Skip to main content

Private Access for ZTNA

This is a discussion board on Netskope Private Access, a cloud-based zero-trust network access solution that provides fast and secure access to private applications that are hosted in public clouds or enterprise data centers

  • 181 Topics
  • 468 Replies
181 Topics
qyost
qyostExplorer III
posted in Private Access for ZTNA
Publisher - Deploying a Fleet

I have a single publisher that I've configured and deployed as an initial investigation of the configuration. Is there a recommended way of capturing all the customization that was necessary to get it working in our environment? I can certainly go back through our support cases and gather them, but that would likely require applying the config modifications on each new host individually. As we look to roll out a fleet of publishers, manually entering these configurations on each device could be significantly slow our rate of depoyment.

470
qyost
D
dmonroeNew Member
posted in Private Access for ZTNA
Private Access suddenly stops working

We've had success implementing and increasing adoption of Private Access over the past 3 years. But, 1-2 users weekly report Private Access going down. Suddenly their Netskope Client stops routing network traffic including DNS and IP. To resolve we uninstall and reinstall of the Netskope Client. We have created several support cases but support suggests to uninstall and reinstall the Netskope Client which we deem a work around, not a fix. Trying to determine if its something we are doing wrong or a problem with the Client. Anyone experiencing similar issues?

5840
C
bruna
Netskope Partner
brunaNetskope Partner
posted in Private Access for ZTNA
upgrade Publisher Docker azure

Hey, I would like to know if anyone has had any problems with netskope azure upgrade, improved through marketplase. I try to update and get a docker image error context deadline exceeded (Client.Timeout exceeded while awaiting headers)

910
bruna
Netskope Partner
bruna
Netskope Partner
brunaNetskope Partner
posted in Private Access for ZTNA
upgrade failed azure

Hi, I went to upgrade two azure publisher, and got a return of ne error Publisher image update failed: status 1 existsHas anyone ever experienced this?

890
bruna
Netskope Partner
xavy2310
Netskope Partner
xavy2310Netskope Partner
posted in Private Access for ZTNA
Publisher for NPA

I need to deploy a Publisher for NPA. I would like to know if I can use RedHat to install the VMware ESXi OVA.

1060
0
Netskope Partner
C
CuriousExplorer II
asked in Private Access for ZTNA
CRL Checking with Pre-Login Tunnel

Hi Everyone, Am wanting to enable CRL Checking of device certificate for Pre-Login tunnel. I want to ensure the CRL in the certificate of the connecting NPA client will be available for verification but I'm unsure of the source doing the verification. The docs are not detailed enough. Where will the CRL Checking request originate? Will it be our management plane or the one of the many NPA Gateway's the client may connect to or some other component (eg. Stitcher)? Thank you

1410
C
S
scolemanNew Member III
posted in Private Access for ZTNA
Private Access - How to Upgrade the Publisher

Steps to Update Your NPA Publisher SSH into the Publisher you want to upgrade. On the Publisher option menu, select Upgrade , and then select 1 to initiate the upgrade. The upgrade should take around a minute. In the Netskope UI, go to Settings > Security Cloud Platform > Publishers . Locate the Publisher you just upgraded on the Publishers page to confirm it has a Connected status. The full support article can be found here: https://support.netskope.com/hc/en-us/articles/360042838534-Upgrade-the-Publisher Credits: Private Access Virtual Team Members

8020
bruna
Netskope Partner
bruna
Netskope Partner
brunaNetskope Partner
posted in Private Access for ZTNA
Erro net/http:TLS handshake timeout

Hello friends, Someone has already had the problem of adding an application in bypass .. accessing this application in the cloud is via CLI , when accessing I receive this error when the client is active and NPA without NPA active, only the client passed the err "an unknown error occurred I noticed some errors without debugging NSCom2.cpp:1850 NSCOM2 message INST_CERT_IN_FF sent from server to "nsClientUI_s2" client with count 1 stAgentSvc p1404 ta9c error registry.cpp:160 registry RegOpenKeyEx failed, err: 2 stAgentSvc p1404 ta9c warn proxy.cpp:155 nsUtil Failed to auto detect proxy or download PAC file, error 12180 stAgentSvc p1404 t3a4c info fileUtil.cpp:83 nsUtils failed to open file for reading: C:ProgramData etskopestagent/data/authtoken.pem, err: 2 stAgentUI p117c t3374 error NSCom2.cpp:1527 NSCOM2 client socket connect failed 10061 Does anyone know what could be going on? The above path has been added to the antivirus exceptions list

10360
S
Netskope Employee
S
shoke223New Member
posted in Private Access for ZTNA
Excluding users from NPA

Hello all, We are at the tail end of our Netskope deployment and having some hesitation with rolling out to one department. This department has users that work remote on company issued devices and have to complete an RDP connection to a device on-site. We've tested eliminating the need for the RDP connection with NPA, however the files they need to access are quite large (2GB +) and are located on an on-prem server. When they have used our VPN or NPA it can take upwards of 20 minutes just to pull down one file. We want to have our SWG policies apply to this group, but not have NPA active for them. I've tested creating policies to block NPA access, but that creates an unnecessary amount of noise for the user. I'm hoping someone can point me in the direction of how to disable NPA for these users prior to deploying the agent. Thanks for the help!

