Private Access for ZTNA

Despite the shift to Zero Trust, VPNs are still essential… but at the same time work from home resulted in a permanent jump in VPN user experience issues: help desk tickets increased 4.9x since 2019. To learn more about the “why”, we’re taking a deep dive into the impact of VPNs to bring these insights to our community members.We’re running a global survey to quantify VPN usage, cost, and user impact, where participants will receive complete results within two weeks:No personal information is required to participate It takes less than three minutes to complete the surveyA global peer benchmarkParticipating will let you understand where your company stands vs. your peers re.:VPN use, performance and cost analysis Top apps consuming VPN bandwidth VoIP and remote assistance VPN dependencies VPN’s direct & indirect impact on the help desk Take the Survey  and help us illuminate this subject together. Thanks for your help! If you have any questions, please let me know.Scott

My organization has two main regions (USA and India).  I currently have ADDS/DNS servers in both regions.  I have two private apps configured for ADDS.  One of them is directing traffic to the India ADDS servers using the local NPAs, the other is doing the same for USA.I have a prelogin user that has access to both private apps.I also have a DNS private app defined (*._http.domain.local, *._kkdcp.domain.local, etc) but it only uses the USA publishers.With this configuration, our USA users are working fine with very little lag on computer startup and login.  Our India users, however, are experiencing very long startup and login times.My question is, what is the proper way of configuring AD and DNS access for clients when the organization is multi-regional and you want the client to always access the closest ADDS/DNS servers?Some solutions I am considering are:Divide each region’s users into separate groups and give them only access to their local ADDS server.  This however does not solv

Hello Community,My developers use the IntelliJ IDE to develop, as our environment is 100% cloud, we use NPA to access the development environments. We use spring as a framework for our applications.My error is the following for some endpoints I simply cannot connect using IntelliJ and spring. If I do a curl or telnet I can access the endpoint normally, only IntelliJ and spring can't. I have openVPN as redundancy and I don't get this error.Has anyone had a similar problem?Below is a simpler application that I can replicate the errorpackage ConnectivityTest;import org.springframework.http.ResponseEntity;import org.springframework.http.client.reactive.ClientHttpConnector;import org.springframework.http.client.reactive.ReactorClientHttpConnector;import org.springframework.web.reactive.function.client.ExchangeStrategies;import org.springframework.web.reactive.function.client.WebClient;import reactor.netty.http.client.HttpClient;public class ConnectivityTest { public static <Objerespon

Hi Everyone, Have an issue where remote NS clients have the following environment and in this order:1. IPv4 and IPv6 addresses assigned (eg. from home wifi or mobile hotspot)- The IPv6 address assigned (global internet address starts with 2001:xxx)2. NPA Tunnel is established3. Connect to corporate VPN service4. Clients are then unable to access applications via the VPN NPA applications continue to operate successfully but the NS client service appears to interfere with the VPN tunnel. Stop the NS client service and there is no issue with the VPN. Disable IPv6 and the VPN and NPA work successfully, this is not recommended by Microsoft so not really a desirable option. Have tried to configure clients to 'Prefer IPv4 over IPv6' this was looking promising but not producing reliable results. Issue still appears to randomly occur, still testing this. Anyone else experience this issue?

how to enable two-way communication through ztna

hello community!   We are seeing a problem with Google Chrome on macOS where Chrome is not passing traffic to a private app via the Netskope Client. We are able to reach the Private app using other browsers installed on the same system without issue. We can even hit the private app using curl at the terminal and it's working fine with NPA. We have tried clearing browser cache and using incognito on Chrome with no success. Anyone have experience with this issue?

