompanies.com/Users/Domain Users") group rather than leaving the "source/user=" field empty so it applies to All Users.  After the policies had time to simmer, we began noticing problems withfile shares (likely a DNS or Domain Controller conflict)lost access to the file sharesWindows Security prompts asking for credentialsgpupdate /forcefailed almost immediately due to failure to connectForticlient EMS status failed over to "not reachable"After changing our NPA policies related to domain controllers and DNS back to user=all users (aka empty) and allowing time for the settings to propagate , access returned to normal. That begged the question, why would setting the policy to "Domain Users" create such an adverse issue. In your experiences, if all domain users need access, do you typically leave the "source/user=" field empty?

1404
S
Netskope Employee
1 year ago
agonzalez
Netskope Partner
agonzalezNetskope Partner
posted in Private Access for ZTNA
Network Consumption Publisher

Hello and good morning 🙂 I would like to know how can I get the bandwidth consumption logs of a publisher because in the DEM (Digital Experience Management) in the NPA section it only shows the network sessions but not the throughput.

681
aramachandran
Netskope Employee
1 year ago
edwin_alvarez
Netskope Partner
edwin_alvarezNetskope Partner
posted in Private Access for ZTNA
Enable TCPDUMP Publisher

it is possible to enable the TCPDUMP command in the publisher? I have tried to run it, but it shows me this message You don't have permission to capture on that device(socket: Operation not permitted)

1332
edwin_alvarez
Netskope Partner
1 year ago
P
perregriniaNew Member III
asked in Private Access for ZTNA
NPA Network printer - Help please

Hello, I need to enable the traffic of print queues from a pc client (with netskope client installed) to network printers in the headquarter(already installed with local IP on pc client), can you help me to create a NPA policy?What are the steps to follow?Is there a guide/best practies somewhere?  Thank you very much

4663
J
1 year ago
agonzalez
Netskope Partner
agonzalezNetskope Partner
asked in Private Access for ZTNA
How to get a diagnostic of a publisher by CLI

A customer has several publishers deployed in the AWS cloud, he wants to see the resource consumption generated by the publishers but does not want to see them through the DEM>NPA on the tenant but wants to see them through the command line.How can I see this diagnostic?

1775
agonzalez
Netskope Partner
1 year ago
R
roboflexNew Member
posted in Private Access for ZTNA
Policy Hit Count for NPA

I am looking for a way to look up a way to get a policy hit count, specifically for NPA policies but I can easily identify the NPA policies based on the name.  I would like to know of a way to get a count of every time a policy was hit.  Right now I have to go into Network Events in SkopeIt, export a list of all data for the last 90 days, and then do some Excel Kung-Fu and do a count-if for each policy name.  Maybe something in Advanced Analytics??

901
S
Netskope Employee
1 year ago
A
Netskope Partner
aalves23Netskope Partner
posted in Private Access for ZTNA
Change the users' email domain on netskope

Has anyone ever needed to change the users' email domain on netskope?I have a client that needs to change the email domain, when it changes, the NPA stops working. The proxy service is still OK, but the NPA does not go up the tunnel. It only works again when he uninstalls and installs the client again.

2160
A
Netskope Partner
1 year ago
J
jschueleNew Member III
posted in Private Access for ZTNA
NPA and SSH/SCP Error

I have a private app configured to allow port 22 and users are able to use SSH and SCP successfully. Users are observing an intermittent issue when trying to SSH/SCP into the app and getting this error: kex_exchange_identification: Connection closed by remote host Connection closed by 191.1.1.3 port 22 This error prevents user from starting a new SSH/SCP session, but all existing SSH/SCP sessions are fine when this error occurs. Usually if user retry's ssh after a while, the error goes away.  Is there any kind of SSH connection limiting in the NS Client or Publisher?

3443
J
1 year ago

Badge winners

Show all badges
Terms & ConditionsCookie settings