Private Access for ZTNA

After enabling Browser Access for an app behind NPA, is there a way to enforce session limits? Thx

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

HiWe are unable to access website, checked alerts and found connection was dropped as no publisher is active.

Hello,So we have installed Netskope client on one of our endpoints and during the enrollment process we got an error “ Configuration failed to load” Can anyone let us know the root cause of the problem and its workaround.Thanks. 

In a standard scenario for a Dial-up IPSEC/SSL VPN-RA we have:A DHCP IP-Pool is set up on the VPN Gateway to assign IP addresses to clients. The DNS resolver is also configured, usually using the Active Directory (AD) DNS for these assignments. The internal/remote networks that will be advertised in the VPN clients' routing table for split-tunnel access are defined.By default, a Windows interface has NetBIOS over TCP (ports 137/138) enabled.So, when connecting to the VPN, a typical SMB access like \\AD-Domain\C$ (using ports 445 and 139) for file sharing works successfully. In other words, with the old VPN model, resources can be accessed without much firewall configuration or concerns about application ports or DNS resolution.In a ZTNA/NPA environment, I’d like to better understand the precautions I should take in the same scenario. Here, we have a remote machine properly joined to the AD Domain. When it connects to the VPN, it receives its internal-use IP and internal DNS. With this

hey all,How to create device classification based on Netskope private app registry value? attached screenshot i want to monitor on these value when private app is connected value device will be managed . thanks

I'm doing a deploy of NPA across my environment and hitting a series of snags.  The issue seems to be related to my Mac users having issues with DNS resolution or pages loading failures.  These are largely my SaaS based SSO apps but they can be anything.  We are using Duo Security for MFA but that has been added as an exception.  The problem is intermittent.  Some users experience it all the time, I only experience it periodically though it used to be all the time for me too.  All users are in the same Steering Configuration.   We are all using MacOS Ventura so this may be related to the bug from last year.  

When some users are at the office, every now and then they become unable to access private apps Chrome simply hangs.When that happens, if they disconnect and reconnect from Wi-Fi, the issue is fixed, until it breaks again after a few hours/minutes.This doesn't happen when they are working from home.

Hi,I have a question (or two) about netskope publisher auto update feature.Does this auto-update feature only work i.e. kicks in when there’s a new version of netskope publisher? assuming I set it to latest update on weekly basisLet’s say I’m on version 117.0 and there’s a new version 118.0. This will get updated to 118 during whatever time I configure the auto update.If there’s no new version of netskope publisher, will it still update the underlying OS/system packages?Thanks 

How to Troubleshoot on private app access for slow connection or unaccusable applications for users (randomly) ? We don’t have DEM advanced license .What kind of tools or options do I have in order to troubleshoot on a slow connection to private apps? I am familiar with :The NPA Troubleshooter Tool Export logs from the client when slowness for private applications occurs.

We are having an issue where user can`t access a private app via publisher and we have checked all the configuration is correct in Netskope Tenant and the same has been confirmed with Netskope Support engineering as well.However, we can telnet the same application on the same port from publishers itself.Both publishers and private applications are on the same subnet.  When we run a TCPdump on the publishers we can see SYN packet from user`s machine is reaching to the publisher, but publisher is not getting SYN-ACK packet from the private applications. There is no firewall blocking it as publishers and private apps are in the same subnet. Let me know what your thoughts on this. 

Hello,We are observing a problem with on-prem detection enabled in client config with NPA.Exceptions are being done on the cloud proxy side instead of the client. We have multiple exceptions configured whereby user traffic must originate from our office IPs due to whitelisting requirements.We are now on R117.0.2.136.It has been indicated that Netskope were working on a feature which would allow customers to choose if exceptions should be done at the client or cloud for BOTH on and off prem.Is anyone aware of the status of this feature?Regards,Simon

What is NPA best practice when it comes to restricting access to home network ranges? Naturally we first thought of creating an RFC 1918 sinkhole app using port 10, however this would restrict access to internal apps as well. If we just carve out and allow our own internal ranges, while sink holing those ranges we don't use, we still allow users access to any home network ranges that are identified as internal. How are other people handling this?

Google Workspace - IDP Client - Google AuthenticatorHello good afternoon community, I hope you are very well.I have a question, regarding the use of MFA or a two-factor authentication for users with the following case:Users with IDP mode installed - Provisioning users to Tenant with Azure-AD . SAML Proxy for IDP - Google Worskpace.Now if a customer wants or needs that apart from the enrollment via IDP, in this case Google Workspace, reauth must be applied at Private Access level so that every so often it performs the reauth.Now thinking if the customer wants that when this reauth occurs, in addition to validate the Google Workspace credentials, use Google Authenticator, this configuration is not specific to Netskope, but in this case the Google Workspace itself? Is this correct?Thank you very much community for your time, advice and collaboration.Best regards

how to automatically disable agent npa tunnel, when endpoints are in company internal network?. It is necessary that when the endpoints are in the internal network of the company, and the endpoint needs to connect to the internal web applications, these are not encapsulated and the traffic is not sent to the netskope cloud. If not, the traffic must go directly through the internal network.How does netskope manage to do this, because it has been tested and found that the netskope agent for https always tunnels traffic to the cloud, so for intra-enterprise web applications you will never be able to access it directly.  

