Private Access for ZTNA

Has anyone ever needed to change the users' email domain on netskope?I have a client that needs to change the email domain, when it changes, the NPA stops working. The proxy service is still OK, but the NPA does not go up the tunnel. It only works again when he uninstalls and installs the client again.

I have a private app configured to allow port 22 and users are able to use SSH and SCP successfully. Users are observing an intermittent issue when trying to SSH/SCP into the app and getting this error: kex_exchange_identification: Connection closed by remote host Connection closed by 191.1.1.3 port 22 This error prevents user from starting a new SSH/SCP session, but all existing SSH/SCP sessions are fine when this error occurs. Usually if user retry's ssh after a while, the error goes away.  Is there any kind of SSH connection limiting in the NS Client or Publisher?

Hello, Wondering what is the use case for DNS steering in Steering config and How does it differ from "Use publisher DNS" in PrivateApps.   

Hi AllCould someone please shed some light on below queries, we are having issues with Prelogon Tunnel in our environment. Do we need to specify prelogonuser= argument during msi install with 105.0x?Since Client Configs does not allow  the use of same prelogin account in different Configs , what is expected behavior when different users associated to different client configs login to the perusermode configured machine? Would the prelogon account change to the one defined in client config pulled down by last logged in user?Especially when logged on users changing their AD passwords, they get the error  “Information could not be read from the domain controller”.Please adviseThanksParul

I have a single publisher that I've configured and deployed as an initial investigation of the configuration.   Is there a recommended way of capturing all the customization that was necessary to get it working in our environment?   I can certainly go back through our support cases and gather them, but that would likely require applying the config modifications on each new host individually.   As we look to roll out a fleet of publishers, manually entering these configurations on each device could be significantly slow our rate of depoyment.

We've had success implementing and increasing adoption of Private Access over the past 3 years.  But, 1-2 users weekly report Private Access going down.  Suddenly their Netskope Client stops routing network traffic including DNS and IP.  To resolve we uninstall and reinstall of the Netskope Client.  We have created several support cases but support suggests to uninstall and reinstall the Netskope Client which we deem a work around, not a fix.  Trying to determine if its something we are doing wrong or a problem with the Client. Anyone experiencing similar issues?

Hey,I would like to know if anyone has had any problems with netskope azure upgrade, improved through marketplase.I try to update and get a docker image error context deadline exceeded (Client.Timeout exceeded while awaiting headers)

Hi,I went to upgrade two azure publisher, and got a return of ne errorPublisher image update failed: status 1 existsHas anyone ever experienced this?

I need to deploy a Publisher for NPA. I would like to know if I can use RedHat to install the VMware ESXi OVA.

Hi Everyone, Am wanting to enable CRL Checking of device certificate for Pre-Login tunnel.  I want to ensure the CRL in the certificate of the connecting NPA client will be available for verification but I'm unsure of the source doing the verification. The docs are not detailed enough. Where will the CRL Checking request originate? Will it be our management plane or the one of the many NPA Gateway's the client may connect to or some other component (eg. Stitcher)? Thank you

Steps to Update Your NPA Publisher SSH into the Publisher you want to upgrade. On the Publisher option menu, select Upgrade, and then select 1 to initiate the upgrade. The upgrade should take around a minute. In the Netskope UI, go to Settings > Security Cloud Platform > Publishers. Locate the Publisher you just upgraded on the Publishers page to confirm it has a Connected status.   The full support article can be found here: https://support.netskope.com/hc/en-us/articles/360042838534-Upgrade-the-Publisher   Credits: Private Access Virtual Team Members

Hello friends,Someone has already had the problem of adding an application in bypass .. accessing this application in the cloud is via CLI , when accessing I receive this error when the client is active and NPAwithout NPA active, only the client passed the err "an unknown error occurredI noticed some errors without debugging  NSCom2.cpp:1850 NSCOM2 message INST_CERT_IN_FF sent from server to "nsClientUI_s2" client with count 1 stAgentSvc p1404 ta9c error registry.cpp:160 registry RegOpenKeyEx failed, err: 2stAgentSvc p1404 ta9c warn proxy.cpp:155 nsUtil Failed to auto detect proxy or download PAC file, error 12180stAgentSvc p1404 t3a4c info fileUtil.cpp:83 nsUtils failed to open file for reading: C:ProgramData etskopestagent/data/authtoken.pem, err: 2 stAgentUI p117c t3374 error NSCom2.cpp:1527 NSCOM2 client socket connect failed 10061 Does anyone know what could be going on? The above path has been added to the antivirus exceptions list  

Hello all, We are at the tail end of our Netskope deployment and having some hesitation with rolling out to one department. This department has users that work remote on company issued devices and have to complete an RDP connection to a device on-site. We've tested eliminating the need for the RDP connection with NPA, however the files they need to access are quite large (2GB +) and are located on an on-prem server. When they have used our VPN or NPA it can take upwards of 20 minutes just to pull down one file. We want to have our SWG policies apply to this group, but not have NPA active for them. I've tested creating policies to block NPA access, but that creates an unnecessary amount of noise for the user. I'm hoping someone can point me in the direction of how to disable NPA for these users prior to deploying the agent. Thanks for the help!

