Private Access for ZTNA

Netskope is not compatible with Google or Cloudflare public DNS servers (8.8.8.8, 8.8.4.4, 1.1.1.1). This is well known and prevents resolution by NPA for all our configured private apps. Based upon our testing (and trial and error) the following public DNS servers are working with NPA for our users and we must update our fleet of Macs as needed.Comcast (Xfinity):  75.75.75.75, 75.75.76.76AT&T:   68.94.156.1, 68.94.157.1Frontier:  185.228.168.168, 185.228.169.168Quad9 Public DNS Servers: 9.9.9.9, 149.112.112.112Fortinet Public DNS servers : 208.91.112.52 , 208.91.112.53 I would like to suggest Netskope maintain a list of known good public DNS servers that work with NPA. This would include updating the list when necessary, due to services not working anymore, etc. In a Work From Home (WFH), traveling, or foreign work force environment, we consistently run into problems with access to private apps due to this issue.   As a final resol

What is Azure Private Endpoint? Cloud Security Architects often make use of “Azure Private Endpoints” to enable access to Azure PaaS services. There are many Azure PaaS Services that supports Private Endpoints e.g., Azure Storage, Azure App Services, Azure CosmoDB, Azure SQL Database, etc. This eliminates the need for the service to be publicly accessible. Access to these private endpoints use Microsoft backbone network without ever going over the public Internet. Private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.   When you bring your Azure PaaS services into your private virtual network all traffic to the service is now routed through the private endpoint and traffic remains on the Microsoft global network. In this architecture and design,

Hi everyone We are deploying single session Azure Virtual desktop and are in design phase where we will put the Ztna agent into the session host so user can have access to private network (on prem). The network infrastructure (in azure and firewall) already in place and our job is to installing agent and start testingWe would like to know any best practice of how ztna agent is working inside Azure virtual desktop, anything we need to consider? Also another challange we got with Ztna agent is that the Ztna team will also install the agent in our SoE laptop. That should be fine but we would need to whitelist all AVD gateway address .so that the AVD client can connect to Azure virtual desktop gateway in the cloud. So far based on microsoft article they recommend to whitelist all *.wvd.microsoft.com but the Ztna team is only happy to whitelist based on IP addresses which pose the risk as the IP address of AVD gateway will keep changing and we may run into the risk of Soe Laptop cannot conn

Hi, I have two local publishers that I use to maintain remote access to Windows PCs in my office. Unfortunately, the users have been complaining nonstop about slow connection speeds and instability issues. It doesn't seem to be a port issue because the problem still occurs even when all ports are enabled. Can you please help me resolve this? 🤔 🤔

Hello, I've been using NPA successfully but I am noticing quite a lot of tunnel down events from several users, a couple events are caused by the device hybernation which we could somewhat address it by disabling the modern hybernation via GPO but the tunnel down remains and NPA does a very poor job on providing more details on what could be the reason for it. How can I get more details about those events? Also, how can I get these events on a report? it would be very valuable for us to have a widget of sorts with top 10 problems, I need to be the first one ot know if a user tunnel is failing to establish. Thanks.

Hello, I have a problem with the resolution of short names on NPA.Access to my FQDN resources works perfectly. But with the short name, the resolution doesn't work.I have a private app DNS with host "*.mydomain.local" and port 53.Resolution works perfectly on my publishers.My network openings are made on the firewall side.But despite all this, I have the impression that the client is trying to resolve via public DNS rather than my local DNS, even though these are correctly configured in the publisher's revolv.conf (as is the domain name). Do you have a suggestion?Thank you

Is it possible to use the option "re-authenticate for private apps" from CLI in linux?I know you can use the stAgentCli to check its status with show-pa command but I would like to make a command in my personal computer to auto-login into the vpn

HiI have installed win10 agent in office thru our legacy proxy.    I can see that the network was steered to nsk when in office, however NPA was having error I have reinstalled, enable traffic bypass  in legacy proxy and firewall but the error persisted.  If I installed via public wifi, NPA was successful.What is the log I should start tracing this error?Thank

