Skip to main content
  • EN

Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

776 Topics
kkhorramnejad
Netskope Employee
kkhorramnejadNetskope Employee
published in Cloud Firewall
Navigating the Cloud: Evolution and Security of Hybrid Applications with Cloud FirewallArticle

What is Cloud Firewall? The evolution of Cloud Firewall (CFW) or Firewall as a Service (FWaaS) is a direct outcome of the widespread adoption of cloud technologies and the migration or development of applications in the cloud. Traditionally, on-premise firewall appliances were designed to secure outbound traffic at Layers 3 and 4 (L3/L4) of OSI model, safeguarding corporate assets from potential security threats. However, the landscape of work and security underwent significant changes, particularly with the rise of remote work, a trend that saw rapid acceleration due to the COVID-19 pandemic. This shift necessitated a reevaluation of security strategies by teams to address both existing and emerging threats.Initially, the strategy involved backhauling the traffic from the remote workforce back to the corporate office's security infrastructure. This approach, however, quickly proved to be inadequate in meeting the security and performance needs of a growing remote workforce. In respons

4521
D
D
Netskope Employee
dwillisNetskope Employee
published in Netskope Cloud Exchange (CE)
Netskope Risk Exchange Ecosystem - Making User Based ChangesKnowledgebase, Cloud Exchange

Netskope wishes to make it easier for our customers and partners to identify and respond to high risk users, instances, apps, and workloads using automated enrichment and correlation actions. This will enable our customers to leverage multi-vendor sourced or single vendor correlated findings to continuously tune Netskope’s adaptive trust policy enforcement framework. This blog series will explore a number of different workflows that those comfortable using basic scripting, or enablement tools like Postman, can employ to programmatically update and inform your inline policy actions. These are just some of the functions that the newest version of Cloud Exchange, version 5.1, supports now and in the future. Look for it to hit the shelves at the end of October. One of the key value propositions of Netskope is its ability to correlate multiple user personas (Korg-lord-of-thunder, davidw@dwillis.com, and fluffythevampireslayer) to a single, unique identity - dwillis@company.com - managed by

800
D
Netskope Employee
G
Netskope Employee
gcut
published in Security Posture Management
SSPM (SaaS Security Posture Management) template based rulesNews

In the 114 release, we are excited to introduce a new type of content for Netskope SSPM: template-based rules. These rule templates are designed to assist deploying environment-specific detections for known threats, noteworthy anomalies and address misconfigurations. Using templates makes it easier to establish a more expedient and proactive defense strategy for your SaaS ecosystem.Each template is composed  with the same Netskope Governance Language (NGL) rule logic which is also used in the hundreds of built-in detections bundled within Netskope SSPM.  Kindly refer below steps Template based rules are predefined detection rules, which contain placeholders intended to be filled by the user. By simply populating the placeholders within the rule, users can effortlessly generate rules tailored to their specific business requirements and constraints. For example, you might want to ensure every user account in a SaaS application is registered with a company provided email-address? Or creat

1610
G
Netskope Employee
W
wilsonExplorer III
asked in Next Gen SWG
Network locations information extraction

Is there a way to dump out the Network Locations and which IP address are contained in each?

20
W
A
AlfaBaneExplorer III
posted in Private Access for ZTNA
Avaya Softphone over NPA

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

2563
mlestoquoy
Netskope Partner
D
drftordieNew Member
asked in Next Gen SWG
Netskope Slowing internet down especially Meeting Softwares (Google Meet, Slack Huddle etc.)

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

262
D
C
ccreedNew Member
asked in Next Gen SWG
Enhancement WEB UI SWG

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

70
C
T
ToruIshizakiNew Member III
asked in CASB
Expansion of CASB-Controlled Services

Hi.I am a Netskope user in Japan. Currently, I am facing difficulties because the following cloud services in Japan cannot be controlled by CASB.It is causing significant inconvenience.I strongly request these services to be supported. Application Name: CryptobinURL:https://cryvia.cryptobin.jp/crypto/usr_index.action Application Name: Dokodemo Cabine,URL:https://dococab.tayoreru.com/login.html Application Name: HENNGE Secure Transfer  URL: https://transfer.hennge.com/#/login