1750
rmanley
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
posted in Private Access for ZTNA
NPA configuration

The client is migrating virtual servers and the NPA publishers are located in them. The query is where I can change the name of the network card because it does not allow me to modify the value and it is necessary to clone the equipment and make it functional.

690
S
Netskope Employee
S
Netskope Employee
sartioliNetskope Employee
posted in Private Access for ZTNA
Disable Edge Embedded DNS Resolver To Fix DNS Over TCP NPA Issue

As for today NPA on NSClient doesn’t capture DNS requests sent over TCP 53 unless “Publisher DNS” is configured in the Private Application. Netskope is aware of this limitation and we are working to support it in the future. This means that for the time being for Private Applications that are not configured to use “Publisher DNS”, if the initial DNS resolution is performed over TCP 53, NPA will bypass the DNS resolution resulting on the NPA Application to fail to work. Despite the general recommendation is to avoid enabling/using DNS over TCP (TCP 53), this often depends on the DNS resolver, and unfortunately certain applications rely on their own DNS resolvers instead of the OS one. Recently we verified that Microsoft Edge uses an embedded DNS resolver that, even when configured not to use secure DNS (DNS over HTTPS), it still tries to use DNS over TCP if possible, breaking NPA. In order to ensure Microsoft Edge will use the OS DNS resolver it’s possible to configure locally or throug

16020
S
Netskope Employee
B
bhasinvineyNew Member III
asked in Private Access for ZTNA
Use Client Re-authentication for Private Apps Feature

Hi I am facing issue in my laptop having the Re-authentication for Private Apps feature enabled every 24 hours. Unfortunately there is no re-auth pop-up coming when these 24 hours expires. I have no indication from the Client whether I need to re-auth now to access the Private Applications. This is hindering my day to day work. I have also checked it with my other colleagues and facing similar issue. The documentation says that "If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access" which is not happening.

6630
zthompsoncr
Netskope Partner
R
robin_koenigNew Member
asked in Private Access for ZTNA
Documentation / Guide for Pre-Logon NPA

Hi everyone, I'm currently looking into possibilities that Netskope offers us to depreciate our current VPN solution. One of them being the Windows deployment via Always on VPN, I figured that the Pre-Logon NPA might come in handy. Unfortunately, I couldn't find anything regarding this in the docs nor the community forum. I'd greatly appreciate any help.Best regards

5130
M
Netskope Employee
bruna
Netskope Partner
brunaNetskope Partner
posted in Private Access for ZTNA
Troubleshooting Publisher - NPA

Hi, I set up a new contingency publisher for the priv app, ran troublesshoint on the tool and everything is fine, no problems. But I can't access priv app,ran a curl , and got an http 500 return.We are not using DNS in the browser. Has anyone ever experienced this ? Or do you have an idea why?

2400
bruna
Netskope Partner
bruna
Netskope Partner
brunaNetskope Partner
asked in Private Access for ZTNA
NPA latency

Hey, Can anyone tell me if there is any limitation on the use of the NPA, number of users... traffic support. For a few days I have been experiencing a slowdown problem in the app and web after adding more users to the NPA.

2310
matt-frank
Netskope Partner
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Private Access for ZTNA
Doubts with NPA Web browser Private Access - SAML Azure AD

Doubts with NPA Web browser Private Access - SAML Azure AD Hello community, as always, many thanks for your comments, advice, recommendations and your time. I have currently configured in our Tenant for user synchronization with SCIM, from Azure AD and I have SSO for Admin console access, using Azure AD, everything work OK. Now I have a huge and big doubt, I understand that for user Private Access via Web i.e. Clientless, a SAML - Reverse Proxy account must be configured. That's my big doubt: I am looking for documentation that supports this configuration, ie Private Access Web browser access with SAML - Reverse Proxy with Azure AD, but I have not found, I have only found for Okta, among others, but with Azure AD nothing. Configure Browser Access for Private Apps: https://docs.netskope.com/en/configure-browser-access-for-private-apps-378561.html#:~:text=for%20Private%20Apps-,Configure%20Browser%20Access%20for%20Private%20Apps,-Browser%20Access%20is Reverse Proxy: https://docs.netskope.

