Product Forums

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

Hey NS Community, Looking for some input on the absolute best way to use DEM to understand its value and how something like P-DEM could be pursued down the line. I have 2 main goals I am looking to accomplish:Which DEM graph is the most useful to investigate performance?  Ex: the network seems a bit sluggish, is NS playing a part in causing this latency? which graph is best to prove or disprove that.  Understand what my performance graph high’s and low’s mean were the low’s showing less demand from NS clients?  were the high’s showing a peak demand from NS clients?  

Hello Team We identified what’s probably a missing feature for CFW/NPA.https://docs.netskope.com/en/time-based-policies/ are available for SWG but they don’t see to be available in CFW/NPA ? This feature is useful to time bind certain sensitive access for user outside of their working hours.If you have different suggestions on how to achieve the same result please do let us know

Good afternoon, thank you for your time and good vibes.I have the following situation:We know that by default at Global level, Netskope, is blocking sites with self signed certificates.In certain cases there are sites we say "known" somewhat controlled, where there are VPN access portals, sites or systems with self-signed certificates, etc..Now the idea is not to apply it globally, but by means of exceptions, so as not to allow all sites with self-signed certificates, but only some based on need and demand.Then I tried to apply a web policy, with action Bypass and it did not work, it still shows the blocking of sites with self signed certificate, as I did not intend to allow it globally, I added a policy, of SSL decrypt, to not make decrypt to a custom web category, that contains these sites, to omit or bypass the blocking. Well this worked, but with this I feel that we lose visibility and inspection to these sites, therefore, please clarify what is the position, recommendation, proced

Hello enthusiasts, I have been configuring the device classification rule for iOS devices with criteria “REQUIRE PASSCODE” only. Although I have removed the passwords in test device (iPad) the Netskope found to be unable to detect the device as “unmanaged” hence the Realtime policy I configured against the “unmanaged devices” did not work as expected. I would request all the folks who have expertise in this matter to help me with your valuable guidance to troubleshoot and fix this. Meanwhile I am testing all the possible scenarios to fix this. Regards,Saifin Thomas

Some context related to user regulation, we found that once users are imported, we can not delete them on the console.We would like to control that only certain users can use Netskope service but integrated idp will have all employee information including ex-employees, so they can still using Netskope SSE and we can only manually set blocking policy to stop their access.In this case, we haven’t come out a way to grant only rightful users to enable Netskope clients, and stop/remove Netskope clients from their byod.Does anyone have any suggestion on this?How can we develop a better user regulation mechanism to enable correct amount of licensed user?Thanks a lot.

I want to be able to route an internal app through NPA, but also be able to apply DLP policies to it. An example would be to present an authorized employee with a user consent notification popup at login. Or a DLP policy to prevent PHI from being posted, etc. Could this be done by creating both a Private App and a Cloud App using the same domain name?

Can anyone help me in understanding the below error logs and what could be the issue here.Thank you in advance! User's Netskope client is in disabled state. 2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error NSCom2.cpp:863 NSCOM2 bind failed on sever socket 100132023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:2147 nsAgentSvc Token not found in the client name2023/04/20 10:50:32.663 stAgentSvc p1484 t48d0 error stAgentSvcEx.cpp:1225 nsAgentSvc Failed to get session details on NSCom error

Hi team, is there a way I can query a specific publisher’s publisher ID using Rest API? I am looking to automate the creation of private apps with designated publishers. It looks like publisher ID is required when creating private apps with assigned publishers. Thanks in advance! 

Team,I have a website URL port 443 configured for NPA due to Geo-restrictions. I have developers that need to access a US site. I have a Publisher in my data center in the US behind a gateway public IP of 168.xxx.xx.x. When my user hits the web URL, they get a 163.xxx.xx.x address. Shouldn’t the NPA website URL use the local gateway address for egress traffic? It appears the NPA traffic is using the SWG tunnel.  Thanks. 

Hello Skope community!I hope everyone is doing well.I would like to tell you that I have related IDP configuration with AzureAD for the install via IDP, using reverse proxy for NPA access over Web-browser, among other experiences with Netskope in labs, POC, production environments, among others.Now I have to configure Reverse Proxy for the following environment.-Control access to office 365 suite (Sharepoint, Onedrive, Outlook, etc.)- IDP Azure-AD / Entra ID.Environment with users with Netskope agent, with steering profiles forwarding all office 365 (SSL Exception Pining Apps O365) to Netskope.Environment with users with Netskope agent, with steering profiles with bypass of office 365.What is sought with the use of Reverse Proxy, control access, upload, download, authentication, etc. to Office 365, of unmanaged computers.I have already been in the process of analyzing and reviewing Links to document and be able to read, analyze and acquire information for the configuration.https://docs

At the moment, our client they are using their in-house IdP for SAML auth.For connecting other solution through SAML, they require same information as forward proxy described: ACS URL Entity ID (service metadata)But we failed to find SAML Proxy IdP URL and SAML Proxy ACS URL.Does anyone know if IdP URL here is equal to entity ID? All the best,Allen

when I modify a policy or configuration change it takes a long time to apply the changes and I have to force the client to apply them (deactivating and activating) does anyone know another way to apply them automatically?   attached client screenshot after adding an exception in Security Cloud Platform > Traffic Steering

I currently have DLP policies that monitor and control users interacting with the Google Gemini app/website. They now want to enable the Gemini feature in Google Workspace, which would then use the embedded feature in Google Meets, Google Docs, etc. Is there a way to monitor this additional traffic with Netskope? FYI, I already have the CASB API connector for Google Workspace, but its limited to Gdrive and Gmail..

Is it possible to create a dashboard representing what actions an analyst has taken on a DLP “file” incident?The analyst can “Change File Permissions” with a dropdown of actions and/or “Contact Users”.Our analysts don’t assign the incidents or resolve them they just take actions since we use a separate case management system.  I’d like to report on actions taken and the incidents/files that were associated to the action.

Greetings,We’ve been excited about enabling the prelogon tunnel feature for NPA for some time now, but have been hesitant to do so without properly securing access by machines via the certificate method outlined in the following article: https://docs.netskope.com/en/windows-autopilot-with-private-access-prelogon/Per this article’s “Generate and Distribute Machine Certificates” section, “This section covers an optional but highly recommended set of steps required for machine certificates generation, signing, distribution and enforcement, which improves security and reduces risks associated with unauthorized access over a prelogon tunnel.”It strikes me that the best practice for prelogon enablement would be coupled with Netskope verifying machine certificates as part of its device classification; I went through the steps of setting up the certificate template in our environment, in addition to configuring the Intune Certificate Connector. However, not long after a third-party assessment/