Private Access for ZTNA

We've had success implementing and increasing adoption of Private Access over the past 3 years.  But, 1-2 users weekly report Private Access going down.  Suddenly their Netskope Client stops routing network traffic including DNS and IP.  To resolve we uninstall and reinstall of the Netskope Client.  We have created several support cases but support suggests to uninstall and reinstall the Netskope Client which we deem a work around, not a fix.  Trying to determine if its something we are doing wrong or a problem with the Client. Anyone experiencing similar issues?

Hey,I would like to know if anyone has had any problems with netskope azure upgrade, improved through marketplase.I try to update and get a docker image error context deadline exceeded (Client.Timeout exceeded while awaiting headers)

Hi,I went to upgrade two azure publisher, and got a return of ne errorPublisher image update failed: status 1 existsHas anyone ever experienced this?

I need to deploy a Publisher for NPA. I would like to know if I can use RedHat to install the VMware ESXi OVA.

Hi Everyone, Am wanting to enable CRL Checking of device certificate for Pre-Login tunnel.  I want to ensure the CRL in the certificate of the connecting NPA client will be available for verification but I'm unsure of the source doing the verification. The docs are not detailed enough. Where will the CRL Checking request originate? Will it be our management plane or the one of the many NPA Gateway's the client may connect to or some other component (eg. Stitcher)? Thank you

Steps to Update Your NPA Publisher SSH into the Publisher you want to upgrade. On the Publisher option menu, select Upgrade, and then select 1 to initiate the upgrade. The upgrade should take around a minute. In the Netskope UI, go to Settings > Security Cloud Platform > Publishers. Locate the Publisher you just upgraded on the Publishers page to confirm it has a Connected status.   The full support article can be found here: https://support.netskope.com/hc/en-us/articles/360042838534-Upgrade-the-Publisher   Credits: Private Access Virtual Team Members

Hello friends,Someone has already had the problem of adding an application in bypass .. accessing this application in the cloud is via CLI , when accessing I receive this error when the client is active and NPAwithout NPA active, only the client passed the err "an unknown error occurredI noticed some errors without debugging  NSCom2.cpp:1850 NSCOM2 message INST_CERT_IN_FF sent from server to "nsClientUI_s2" client with count 1 stAgentSvc p1404 ta9c error registry.cpp:160 registry RegOpenKeyEx failed, err: 2stAgentSvc p1404 ta9c warn proxy.cpp:155 nsUtil Failed to auto detect proxy or download PAC file, error 12180stAgentSvc p1404 t3a4c info fileUtil.cpp:83 nsUtils failed to open file for reading: C:ProgramData etskopestagent/data/authtoken.pem, err: 2 stAgentUI p117c t3374 error NSCom2.cpp:1527 NSCOM2 client socket connect failed 10061 Does anyone know what could be going on? The above path has been added to the antivirus exceptions list  

Hello all, We are at the tail end of our Netskope deployment and having some hesitation with rolling out to one department. This department has users that work remote on company issued devices and have to complete an RDP connection to a device on-site. We've tested eliminating the need for the RDP connection with NPA, however the files they need to access are quite large (2GB +) and are located on an on-prem server. When they have used our VPN or NPA it can take upwards of 20 minutes just to pull down one file. We want to have our SWG policies apply to this group, but not have NPA active for them. I've tested creating policies to block NPA access, but that creates an unnecessary amount of noise for the user. I'm hoping someone can point me in the direction of how to disable NPA for these users prior to deploying the agent. Thanks for the help!

The client is migrating virtual servers and the NPA publishers are located in them. The query is where I can change the name of the network card because it does not allow me to modify the value and it is necessary to clone the equipment and make it functional.

As for today NPA on NSClient doesn’t capture DNS requests sent over TCP 53 unless “Publisher DNS” is configured in the Private Application. Netskope is aware of this limitation and we are working to support it in the future.This means that for the time being for Private Applications that are not configured to use “Publisher DNS”, if the initial DNS resolution is performed over TCP 53, NPA will bypass the DNS resolution resulting on the NPA Application to fail to work. Despite the general recommendation is to avoid enabling/using DNS over TCP (TCP 53), this often depends on the DNS resolver, and unfortunately certain applications rely on their own DNS resolvers instead of the OS one. Recently we verified that Microsoft Edge uses an embedded DNS resolver that, even when configured not to use secure DNS (DNS over HTTPS), it still tries to use DNS over TCP if possible, breaking NPA. In order to ensure Microsoft Edge will use the OS DNS resolver it’s possible to configure locally or th

Hi I am facing issue in my laptop having the Re-authentication for Private Apps feature enabled every 24 hours. Unfortunately there is no re-auth pop-up coming when these 24 hours expires. I have no indication from the Client whether I need to re-auth now to access the Private Applications. This is hindering my day to day work. I have also checked it with my other colleagues and facing similar issue.  The documentation says that "If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access" which is not happening. 

Hi everyone,I'm currently looking into possibilities that Netskope offers us to depreciate our current VPN solution. One of them being the Windows deployment via Always on VPN, I figured that the Pre-Logon NPA might come in handy. Unfortunately, I couldn't find anything regarding this in the docs nor the community forum.I'd greatly appreciate any help.Best regards

Hi, I set up a new contingency publisher for the priv app, ran troublesshoint on the tool and everything is fine, no problems.But I can't access priv app,ran a curl , and got an http 500 return.We are not using DNS in the browser.Has anyone ever experienced this ? Or do you have an idea why?