Netskope Private Access now consumes NewEdge Traffic Management 2.0(GSLB) for optimizing the DC selection for Client as well as for Publishers. Customers can take following advantages with this feature,  DC selection is no longer DNS There is no dependency on Google DNS or LDNS for POP selection (the last hop recursive DNS resolver). APIs are hosted within existing allow listed NewEdge IP range, no additional network changes needed.  Improved granularity for geolocation of public IP egresses. DNS-based methods (EDNS/ECS0/Google DNS) can only utilize a /24 of the public IP. The GSLB service can better geolocate as it has the entire IP address /32 instead of a /24 advantage for gateway selection. DC selections according to geographic distance, with in-country preference. For example, if an endpoint in the south of France is very close to Barcelona, the Netskope Client will prefer a DC in France, even if it is physically farther away than the NewEdge Barcelona DC. New

Hi Team ,    Can anyone help me the Detailed Architecture for NPA traffic starting from user device till it access the application including the auth type,Identification, Encryption , tunnel that exist all across the traffic flow.

Curious about how to make the leap to Zero Trust Connectivity?    Discover the limitations of traditional VPNs and learn how to migrate from VPN to ZTNA Next from a Netskope customer—Jeff Wehrman (@jwehrman), Sr. Staff Cybersecurity Engineer, at Dexcom in this webinar recap! The recording, slide deck and a summary of the Q&A can be found below:   Watch on-demand   Q: Netskope is not a total replacement for VPN, which means not supporting server to client flow. How can we overcome this? A: You bring up an important point. Most ZTNAs do not support server-initiated but Netskope ZTNA Next supports both client and server-initiated flows. Q: When within your office, is Netskope Private Access (NPA) engaged or does it go offline? A: Short answer is it stays engaged. The Netskope Client, which steers user traffic, is always on whether in office or remote. It can be configured to steer that traffic to the Netskope Cloud or a local ZTNA Broker ad

Tired of outdated VPNs? Discover how to make the leap to Zero Trust Connectivity from a Netskope customer! Jeff Wehrman, Sr. Staff Cybersecurity Engineer, at Dexcom will share how he successfully retired their VPN with ZTNA Next in this webinar.   November 15th - 8am PST November 16th - 3pm AEDT   What you will learn: Hear about the major ways that remote access has evolved over the past three decades Learn deployment lessons from a Netskope customer who has successfully retired their VPN Witness Netskope ZTNA Next in action with a live demo

We have an internal AWS hosted app, thats not reachable from the internet, and we need to provide access to an external partner that doesn't have the NS Client. Can I use NPA and configure a new private app with Allow Browser Access enabled to do this? Or, what are other good options? Thx

Hello Team, Users can't use the NPA Application when the DNS server is set to IPv6. It appears that NPA can't work with IPv6 DNS queries to match the SRP installed. I found some community posts for MAC OS where users recommended turning off IPV6. Does NPA work with IPV6 DNS servers, or are there any limitations?

I'm trying to build a module (currently just playing with locals directly in main.tf) which will build an instance of a private app. for each DC and tie it to the local publishers in that DC. That part is working, but I am failing to also tie the protocols fields correctly in and iterate over those as well, as the attached code will fail if either of the protocol ports fields are empty (in the case where an app only has tcp or udp ports defined). @sshiflett ?

Has anyone have a setup where you roll out Netskope client to all your endpoints and configure Azure AD conditional access to allow connections to Microsoft services if they come via Netskope IP? we are doing this as part of our own ZTNA setup to only allow trusted devices/location.  The setup works well with one minor problem. Netskope will have occasionally tunnel down/up (e.g. switching from LAN/docked to Wifi, etc) and that causes netskope to disabled momentarily before re-enabling again. (which means momentarily it shows attempting connection from non netskope IP) This then lead to services e.g. teams, outlook etc require authentication immidiately which is not the best end user experience.  Has anyone encounter this and able to suggest solution/workaround? I dont want to change trusted location to country based as that defeat the purpose of the ZTNA we are doing.

