Product Forums

Given an application in NPA, which has both TCP and UDP ports as part of the app. definition, how does the Publisher App Reachability check work?I have an application/server, which is in fact currently unreachable (due to a NAT issue in a firewall) from the defined publisher(s), which has both TCP and UDP ports as part of the app. definition in NPA.This app is incorrectly marked as Green in the portal, but if I remove the UDP ports from the app. definition, the status correctly turns Red.So, the questions is, if adding UDP ports to a private app. simply means, that the Publisher App Reachability check will automatically turn Green, as a UDP check makes no sense? --Erik    

What could be the reason why the WhatsApp application is experiencing issues when uploading or downloading files on our iOS devices, even though there are no policies in place that should restrict these actions. How can i bypass the whatsapp application on iOS devices?, i haven’t found the procees that i need for the certificate pinned application config. Thanks for your comments  

I have a subset of users on Mac device that are telling me that meetings (Google Meet, Slack Huddle etc.) are very choppy. I have added google.meet.com and Slack URLS to the steering domain bypass. But still having issues, I see in alot of these users logs:Tunnel down due to errorDetected Dead PeerThe below is seen the most:Tunnel down due to errorTunnel Down Due to SSL Error I have had users disable IPv6, power cycle their home modem and router, some have contacted their ISP and click renew DCHP many times. Any thoughts?

Hi team,We noticed that DNS TXT record response originally includes multiple entries, but after processing through Netskope, only a single entry remains.Not sure if it is because on our tenant DNS Security is enabled. Does anyone also face the same issue?

Is there a way to dump out the Network Locations and which IP address are contained in each?

We're gradually expanding our NPA footprint in our company. Recently the first user needing the use of Avaya One-X Agent was looped in and the log-in fails. We've had the app configured for some time now but no testers until now. I have some internal discussions going with the involved teams but wanted to reach out here to see if anyone has any useful tips/experience implementing NPA access to a softphone solution. Of course, Avaya related products would be ideal, but any information would be welcomed. 

Under Security Cloud Platform > Traffic Steering > App Definitions add ability to Disable. currently only supports edit and delete

Hi.I am a Netskope user in Japan. Currently, I am facing difficulties because the following cloud services in Japan cannot be controlled by CASB.It is causing significant inconvenience.I strongly request these services to be supported. Application Name: CryptobinURL:https://cryvia.cryptobin.jp/crypto/usr_index.action Application Name: Dokodemo Cabine,URL:https://dococab.tayoreru.com/login.html Application Name: HENNGE Secure Transfer  URL: https://transfer.hennge.com/#/login

Hi all, because of privacy reasons, we don’t want Netskope to pass along the X-Forwarded-For-Header containing the public IP address of our users to the Internet.. The following website tests can be used to prove that Netskope always provides this information.notskope.comBrowser Spy (gaijin.at) How can we disable this Feature of Netskope? We don’t want Netskope to pass along the original public IP of our users ...The setting for the XFF Header unser Settings → Security CLoud Plattform is set to “Do not trust” but it has obviously nothing todo with our problem: In our current on-premise proxy we had the option to remove theXFF Information: 

The current AWS AMI for a Publisher is still using Ubuntu v20.x, which is end of life very soon. Netskope has published multiple articles noting Publishers should be upgraded to v22.x. Why is this not updated? 

Hi,If a customer has a corporate site where they configure Cloud Explicit Proxy as a steering method and they have clientless devices, such as servers, and the customer wants all traffic to be authenticated, what is the difference between configuring a SAML Forward Proxy account to authenticate this traffic and configuring a Reverse Proxy as a Service on the Netskope tenant? Additionally, which option is the best approach?If the clientless device is a BYOD from a third-party worker, I assume that the best option would be to use the Reverse Proxy so that they don’t need to change the proxy settings on the device. But what about servers or corporate-managed clientless devices? What kind of authentication method should be used for them, and what are the differences, if any, between these methods? Thanks! Regards

Hi Netskope community,  I’ve deployed NPA for my company for several years now, with the re-auth feature enabled (every X days). This feature is leading to some difficulties in autopilot context + comes with few “bug” here and there, with complains from few users requiring to manually re-auth. While reviewing those problems, I’m challenging the utility of this feature in my context:I have Windows 11 environment, all devices hybrid joined when the auth expired, there is a popup appearing, getting the local windows auth token automatically and disappearing by itself after few seconds I have a conditional access rule in azure disabled MFA for NPA app when it comes from trusted corporate device. Nobody in the company had to enter credentials because the auth is always OK since it comes from local windows session.In this situation, for windows corporate laptop, I’m wondering if there is any reason to enable this feature from a security standpoint.I know that Netskope is recommending to acti