HiI have configured a new NPA browser access for an end customer and we cannot make it work and I don’t know what’s failing, hope any of you can help me.I have configured the reverse proxy account on Netskope tenant, as well as the Azure AD Enterprise application. On the netskope tenant I have also configured a new private application with the browser access enabled, and a real-time policy that allows the users that are also added on Azure’s Netskope application to access the private application. When we have tested the solution, by accessing the application via browser typing the “public hostname” of the private application as the URL, it is redirected to Azure to authenticate the user, and the authentication works fine.After authenticate the user, the browser is then redirected and we can see that it is finally redirected to the customer private host FQDN (which is not published on the Internet), so users can only access to the application via browser access when they are on-premise

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

HiI have an internal application accessible by PublisherA and PublisherB which are deployed in different location.If PublisherA failed to access the internal application while PublisherB was able accessible, does my client will still try to connect to PublisherA?thank

So i configured a test private application to use HTTP browser access. FYI, the the app is hosted in our AWS environment and uses an auto-generated Amazon certificate. After enabling developer tools in my Chrome browser it clearly shows the session is still using TLS encryption. The only thing visibly different by enabling HTTP vs HTTPS in the private app configuration is it adds 80 to the unique URL name. Everything else appears to be encrypted. Can you explain in more detail what the difference between configuring HTTP and HTTPS?

Hi All,How would Netskope detect if lets say a compromised machines is uploading malware in the payload towards the server or lets say ho their stack is detection Remote File Inclusion, Remote Code Execution ,Cross-Site Scripting ,SQL Injection etc for NPA connection.

In cloud security, staying ahead of potential threats is crucial. As organizations continue to embrace cloud technologies, ensuring robust security measures becomes increasingly complex. To address this challenge, Netskope is proud to announce an exciting new integration, empowering users to proactively safeguard their resources across hyperscaler environments like never before.Introducing the Integration of Wiz Webhooks with Netskope APINetskope, a leader in cloud security, has partnered with Wiz, a renowned cloud security platform, to introduce seamless integration of Wiz webhooks with the Netskope API. This collaboration enables customers to leverage real-time insights from Wiz's comprehensive cloud security platform directly within Netskope.Proactive Policy Enforcement for Hyperscaler ResourcesOne of the key highlights of this integration is the ability to create dynamic policy changes in Netskope based on vulnerabilities detected by Wiz for your AWS, Azure, and GCP resources. By h

Hello,I’d like to create a new NPA policy via REST Api.I wonder if this part is needed:"rule_order": {                          "order": "top",                          "rule_name": "api-policy-managed",      "rule_id": 1,                          "position": 5                        }I don’t know the “rule_id” as it’s not created yet. Could I just skip it?What is default order for newly created policy within provided "group_id" and "group_name"?What about other parts like "dlp_actions", “privateAppsWithActivities”, "net_location_obj", "srcCountries"  - should be skipped if not needed? Best regards

Hey there,This might sound silly (because it is), but would it be possible to have a different icon color when private apps are disabled ?ie: having a more orange-y color when private apps are disabled, so users can know they need to re-auth (instead of showing a green dot that implies “all is good” when it is actually not).Cheers

Where is the recommanded location (DMZ or Server zone) to implement the publisher in the firewall protected environment? All the port need to be opened to the back-end servers on the firewall?is the traffice flow is correct?End-users → tunnel  →  publisher -->(open all required ports on the FW ) → App servers

Hi there,We have created apps definition with FQDN and PQDN, but we are able to access the application with FQDN and not with PQDN. We have DNS Search Domain update from DHCP which is correct domain and also edited the 51-cloud-init.yaml  file with the correct domains in publisher. But still access with PQDN doesn`t work.Does anyone has any idea what next can be done? I have already raised Netskope Support, but would like to quick resolution if anyone has faced this issue.

Netskope is not compatible with Google or Cloudflare public DNS servers (8.8.8.8, 8.8.4.4, 1.1.1.1). This is well known and prevents resolution by NPA for all our configured private apps. Based upon our testing (and trial and error) the following public DNS servers are working with NPA for our users and we must update our fleet of Macs as needed.Comcast (Xfinity):  75.75.75.75, 75.75.76.76AT&T:   68.94.156.1, 68.94.157.1Frontier:  185.228.168.168, 185.228.169.168Quad9 Public DNS Servers: 9.9.9.9, 149.112.112.112Fortinet Public DNS servers : 208.91.112.52 , 208.91.112.53 I would like to suggest Netskope maintain a list of known good public DNS servers that work with NPA. This would include updating the list when necessary, due to services not working anymore, etc. In a Work From Home (WFH), traveling, or foreign work force environment, we consistently run into problems with access to private apps due to this issue.   As a final resol

