Skip to main content
  • EN

Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

783 Topics
kkhorramnejad
Netskope Employee
kkhorramnejadNetskope Employee
published in Cloud Firewall
Navigating the Cloud: Evolution and Security of Hybrid Applications with Cloud FirewallArticle

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

4741
D
D
Netskope Employee
dwillisNetskope Employee
published in Netskope Cloud Exchange (CE)
Netskope Risk Exchange Ecosystem - Making User Based ChangesKnowledgebase, Cloud Exchange

Netskope wishes to make it easier for our customers and partners to identify and respond to high risk users, instances, apps, and workloads using automated enrichment and correlation actions. This will enable our customers to leverage multi-vendor sourced or single vendor correlated findings to continuously tune Netskope’s adaptive trust policy enforcement framework. This blog series will explore a number of different workflows that those comfortable using basic scripting, or enablement tools like Postman, can employ to programmatically update and inform your inline policy actions. These are just some of the functions that the newest version of Cloud Exchange, version 5.1, supports now and in the future. Look for it to hit the shelves at the end of October. One of the key value propositions of Netskope is its ability to correlate multiple user personas (Korg-lord-of-thunder, davidw@dwillis.com, and fluffythevampireslayer) to a single, unique identity - dwillis@company.com - managed by

850
D
Netskope Employee
G
Netskope Employee
gcut
published in Security Posture Management
SSPM (SaaS Security Posture Management) template based rulesNews

In the 114 release, we are excited to introduce a new type of content for Netskope SSPM: template-based rules. These rule templates are designed to assist deploying environment-specific detections for known threats, noteworthy anomalies and address misconfigurations. Using templates makes it easier to establish a more expedient and proactive defense strategy for your SaaS ecosystem.Each template is composed  with the same Netskope Governance Language (NGL) rule logic which is also used in the hundreds of built-in detections bundled within Netskope SSPM.  Kindly refer below steps Template based rules are predefined detection rules, which contain placeholders intended to be filled by the user. By simply populating the placeholders within the rule, users can effortlessly generate rules tailored to their specific business requirements and constraints. For example, you might want to ensure every user account in a SaaS application is registered with a company provided email-address? Or creat

1720
G
Netskope Employee
J
jschueleNew Member III
asked in CASB
Dropbox file names missing

We had someone upload files to their personal Dropbox account and the DLP incident forensic information is missing the file names; its replaced by a hash only. Is this a known issue, or feature?

30
J
R
Ramesh Babu KNew Member
asked in CASB
macOS-specific issues with Kubernets cluster connectivity via netskope client--TLS certificate error

we are managing multiple Kubernetes clusters hosted on GCP and AWS. While everything works as expected on Widows, users on macOS are facing connectivity issues when interacting with these clusters using tools like kubectl. when the Netskope client is enabled, users are encountering this error “Unable to connect to the server: tls: failed to verify certificate: x509: certificate signed by unknown authority”Since we are dealing with critical production workloads spread across multiple clusters. we want to avoid any manual modification of kubeconfig files. Can you suggest any possible solutions to resolve this issue.

200
R
M
Melinda_LeeNew Member III
posted in CASB
Netskope Client change tenant

Hello, I have 2 tenants, 1 for QA and 1 for production. Has anyone figured out a way to switch clients from one tenant to another without having to uninstall and reinstall? especially on a MAC system?

4246
bnorcutt
Netskope Partner
M
munster
asked in Next Gen SWG
Block Python Access Internet

HiIs there anyway to block python from access internet to download packages?Whether from VSC or cmdline, etc? thank 

273
N
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in DLP
Email Draft Activity Should be Monitored by NGSWG DLP?

Anyone concerns about Email draft can not be detected by Netskope?On App Catalog it says “Create, Edit, Post, Send” support DLP.On the Application Events, ObjectID can successfully be fetched and we also can clearly saw the activities and content through DevTools.However, DLP policy is not triggered but the action is recorded.We also created a support case on this but L3 support responded and claimed it should be related to SMTP DLP module. We are curious if anyone else has encountered this and have similar concern as we do. 

585
AllenWu
Netskope Partner
J
jschueleNew Member III
asked in DLP
Data Classification integration with Cyera

Are there any planned integrations with Cyera for data classification label usage in DLP policies?Does anyone have experience with this product and use case?Thanks

131
S
Netskope Employee
elawaetz
elawaetzExplorer III
asked in Private Access for ZTNA
How does Publisher perform App Reachability check for UDP?

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

524
elawaetz
steveMC
Netskope Partner
steveMCNetskope Partner
asked in CASB
WhatsApp upload and download Issues on iOS

What could be the reason why the WhatsApp application is experiencing issues when uploading or downloading files on our iOS devices, even though there are no policies in place that should restrict these actions. How can i bypass the whatsapp application on iOS devices?, i haven’t found the procees that i need for the certificate pinned application config. Thanks for your comments  

70
steveMC
Netskope Partner
D
drftordieNew Member
asked in Next Gen SWG
Netskope Slowing internet down especially Meeting Softwares (Google Meet, Slack Huddle etc.)

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

14113
D
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Cloud Firewall
DNS Security fails to support multiple txt type records

Hi team,We noticed that DNS TXT record response originally includes multiple entries, but after processing through Netskope, only a single entry remains.Not sure if it is because on our tenant DNS Security is enabled. Does anyone also face the same issue?

593
AllenWu
Netskope Partner
W
wilsonExplorer III
asked in Next Gen SWG
Network locations information extraction

Is there a way to dump out the Network Locations and which IP address are contained in each?

251
N
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
Avaya Softphone over NPA

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

2683
mlestoquoy
Netskope Partner
C
ccreedNew Member
asked in Next Gen SWG
Enhancement WEB UI SWG

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

120
C
T
ToruIshizakiNew Member III
asked in CASB
Expansion of CASB-Controlled Services

Hi.I am a Netskope user in Japan. Currently, I am facing difficulties because the following cloud services in Japan cannot be controlled by CASB.It is causing significant inconvenience.I strongly request these services to be supported. Application Name: CryptobinURL:https://cryvia.cryptobin.jp/crypto/usr_index.action Application Name: Dokodemo Cabine,URL:https://dococab.tayoreru.com/login.html Application Name: HENNGE Secure Transfer  URL: https://transfer.hennge.com/#/login

170
T
S
steff94New Member III
asked in Next Gen SWG
Disable outgoing XFF-Header to hide public ip of clients?

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

4924
A
J
jschueleNew Member III
asked in Private Access for ZTNA
AWS AMI for Publisher version outdated

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

392
S
Netskope Employee
E
ElTetuNew Member III
asked in Next Gen SWG
Forward Proxy vs Reverse Proxy on clientless scenario

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

662
E
R
RobinTNew Member
asked in Private Access for ZTNA
Is re-auth feature useful in a windows corporate workstation context

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

412
R
C
ChrisGNew Member
asked in Private Access for ZTNA
Browser access - CNAME change with authentication loop

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

261
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Next Gen SWG
Data plane

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

481
S
Netskope Employee
H
hungnn3009New Member
asked in Private Access for ZTNA
Azure Virtual desktop Published App with Netskope

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

260
H
X
xstuartbarrettxNew Member III
asked in Next Gen SWG
Bulk URL Lookups

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

4225
M
Netskope Employee

Badge winners

Show all badges
Terms & ConditionsCookie settings