Private Access for ZTNA

I am following the steps in the documentation to make apps available from the browser.Configure Browser Access for Private Apps (netskope.com)If It uses standard port 80 it seems to work but 443 or any other port I get this error message.Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

Use NPA with logical condition Good afternoon everyone.Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type.Example:The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network.Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

Private access - NPA Threat Protection Inspection Hello good afternoon, as always thanks for the collaboration, your time and good vibes.Reviewing the NPA topics, and validating to generate an NPA type policy, I don't see that it allows me to add a Netskope Threat Protection profile. For example if I have at NPA level, some SMB type access, for shared folders against some File server, Storage or NAS, via the corresponding UDP/TCP ports used by SMBv2 and SMBv3 and I add them as a NPA type APP, at that point Netskope performs or not the inspection of that traffic flow? Netskope Threat Protection for NPA does or does not perform inspection of NPA/Private access APPs.I remain attentive Best regards

Good afternoon all,   So I've made some great progress on getting netskope to run so I can access all my network resources etc when it's up and running. However I've run into an issue when it comes to doing a remote Hybrid AD join.   The application is packaged up and working   I can access my domain controllers when not on a VPN through netskope private access.   What I can't do at the moment is domain join machines remotely, is there a way that I can for want of a better word, bodge the install or configure it in such a way so I can open network access and then authenticate against my on-prem domain controllers? I read somewhere that you can use NSBranding.JSON or something to enable the configuration but I can't find any official documentation.   Thanks RGE_Master

Hello - We have configured steering exceptions for VPN gateway IPs, domains, and cert pinned app for the VPN processes so that Netskope will not impact vpn connections and works as expected when users connect to VPN. But after enabling private app discovery users are not able to connect to VPN gateway via VPN client and not sure what is causing problem. As part of App discovery configuration we added the company wild card domain and VPN gateway FQDN matches the domain. Did anyone face similar issue before? If yes can someone provide guidance on this issue? Thanks

Hi, We are currently in the process of setting up a new netskope installation for private access and DLP. Things a re going fairly well and most stuff is working. We have a lot of devs in our organization and a lot of them use WSL on windows for things like their buildtools and docker etc. What we have found is we have to install the netskope linux client in WSL for it to be able to get private access. This is in addition to the windows client. Although this is logical as wsl is a hyperv vm underneath the hood, its far from optimal. Has anyone else got and alternative ways of doing it?ie can the windows netskope client provide a proxy we could define via the https_proxy variables etc? 

Hello community the new ZTNA NEXT was announced. Does anyone know the release date yet?how can we test it?Will it be a separate license?need to change the topology?

New user to Netskope so apologies if this has been answered.I have an internal application with an Admin page that can be access via port 8383.This application has a public address for client apps to communicate with when they are not in the building.  The Admin page is not available when you are using the External address.Example:Internal  App.Test.com  IP 192.1.1.1External App.Test.com. IP 35.1.1.1We configured this as a Private App, however the admin page does not work and from what I can tell from the logs Netskope is using the External address.  If I use the IP address instead of the FQDN internally it works.   Any thoughts?

Hi, We want to script "Disable Netskope Client", "Enable Netskope Client" on MacOS. That is a full tunnel teardowns and rebuild, reloading of network stack etc. I saw some posts re using sudo launchctl [un]load /Library/LaunchDaemons/com.netskope.client.auxsvc.plist but this appears to do nothing. Certainly the NPA tunnel stays up for existing connections.Thanks

  Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Autopilot can be used to simplify and streamline the bulk deployment, setup, and configuration of Windows 10/11 devices in an organization to ensure they are provisioned and locked down according to corporate standards. It can also be used for device reset, repurpose, and recovery. Netskope has a feature called Netskope Private Access Prelogon for Private Apps which assists customers to take advantage of autopilot functionality.   Netskope’s Professional Services team has been using this feature to recognize company owned devices and associate them with appropriate enrollment workflows and configuration profiles,  automatically join devices to Azure Active Directory (Azure AD) or Active Directory, auto-enroll devices into MDM services such as Intune, and Customer Out of Box Experience (OOBE) conten

Hi community,  we are facing issues with several of our websites accessed via NPA:Reaching the website is working without any issue, but if you let it in background for a while and come back to it, sometimes it falls into error without possibility to refresh the page and make it work. User needs to disable/enable agent to make it work again. Anyone faced similar issue ?Thanks, Robin