What is Azure Private Endpoint? Cloud Security Architects often make use of “Azure Private Endpoints” to enable access to Azure PaaS services. There are many Azure PaaS Services that supports Private Endpoints e.g., Azure Storage, Azure App Services, Azure CosmoDB, Azure SQL Database, etc. This eliminates the need for the service to be publicly accessible. Access to these private endpoints use Microsoft backbone network without ever going over the public Internet. Private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.   When you bring your Azure PaaS services into your private virtual network all traffic to the service is now routed through the private endpoint and traffic remains on the Microsoft global network. In this architecture and design,

Hi everyone We are deploying single session Azure Virtual desktop and are in design phase where we will put the Ztna agent into the session host so user can have access to private network (on prem). The network infrastructure (in azure and firewall) already in place and our job is to installing agent and start testingWe would like to know any best practice of how ztna agent is working inside Azure virtual desktop, anything we need to consider? Also another challange we got with Ztna agent is that the Ztna team will also install the agent in our SoE laptop. That should be fine but we would need to whitelist all AVD gateway address .so that the AVD client can connect to Azure virtual desktop gateway in the cloud. So far based on microsoft article they recommend to whitelist all *.wvd.microsoft.com but the Ztna team is only happy to whitelist based on IP addresses which pose the risk as the IP address of AVD gateway will keep changing and we may run into the risk of Soe Laptop cannot conn

Hi, I have two local publishers that I use to maintain remote access to Windows PCs in my office. Unfortunately, the users have been complaining nonstop about slow connection speeds and instability issues. It doesn't seem to be a port issue because the problem still occurs even when all ports are enabled. Can you please help me resolve this? 🤔 🤔

Hello, I've been using NPA successfully but I am noticing quite a lot of tunnel down events from several users, a couple events are caused by the device hybernation which we could somewhat address it by disabling the modern hybernation via GPO but the tunnel down remains and NPA does a very poor job on providing more details on what could be the reason for it. How can I get more details about those events? Also, how can I get these events on a report? it would be very valuable for us to have a widget of sorts with top 10 problems, I need to be the first one ot know if a user tunnel is failing to establish. Thanks.

Hello, I have a problem with the resolution of short names on NPA.Access to my FQDN resources works perfectly. But with the short name, the resolution doesn't work.I have a private app DNS with host "*.mydomain.local" and port 53.Resolution works perfectly on my publishers.My network openings are made on the firewall side.But despite all this, I have the impression that the client is trying to resolve via public DNS rather than my local DNS, even though these are correctly configured in the publisher's revolv.conf (as is the domain name). Do you have a suggestion?Thank you

Is it possible to use the option "re-authenticate for private apps" from CLI in linux?I know you can use the stAgentCli to check its status with show-pa command but I would like to make a command in my personal computer to auto-login into the vpn

HiI have installed win10 agent in office thru our legacy proxy.    I can see that the network was steered to nsk when in office, however NPA was having error I have reinstalled, enable traffic bypass  in legacy proxy and firewall but the error persisted.  If I installed via public wifi, NPA was successful.What is the log I should start tracing this error?Thank

Netskope Private Access now consumes NewEdge Traffic Management 2.0(GSLB) for optimizing the DC selection for Client as well as for Publishers. Customers can take following advantages with this feature,  DC selection is no longer DNS There is no dependency on Google DNS or LDNS for POP selection (the last hop recursive DNS resolver). APIs are hosted within existing allow listed NewEdge IP range, no additional network changes needed.  Improved granularity for geolocation of public IP egresses. DNS-based methods (EDNS/ECS0/Google DNS) can only utilize a /24 of the public IP. The GSLB service can better geolocate as it has the entire IP address /32 instead of a /24 advantage for gateway selection. DC selections according to geographic distance, with in-country preference. For example, if an endpoint in the south of France is very close to Barcelona, the Netskope Client will prefer a DC in France, even if it is physically farther away than the NewEdge Barcelona DC. New