3810
Rohit_Bhaskar
Netskope Employee
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Private Access for ZTNA
Netskope Private Access- Client Update config time interval

Netskope Private Access- Client Update config time interval Hello good evening, I hope you are all very well. I have a question, I have been searching and I have not found anything regarding the autoupdate interval of the Netskope client configuration, when changes occur e.g. changes at NPA level, e.g. new Publisher, new Private apps, private access policies. I have even been timing, because I understand that this is not 100% manual or yes ?. Could you tell me automatically when it takes the client to automatically perform the udpate of the config, when there are NPA adjustments. I have been timing the client, and in 35 minutes elapsed the client still does not update the NPA config by itself. Thank you, I remain attentive Best regards

2560
MetgatzNK
Netskope Partner
B
barrycuda72New Member
posted in Private Access for ZTNA
Private App with Browser access

I am following the steps in the documentation to make apps available from the browser. Configure Browser Access for Private Apps (netskope.com) If It uses standard port 80 it seems to work but 443 or any other port I get this error message. Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

6890
S
Netskope Employee
bruna
Netskope Partner
brunaNetskope Partner
posted in Private Access for ZTNA
Use NPA with logical condition

Use NPA with logical condition Good afternoon everyone. Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type. Example: The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network. Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

800
NicolaScand
Netskope Partner
MetgatzNK
Netskope Partner
MetgatzNKNetskope Partner
posted in Private Access for ZTNA
Private access - NPA Threat Protection Inspection Apps - Policy

Private access - NPA Threat Protection Inspection Hello good afternoon, as always thanks for the collaboration, your time and good vibes. Reviewing the NPA topics, and validating to generate an NPA type policy, I don't see that it allows me to add a Netskope Threat Protection profile. For example if I have at NPA level, some SMB type access, for shared folders against some File server, Storage or NAS, via the corresponding UDP/TCP ports used by SMBv2 and SMBv3 and I add them as a NPA type APP, at that point Netskope performs or not the inspection of that traffic flow? Netskope Threat Protection for NPA does or does not perform inspection of NPA/Private access APPs. I remain attentive Best regards

2430
A
Netskope Partner
R
RGE_MasterNew Member III
posted in Private Access for ZTNA
Enabling Netskope before login

Good afternoon all, So I've made some great progress on getting netskope to run so I can access all my network resources etc when it's up and running. However I've run into an issue when it comes to doing a remote Hybrid AD join. The application is packaged up and working I can access my domain controllers when not on a VPN through netskope private access. What I can't do at the moment is domain join machines remotely, is there a way that I can for want of a better word, bodge the install or configure it in such a way so I can open network access and then authenticate against my on-prem domain controllers? I read somewhere that you can use NSBranding.JSON or something to enable the configuration but I can't find any official documentation. Thanks RGE_Master

7900
S
A
Netskope Partner
ark007Netskope Partner
asked in Private Access for ZTNA
Enabling private app discovery is not allowing VPN to connect

Hello - We have configured steering exceptions for VPN gateway IPs, domains, and cert pinned app for the VPN processes so that Netskope will not impact vpn connections and works as expected when users connect to VPN. But after enabling private app discovery users are not able to connect to VPN gateway via VPN client and not sure what is causing problem. As part of App discovery configuration we added the company wild card domain and VPN gateway FQDN matches the domain. Did anyone face similar issue before? If yes can someone provide guidance on this issue? Thanks

1300
A
Netskope Partner
C
cscottNew Member
posted in Private Access for ZTNA
New installation of private access and WSL

Hi, We are currently in the process of setting up a new netskope installation for private access and DLP. Things a re going fairly well and most stuff is working. We have a lot of devs in our organization and a lot of them use WSL on windows for things like their buildtools and docker etc. What we have found is we have to install the netskope linux client in WSL for it to be able to get private access. This is in addition to the windows client. Although this is logical as wsl is a hyperv vm underneath the hood, its far from optimal. Has anyone else got and alternative ways of doing it? ie can the windows netskope client provide a proxy we could define via the https_proxy variables etc?

13740
R
R
rafaelmeurerNew Member III
posted in Private Access for ZTNA
ZTNA NEXT

Hello community the new ZTNA NEXT was announced. Does anyone know the release date yet? how can we test it? Will it be a separate license? need to change the topology?

730
R
B
barrycuda72New Member
asked in Private Access for ZTNA
Internal and External server same name

New user to Netskope so apologies if this has been answered. I have an internal application with an Admin page that can be access via port 8383. This application has a public address for client apps to communicate with when they are not in the building. The Admin page is not available when you are using the External address. Example: Internal App.Test.com IP 192.1.1.1 External App.Test.com. IP 35.1.1.1 We configured this as a Private App, however the admin page does not work and from what I can tell from the logs Netskope is using the External address. If I use the IP address instead of the FQDN internally it works. Any thoughts?

1510
Rohit_Bhaskar
Netskope Employee

Most helpful members this week

Badge winners

Show all badges

Popular tags

Terms & ConditionsCookie settings

Cookie policy

We use cookies to enhance and personalize your experience. If you accept you agree to our full cookie policy. Learn more about our cookies.

 
Cookie settings