I'm using the Netskope Provider version 0.2.5 for NPA to query for a list of Publishers based on a site code.netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform RegistryAccording to version 0.2.4 of the provider, I can filter on stuff in the query:netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform Registry This simple query for site code (=key) works well:data "netskope_publishers" "all" {        for_each = toset(keys(local.datacenters))        filter = "publisher_name sw ${each.key}"} However, I'd like to match also on "tags" which is a list of strings, and I'm failing to get that query right. I have also tried deploying a Publisher with a tag via the provider, but is there any way I can display that tag in the GUI?

It is recommended to ensure the Netskope Client is running the latest Gold Release.   Steps to Maintain Latest Release: Using Desktop Application tools like SCCM/IBM tools OR Use Netskope's Auto-Upgrade option to Latest Golden Release  

Netskope Private Access (NPA) is a Zero-Trust Network Access solution that provides seamless access for users accessing applications.  One of the Zero-trust capabilities within NPA, Periodic Reauthentication, is based on an integration with your enterprise Identity Provider (IDP) such as Azure AD or Okta.   This capability allows the Netskope client to challenge the user via your Identity Provider for credentials and MFA to maintain or activate access to internal applications.  Administrators configure intervals for groups or OUs based on the security posture required.  For example, the below configuration would require a user to authenticate to my IDP every 12 hours with a 1 hour grace period before access would be revoked:   Depending on your enterprise’s security requirements, you may wish to always enforce MFA or specific access requirements.  This becomes a challenge if your Identity Provider caches sessions for a period of time which is increasingly common.  The mini browser used

Hi 🙂 In my laboratory I did the configuration to be able to resolve names.At first it worked, I was able to access the application by name/FQDN via HTTPS, network sharing and gpupdate. It stops working out of nowhere, sometimes when restarting the NPA it starts working again and sometimes it doesn't even restart. I stopped the service, stopped the process, renamed the logs folder, to only have new logs.I enabled debug, reproduced the error and got the logs.I found error message 11001 and several other errors.Has anyone seen this error? Any tips?

Hello, I am noticing that when we have users in office connected to our Wi-Fi on site, Netskope is saying they are remote. Netskope Configuration shows "Private Access: Connected". My current user that is experiencing this is showing an on-prem IP address though. Has anyone experienced this?

We recently retired our VPN infrastructure and are using NPA for all private apps. I have attached a PDF that shows the configuration changes required on Mac systems for NPA to function properly. This covers disabling Secure DNS, Privacy & Security settings, disabling IPv6, disabling the QUIC protocol in Chrome, public DNS servers. Enjoy 😉

Hi team, I have a query regarding the NPA the customer wants to segerate the group of user traffic should be steer in NPA. Like they only want the specific group of users. use NPA services I checked the same in steering configuration option i didnt get it please let us know if we can acheive this use cases kindly find the below questions from client end. Also please let me know what limitations we get in Azure AD license. Like what netskope suggest to purchase the license so we can configure SAML SSO. 1.In AD, do we need create a separate security group for SWG,CASB and add few user in the group and test for couple weeks.2.In AD ,do we need a separate security group for NPA and add few users in the group who will access  

Apologies if this has already been requested, but are there any plans to support the system default browser for SAML re-authing for private app access? Right now, whether authenticating via SAML for enrollment or after the time period configured for private app access, we are redirected to our idp via an embedded browser. This defeats the purpose of SSO since it doesn't use the system native browser. If users are already auth'd to the IDP in their system default browser (such as chrome) then launching it in chrome wouldn't require any additional auth, SSO would just kick in. 

Hi team, I looking for a configuration where the user try to access the prvt apps whenever they tried the user get auth prompt for the Pvt apps only please let me know if it's possible to do so as I'm currently doing one POC so i get this requirement from customer end. Also please let us know the configuration to access network drive with the help of NPA.The user access the folders like go to THISPC on upper side bar write //x.x.x.10 IP e.g and access the network share folder I want this to acheive by Netskope I do follow the steps of SMB configuration but required a details regarding this please help me out with this configuration.