Hi team,I´d like to know if it´s possible to modify the keepalive time interval between publisher and private app?Thanks in advance!

IntroductionNetskope Private Access is a Zero-trust Network Access (ZTNA) that provides secure access to internal applications on behalf of your users.  I focus pretty heavily on NPA in my day to day engagements and some of the most common questions I receive are on how the individual components of Netskope Private Access actually operate and route traffic.  With that in mind, let’s take a look at the high level components of Netskope Private Access.  As a quick note, while NPA does support both client and clientless access methods, this post focuses solely on the client based flows that occur on devices with the Netskope steering agent installed.  It should also be noted that this flow applies to a remote user and flows for on-premise users will vary depending on your Netskope configuration.  The abstracted flow for client based flows is below starting from the left side with a device with the Netskope agent installed all the way to the application via the Netskope Publisher on the ri

As we built out our Private Apps, we never leveraged the wildcard entry for domain for our corp environments (ex - *.randomco.com , *.corp.randomco.com) . While looking over community posts related to “npa” “wildcard” and documentation from our former NS engineer, I found a few mentions of leveraging the wildcard entry for access to PC’s, servers, RPD for support, streamlined PQDN access/connectivity. That being said, I believe this will solve a lot of our headaches in terms of how granular some of our apps have become. We essentially had our ISFW admin do a 1-1 buildout of ISFW rules as a base for our Private App library.What I need clarification or “best practice” on, though, handling the ports/protocols.Do you typically go with a 1-65535 entry for TCP/UDP for this use-case? Note: there are concerns internally that such a wildcard entry would create a sizable security hole.@sshiflett

HiI have been able to configure the NPA periodic reauth and the flexible dynamic steering in my netskope settings, but I’d like to “combine” both of them and I’m not sure if that’s possible.I mean, I have configured the dynamic steering so the users Netskope Client will steer traffic to private apps only whten they are off-premise, and the client will disable for private apps when they are on-premise.I have also configured the Periodic Reauth for NPA in my client configuration settings, so it asks for reauthentication after a period of time, but I see that this Periodic Reauth asks for the reauthentication no matter if the user is on-premise or off-premise. As I want the client only to steer traffic to private apps when off-premise, I’d like also that the Periodic Reauth triggers only when the user is off-premise, and not on-premise no matter how many time has passed since last authentication.could this be done? It seems that the Periodic Reauth is a “global” setting and don’t take int

I'm new to using Netskope Private Access and need some guidance. I want to monitor and review authentication and authorization logs/events info for the applications accessed through this service.Could someone provide detailed steps or direct me to the relevant sections in the Netskope admin console where I can find these logs?Any help would be greatly appreciated!Thank you!

Problem Statement:ZTNA requires that all application objects are uniquely and explicitly defined. In large organisations, IT Security teams often do not have insight into all the applications used by business users and neither do they understand which users should have access to these applications.Use Case:Leverage robotic process automation to enable business led application onboarding. Provide a form to business users enabling those users to request a new application. After an approval flow, API’s are then leveraged to provision the application objects in Netskope with the relevant access granted. Proof of concept:The idea is that any business process automation tool like, Microsoft Power Automate, BMC Helix, tine etc. can be used to assist companies to achieve this use case. I leveraged the community version of n8n to build a simple proof of concept and provide insight into how this type of process can be used to simplify the implementation of a zero trust network access strategy.De

Hi Netskope family, i’m testing differents options to integrate the users un policies (such SCIM, AD, etc) and i have a question realted with OU’s and groups from the on-premise AD.I have configured an on-premise AD and i have integrated the groups and the OU’s in real time protection policy (and it works fine) but my question is, do you know if exist any method to delete from the Netskope tenant the OU’s and groups? Its easy to implement them, using Netskope Adapters tool (installing the tool into the AD), but i didnt found any method to delete the AD, OUs and groups from the tenant. Do you know if you can do throught the API? To clarify, i want to delete the AD that i have installed, from the Netskope tenant. Is it possible? Thanks in advance!Best regards, 

Hi everyone,   Is there a way (prefer. registry key) to determine is a Netskope Client install was single user (default) or multi user mode? This would help in "cleanup" of messed-up installs.   Best regards,   Etienne

Hi All, I am new to Netskope.  We are running Netskope as a VPN solution. Can you run another VPN solution on top of this without affecting Netskope.Like Cisco Anyconnect.

We are expanding our NPA footprint soon. Several of the users that are about to gain NPA access use the Ivanti Management Console (remote management console) on a daily basis. Attempting to log into the console results in the following error:  Console Initialization Error:  Unable to connect to the database.A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: TCP Provider, error: 0 - No such host is known.).We have Private apps created for this host and IP already.  Has anyone else configured this successfully for NPA access?