Hey,Can anyone tell me if there is any limitation on the use of the NPA, number of users... traffic support.For a few days I have been experiencing a slowdown problem in the app and web after adding more users to the NPA.

Doubts with NPA Web browser Private Access - SAML Azure AD Hello community, as always, many thanks for your comments, advice, recommendations and your time.I have currently configured in our Tenant for user synchronization with SCIM, from Azure AD and I have SSO for Admin console access, using Azure AD, everything work OK. Now I have a huge and big doubt, I understand that for user Private Access via Web i.e. Clientless, a SAML - Reverse Proxy account must be configured. That's my big doubt: I am looking for documentation that supports this configuration, ie Private Access Web browser access with SAML - Reverse Proxy with Azure AD, but I have not found, I have only found for Okta, among others, but with Azure AD nothing. Configure Browser Access for Private Apps:https://docs.netskope.com/en/configure-browser-access-for-private-apps-378561.html#:~:text=for%20Private%20Apps-,Configure%20Browser%20Access%20for%20Private%20Apps,-Browser%20Access%20is Reverse Proxy:

Netskope Private Access- Client Update config time interval Hello good evening, I hope you are all very well. I have a question, I have been searching and I have not found anything regarding the autoupdate interval of the Netskope client configuration, when changes occur e.g. changes at NPA level, e.g. new Publisher, new Private apps, private access policies. I have even been timing, because I understand that this is not 100% manual or yes ?. Could you tell me automatically when it takes the client to automatically perform the udpate of the config, when there are NPA adjustments. I have been timing the client, and in 35 minutes elapsed the client still does not update the NPA config by itself. Thank you, I remain attentive Best regards 

I am following the steps in the documentation to make apps available from the browser.Configure Browser Access for Private Apps (netskope.com)If It uses standard port 80 it seems to work but 443 or any other port I get this error message.Netskope was unable to provide access to this application for tenant:<xxxx>. User is not authorized to access this app, please contact your IT administrator

Use NPA with logical condition Good afternoon everyone.Can anyone tell me if there is any way to put a logical condition, example:Is there a way to configure netskope to be a “second choice” connection type.Example:The user is in the company, on the internal network, I want the traffic not to go out through the NPA, but through our internal network.Or, user is on VPN, I want traffic to go out through VPN instead of NPA. Is it possible for him to identify this? Or will the priority always be the NPA?

Private access - NPA Threat Protection Inspection Hello good afternoon, as always thanks for the collaboration, your time and good vibes.Reviewing the NPA topics, and validating to generate an NPA type policy, I don't see that it allows me to add a Netskope Threat Protection profile. For example if I have at NPA level, some SMB type access, for shared folders against some File server, Storage or NAS, via the corresponding UDP/TCP ports used by SMBv2 and SMBv3 and I add them as a NPA type APP, at that point Netskope performs or not the inspection of that traffic flow? Netskope Threat Protection for NPA does or does not perform inspection of NPA/Private access APPs.I remain attentive Best regards

Good afternoon all,   So I've made some great progress on getting netskope to run so I can access all my network resources etc when it's up and running. However I've run into an issue when it comes to doing a remote Hybrid AD join.   The application is packaged up and working   I can access my domain controllers when not on a VPN through netskope private access.   What I can't do at the moment is domain join machines remotely, is there a way that I can for want of a better word, bodge the install or configure it in such a way so I can open network access and then authenticate against my on-prem domain controllers? I read somewhere that you can use NSBranding.JSON or something to enable the configuration but I can't find any official documentation.   Thanks RGE_Master

Hello - We have configured steering exceptions for VPN gateway IPs, domains, and cert pinned app for the VPN processes so that Netskope will not impact vpn connections and works as expected when users connect to VPN. But after enabling private app discovery users are not able to connect to VPN gateway via VPN client and not sure what is causing problem. As part of App discovery configuration we added the company wild card domain and VPN gateway FQDN matches the domain. Did anyone face similar issue before? If yes can someone provide guidance on this issue? Thanks

Hi, We are currently in the process of setting up a new netskope installation for private access and DLP. Things a re going fairly well and most stuff is working. We have a lot of devs in our organization and a lot of them use WSL on windows for things like their buildtools and docker etc. What we have found is we have to install the netskope linux client in WSL for it to be able to get private access. This is in addition to the windows client. Although this is logical as wsl is a hyperv vm underneath the hood, its far from optimal. Has anyone else got and alternative ways of doing it?ie can the windows netskope client provide a proxy we could define via the https_proxy variables etc? 

Hello community the new ZTNA NEXT was announced. Does anyone know the release date yet?how can we test it?Will it be a separate license?need to change the topology?

New user to Netskope so apologies if this has been answered.I have an internal application with an Admin page that can be access via port 8383.This application has a public address for client apps to communicate with when they are not in the building.  The Admin page is not available when you are using the External address.Example:Internal  App.Test.com  IP 192.1.1.1External App.Test.com. IP 35.1.1.1We configured this as a Private App, however the admin page does not work and from what I can tell from the logs Netskope is using the External address.  If I use the IP address instead of the FQDN internally it works.   Any thoughts?

Hi, We want to script "Disable Netskope Client", "Enable Netskope Client" on MacOS. That is a full tunnel teardowns and rebuild, reloading of network stack etc. I saw some posts re using sudo launchctl [un]load /Library/LaunchDaemons/com.netskope.client.auxsvc.plist but this appears to do nothing. Certainly the NPA tunnel stays up for existing connections.Thanks