140
T
S
steff94New Member III
asked in Next Gen SWG
Disable outgoing XFF-Header to hide public ip of clients?

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

4694
A
J
jschueleNew Member III
asked in Private Access for ZTNA
AWS AMI for Publisher version outdated

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

302
S
Netskope Employee
E
ElTetuNew Member III
asked in Next Gen SWG
Forward Proxy vs Reverse Proxy on clientless scenario

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

502
E
R
RobinTNew Member
asked in Private Access for ZTNA
Is re-auth feature useful in a windows corporate workstation context

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

362
R
C
ChrisGNew Member
asked in Private Access for ZTNA
Browser access - CNAME change with authentication loop

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

201
S
Netskope Employee
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Next Gen SWG
Data plane

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

261
S
Netskope Employee
H
hungnn3009New Member
asked in Private Access for ZTNA
Azure Virtual desktop Published App with Netskope

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

190
H
X
xstuartbarrettxNew Member III
asked in Next Gen SWG
Bulk URL Lookups

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

4065
M
Netskope Employee
M
maxkorNew Member III
asked in Private Access for ZTNA
Browser Access- Concurrent Users

I wanted to confirm if there's a way to view users and the applications, they are connected to in real time using Netskope Publisher.  Linux Command Line: Commands or scripts that can display real-time connections, including the users and applications they are connected to. Netskope Dashboard: Any dashboard view or feature that provides live monitoring of users and applications.  Thanks!

250
M
N
nadkickNew Member III
posted in Next Gen SWG
O365 Reverse proxy - how to exclude Windows365

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

2333
ajit321aj
Netskope Partner
steveMC
Netskope Partner
steveMCNetskope Partner
asked in Private Access for ZTNA
Can Active Directory GPO policies be applied to remote devices using ZTNA?

Recently, we’ve encountered a use case we hadn’t seen before. Can GPO policies be applied to remote devices using ZTNA?What could you share about this? From what we’ve seen, it seems possible. Any advice?

542
steveMC
Netskope Partner
G
gabrieldmeidaNew Member III
asked in Private Access for ZTNA
ZTNA in SaaS infrastructure

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

441
S
Netskope Employee
M
Netskope Employee
mkoyfmanNetskope Employee
published in Next Gen SWG
Configuring CLI-based Tools and Development Frameworks to work with Netskope SSL Interception

If Netskope is deployed inline (for CASB or Web), some CLI tools will not work because they use certificate bundles distributed with those tools (i.e. Python distribution, for example), and they do not access system certificate store where Netskope client installs Netskope root CA. The guidance below will allow you to enable those tools to seamlessly work with Netskope SSL interception.In order for these tools to trust Netskope-signed certificates, they need to be configured to trust Netskope Certificate Authority (CA). This is typically accomplished by setting certain environment variables to point to Netskope CA to allow for smooth SSL operation.The variables need to be set to point to the following files that contain Netskope CA:On a Mac: /Library/Application Support/Netskope/STAgent/data/nscacert.pemOn Windows: %ProgramData%\Netskope\STAgent\data\nscacert.pemFor example to set REQUESTS_CA_BUNDLE variable on a Mac to point to the Netskope root CA, you can run this command:export REQ

92425
nicscott.dp
xavy2310
Netskope Partner
xavy2310Netskope Partner
asked in Private Access for ZTNA
POP ATL

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

421
zthompsoncr
Netskope Partner
K
kvdNew Member
asked in Next Gen SWG
Entra ID Scim - Sync all groups of the users belong to group X

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

311
E
cubiaz55
cubiaz55New Member
asked in DEM: Digital Experience Management forum
Best Way to use DEM for performance monitoring

Hey NS Community, Looking for some input on the absolute best way to use DEM to understand its value and how something like P-DEM could be pursued down the line. I have 2 main goals I am looking to accomplish:Which DEM graph is the most useful to investigate performance?  Ex: the network seems a bit sluggish, is NS playing a part in causing this latency? which graph is best to prove or disprove that.  Understand what my performance graph high’s and low’s mean were the low’s showing less demand from NS clients?  were the high’s showing a peak demand from NS clients?  

432
cubiaz55
M
mdecampsNew Member
asked in Next Gen SWG
How to disable Netskope Agent remotely ?

Hello,How to provide a Service Desk the capability to disable Netskope agent for users without giving them an access to the Netskope console and without providing them the  password to disable the agent (because we enable password protection against user agent deactivation) ?

935
ejang
Netskope Employee

Badge winners

Show all badges
Terms & ConditionsCookie settings