Netskope Private Access is a Zero Trust Network Access (ZTNA) solution that connects users and devices to applications rather than networks.  This differs from traditional network access solutions such as remote access VPNs.  Legacy VPNs provided network level access for remote users by essentially extending your internal network to the remote device.   This was simple from an administrative and user perspective, but ultimately provides unnecessary access for most employees.  In contrast, ZTNA solutions like Netskope Private Access provide access to applications based on contextual criteria such as user risk, device risk, and which resources are being accessed.  This is more secure and aligns to Zero Trust principles such as providing minimum access levels , continuously verifying context, and removing implicit trust based on the network.  While this is significantly more secure, it can also be more challenging for administrators to implement as they need

Interconnect NPA Private Access IPSEC to Private Apps Hello good afternoon, thank you for your cooperation. I have a doubt, is there any way to enable, example: If I have an IPSEC tunnel between my HQ and AWS, can I have an IPSEC tunnel, between my Netskope and AWS, without having to depend on installing a "Publisher" and not depending on that VM or Addon, to be able to access private APPS services, such as Private Access features ? For a SASE/ZTNA environment? Thank you, I remain attentive Best regards

Endpoint with Netskope Private APP Client and VPN Client installed endpointHello, good afternoon, as always, thanks for the support and for your constant collaboration.I have a question regarding the following environment/particular case.-Workstation/Laptop, outside the network/DC (Internet modem 4g/5g - Home Internet connection - Connection from Cafe) with Netskope Client installed and with VPN Client installed and Connected to the datacenter, bound for 10.10. 10.100 (App1) 10.10.10.200 (App2) 10.10.10.250 (App3).-Tenant Netskope with NPA Private Access (policies, access, configurations already fully done)-Publisher in Datacenter and fully connected-Publisher NPA Private Access/Private Apps destinations: with IP of internal access systems: that is, App1:10.10.10.100 - App2:10.10.10.200 - App3: 10.10.10.250My question is the following, with the environment already described, what happens in the case of the workstation with the VPN client connected, with the Netskope client installed, w

Zero Trust Network Access(ZTNA) solutions provide vast security improvements compared to traditional VPNs thanks to only allowing users access to the applications they need. Migrating from a VPN solution to a ZTNA mindset requires a deep understanding of the applications within the network and what access is needed. Netskope recently released a new feature called NPA App Discovery which assists administrators in identifying the applications and required access. Netskope’s Professional Services team has been using this feature to mitigate end-user risk while speeding up NPA deployments. With App Discovery enabled, selected users will have a traditional VPN experience and temporary access to all resources on the network. Netskope will identify all of the domains, IP’s, and ports for applications these pilot users access, taking the guesswork out of defining the applications. Netskope administrators can view this data in the Netskope UI and quickly create definitions and access policies

Hello,   We encounter an issue that when a user's domain / UPN changes from say: admin@contoso.local > admin@newcontoso.local The private gateway will fail to establish   In my env Netskope is setup in MultiUser mode(v93.1.0.951) and is integrated with Azure AD for user provisioning / SSO   Reinstalling the Netskope client doesn't resolve the issue   Looking at the device within the Netskope Admin console its client status is 'Multiple Statuses' it will show the same user with both the new domain and the previous domain   Looking at the users profile (updated domain) it will report that the client status is up but physically on the workstation the tunnel will be down and non functional   The only solution that works is to reimage the workstation or assign another device, which feels insane Has anyone seen this before or have any advice on a resolution?   Cheers,  

Hi all, I am trying to setup a public accessable website (home.heinonline.org) as a published private app on a publisher. But it looks like that all attempts to access this website from an off-prem client steers the traffic through Netskope instead of going to the publisher. The reason I want to do this is that user when accessing the website will "auto-authenticate" when on-prem (via IP identification). And I am hoping to get the same result of "auto-authenticate" for off-prem users by publishing the website as a private app on a publisher that is on the same network as on-prem users. Any ideas on what I can do to make this work? Thanks in advance.

We have SCIM integration done between Jumpcloud and Netskope. But seems like some user groups in Netskope does not get populated with the users based on Jumpcloud. Is there any way for me to manually trigger a sync? Or check the sync logs. 