The client is migrating virtual servers and the NPA publishers are located in them. The query is where I can change the name of the network card because it does not allow me to modify the value and it is necessary to clone the equipment and make it functional.

As for today NPA on NSClient doesn’t capture DNS requests sent over TCP 53 unless “Publisher DNS” is configured in the Private Application. Netskope is aware of this limitation and we are working to support it in the future.This means that for the time being for Private Applications that are not configured to use “Publisher DNS”, if the initial DNS resolution is performed over TCP 53, NPA will bypass the DNS resolution resulting on the NPA Application to fail to work. Despite the general recommendation is to avoid enabling/using DNS over TCP (TCP 53), this often depends on the DNS resolver, and unfortunately certain applications rely on their own DNS resolvers instead of the OS one. Recently we verified that Microsoft Edge uses an embedded DNS resolver that, even when configured not to use secure DNS (DNS over HTTPS), it still tries to use DNS over TCP if possible, breaking NPA. In order to ensure Microsoft Edge will use the OS DNS resolver it’s possible to configure locally or th

Hi I am facing issue in my laptop having the Re-authentication for Private Apps feature enabled every 24 hours. Unfortunately there is no re-auth pop-up coming when these 24 hours expires. I have no indication from the Client whether I need to re-auth now to access the Private Applications. This is hindering my day to day work. I have also checked it with my other colleagues and facing similar issue.  The documentation says that "If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access" which is not happening. 

Hi everyone,I'm currently looking into possibilities that Netskope offers us to depreciate our current VPN solution. One of them being the Windows deployment via Always on VPN, I figured that the Pre-Logon NPA might come in handy. Unfortunately, I couldn't find anything regarding this in the docs nor the community forum.I'd greatly appreciate any help.Best regards

Hi, I set up a new contingency publisher for the priv app, ran troublesshoint on the tool and everything is fine, no problems.But I can't access priv app,ran a curl , and got an http 500 return.We are not using DNS in the browser.Has anyone ever experienced this ? Or do you have an idea why?

Hey,Can anyone tell me if there is any limitation on the use of the NPA, number of users... traffic support.For a few days I have been experiencing a slowdown problem in the app and web after adding more users to the NPA.

Doubts with NPA Web browser Private Access - SAML Azure AD Hello community, as always, many thanks for your comments, advice, recommendations and your time.I have currently configured in our Tenant for user synchronization with SCIM, from Azure AD and I have SSO for Admin console access, using Azure AD, everything work OK. Now I have a huge and big doubt, I understand that for user Private Access via Web i.e. Clientless, a SAML - Reverse Proxy account must be configured. That's my big doubt: I am looking for documentation that supports this configuration, ie Private Access Web browser access with SAML - Reverse Proxy with Azure AD, but I have not found, I have only found for Okta, among others, but with Azure AD nothing. Configure Browser Access for Private Apps:https://docs.netskope.com/en/configure-browser-access-for-private-apps-378561.html#:~:text=for%20Private%20Apps-,Configure%20Browser%20Access%20for%20Private%20Apps,-Browser%20Access%20is Reverse Proxy:

Netskope Private Access- Client Update config time interval Hello good evening, I hope you are all very well. I have a question, I have been searching and I have not found anything regarding the autoupdate interval of the Netskope client configuration, when changes occur e.g. changes at NPA level, e.g. new Publisher, new Private apps, private access policies. I have even been timing, because I understand that this is not 100% manual or yes ?. Could you tell me automatically when it takes the client to automatically perform the udpate of the config, when there are NPA adjustments. I have been timing the client, and in 35 minutes elapsed the client still does not update the NPA config by itself. Thank you, I remain attentive Best regards 

I am following the steps in the documentation to make apps available from the browser.Configure Browser Access for Private Apps (netskope.com)If It uses standard port 80 it seems to work but 443 or any other port I get this error message.Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

Use NPA with logical condition Good afternoon everyone.Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type.Example:The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network.Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

Private access - NPA Threat Protection Inspection Hello good afternoon, as always thanks for the collaboration, your time and good vibes.Reviewing the NPA topics, and validating to generate an NPA type policy, I don't see that it allows me to add a Netskope Threat Protection profile. For example if I have at NPA level, some SMB type access, for shared folders against some File server, Storage or NAS, via the corresponding UDP/TCP ports used by SMBv2 and SMBv3 and I add them as a NPA type APP, at that point Netskope performs or not the inspection of that traffic flow? Netskope Threat Protection for NPA does or does not perform inspection of NPA/Private access APPs.I remain attentive Best regards

Good afternoon all,   So I've made some great progress on getting netskope to run so I can access all my network resources etc when it's up and running. However I've run into an issue when it comes to doing a remote Hybrid AD join.   The application is packaged up and working   I can access my domain controllers when not on a VPN through netskope private access.   What I can't do at the moment is domain join machines remotely, is there a way that I can for want of a better word, bodge the install or configure it in such a way so I can open network access and then authenticate against my on-prem domain controllers? I read somewhere that you can use NSBranding.JSON or something to enable the configuration but I can't find any official documentation.   Thanks RGE_Master