Netskope introduced REST APIs for Netskope Private Access earlier this year in R91. These REST API endpoints allow for networking and security teams to automate application onboarding, infrastructure management, and policy for Private Access. Now if you aren’t familiar with Netskope Private Access, you can find an overview here. Netskope Private Access essentially has three key components used to manage access to your enterprise applications: Publishers are lightweight virtual machines that broker access to your internal applications by connecting to the Netskope cloud. Publishers are supported in public clouds including AWS, GCP, and Azure along with private data center virtualization such as Hyper-V or ESXi. Additional platforms are supported as well. App Definitions are Netskope objects used to determine the hostnames, ports, and IP addresses that your end users can access via Netskope Private Access. Real-time Protection Policies grant or deny access to your enterprise a

Have you been curious to get access to see how Netskope Private Access works? We are offering a free 14-day test drive for you to see how NPA seamlessly connects users everywhere to private applications hosted anywhere in data centers or public cloud environments. What you can expect: Free 14-day hands-on experience Turnkey testing environment No software to download/install Application-specific connectivity and superior user experience Single management console for user identity, application, and access policies. Admin and User Guides to help you every step of the way Click here to sign up to access your testing environment today.

Hello,  We started using NPA for our Radiologists; they connect from home [1Gb ISP connection] via NPA [two publishers] to our on prem PACS system.  PACS studies/Images are pretty big, some studies are 2 GB+ in size. We are on 97.0.0.7294 for the publisher and per the release notes, this version supports peak throughput of 500 Mbps. But unfortunately we are not seeing that. In testing the Peak, we notice is only ~120Mbps. We have set up a speedtest docker container just for this purpose and published it through NPA. Wondering if anyone has thoughts on how to increase the throughput so the images load faster as some of our rads reported slowness in loading the studies.   

OktaAdvanced Server Access provides Zero Trust identity and access management for cloud and on-premises infrastructure. Using Okta as its source of truth, Advanced Server Access reconciles accounts to manage SSH and RDP access to Linux and Windows servers. Advanced Server Access extends secure privileged access to users, automates lifecycle management for server accounts, and eliminates the need for credential management.Okta Advanced Server Access can be configured to allow direct connection to servers or it can be configured to use a Bastion and/or an Okta ASA Gateway to provide the connection through a “Session Gateway Broker”An example of integration with Netskope leveraging Network Private Access is the following:   In this example we have a Linux and a Windows machine published through the Okta ASA Gateway, and a Linux machine published directly without the ASA Gateway.In this case we’ll configure 2 separate NPA Applications: NPA Okta ASA Gateway Application: defined for

Note:  SCCM distributions are highly customizable, and the below information is based on sample environments.  You should always consult with your SCCM administrator to create optimal Application Definitions and Policies based on your environment.   Introduction Microsoft’s System Center Configuration Manager (SCCM) is an endpoint management solution that has been combined with Intune, Autopilot, and other tools into Microsoft Endpoint Configuration Manager.  SCCM is traditionally deployed with management and distribution points on-premises or in public clouds that are used to deploy updates, configurations, and software to managed endpoints.   When on-premises, communications between the managed endpoint and SCCM distribution points are handled via enterprise networking and security tools such as site-to-site tunnels. Traditionally, remote access VPNs were used to connect remote endpoints to SCCM distribution points.  In distributed environments, this pre

Quick Setup of SSH for Publisher prior to running on Centos 7Comamnd to build PublisherLink: https://docs.netskope.com/en/deploy-a-publisher.htmlPlease Note:  create another admin user in centos as when you run the pubisher command as it locks you out of root after step 3 in the link. You need to login via the other user and run the commnd below.Login with other user via SSH user created then excute the following command curl https://s3-us-west-2.amazonaws.com/publisher.netskope.com/latest/generic/bootstrap.sh | sudo bash; sudo su - $USER; exit Wait up to 10 min subject to your line speed.Setup SSH Server sudo yum –y install openssh-server openssh-clientssudo systemctl start sshdsudo systemctl status sshdEnable OpenSSH Servicesudo systemctl enable sshdservice sshd restartsudo systemctl status sshd(To check Status is Active)IF you cant SSH enable the followingFirewall Settingssudo systemctl start firewalldsudo firewall-cmd --permanent --add-service=sshsudo firewall-c

Hi AllWe have several tenants we manage and we have just  setup our first client that is only using NPA and i received a shock when looking at the overview dashboard which showed 0 users yet all 73 users where connected and working. Can i suggest that a Widget Dashboard is given for the users just using NPA that shows at least the number of users connected. I thing this would be great for all netskope admins as at the moment does not give you a true representation of the number of user working. Would be great if you could drill into this dashbaord showing the following key information in a list1.) Username2.) user Group relating to the private apps that can be steer3.)Time of connection4.) Time of disocnnection5.) Source IP6.) Traffic