Hi all - we have configured browser access for a private app. Everything works fine with the authentication flow with our IdP into the private app through the normal reverse proxy public host URL. We have set the CNAME of a custom host to revert to the public host URL. When we go to the custom host URL, it goes into a loop where it authenticates fine then tries to resolve to the custom host (not the public host reverse proxy URL) and creates an indefinite loop (IdP → netskope SAML → IdP). We confirmed with the SAML tracer that it indeed keeps resolving to the custom host URL and not the public host URL as intended. Anyone had the issue and hot to resolve it?

Is there documentation that talks about and establishes differences between the Data plane, Management plane, and localization zone?I'd like to know what each function is.

Hi  We are using the ZTNA Multisession with Azure virtual desktop at the moment and all working well so far using virtual desktop. User can launch virtual desktop, netskope automatically enroll and authenticate after that and user can start access on prem app … Now instead of publishing virtual desktop we need to publish virtual application through Azure virtual desktop What we have seen is that most of the time virtual app is launched well before netskope can enroll and establish causing the virtual app (URL address) not be able to displayed/access For now when publishing virtual application we need to put the time delay in there for 1 or 2 minutes before actual URL/App is launching so to give neskope agent enough time to establish (Private access and Internet gateway) is there any better way to accomodate this task? Any script can be done to check the status of netskope before actual launching the virtual application? 

Hi, has anyone found a way to do bulk URL lookups? I have 100’s of URLs that I want to find their associated categories of. I’ve tried using Advanced Analytics, but it seems unreliable to give me the pre-defined Netskope categories that I’m searching for. 

Hey,We have reverse proxy in place for O365 apps for devices without Netskope client. Now we finally want move away from providing physical hardware to consultants / external project members and replace it with providing virtual machines via Windows365. This ensures all these third parties needing access to our environment are doing this from machines we control. All works fine when an employee with a managed device wants to access such a virtual machine (because reverse proxy is bypassed by having NS installed) but as soon as a non-company person now wants to access W365 machines we provide, reverse proxy kicks in and causes an error what prevents these users to continue and start these machines (see screenshot). How can we exclude Windows365 traffic from reverse proxy? Is this something to configure on Netskope or IdP (Okta)? Thanks!Nadja

Hello, I am implementing ZTNA in my company, but I have some questions.My current environment for internal applications relies on a VPN, which ZTNA will replace. However, I would also like to enable ZTNA access for other environments (AWS, GitHub, GCP, etc.). Since these are SaaS environments, is it possible to use ZTNA for them?Or is ZTNA only applicable to internal systems?

Greetings, I'd like to know how the Netskope client identifies its closest POP and how I can change, for example, the POP IP within a client to point to another and run latency tests?

We've setup the Entra ID SCIM configuration. We've created an Entra ID Enterprise Application and added 2 user groups. What i want is to only sync users from these groups to NetSkope but i also want all the groups the users are member of to be presented in NetSkope. When we have access to all the groups we can create realtime protection rules to private applications based on application groups we already use in or IAM proces. Is this possible? Or do i need to sync all users and all groups?

Hey NS Community, Looking for some input on the absolute best way to use DEM to understand its value and how something like P-DEM could be pursued down the line. I have 2 main goals I am looking to accomplish:Which DEM graph is the most useful to investigate performance?  Ex: the network seems a bit sluggish, is NS playing a part in causing this latency? which graph is best to prove or disprove that.  Understand what my performance graph high’s and low’s mean were the low’s showing less demand from NS clients?  were the high’s showing a peak demand from NS clients?  

Hello Team We identified what’s probably a missing feature for CFW/NPA.https://docs.netskope.com/en/time-based-policies/ are available for SWG but they don’t see to be available in CFW/NPA ? This feature is useful to time bind certain sensitive access for user outside of their working hours.If you have different suggestions on how to achieve the same result please do let us know

Good afternoon, thank you for your time and good vibes.I have the following situation:We know that by default at Global level, Netskope, is blocking sites with self signed certificates.In certain cases there are sites we say "known" somewhat controlled, where there are VPN access portals, sites or systems with self-signed certificates, etc..Now the idea is not to apply it globally, but by means of exceptions, so as not to allow all sites with self-signed certificates, but only some based on need and demand.Then I tried to apply a web policy, with action Bypass and it did not work, it still shows the blocking of sites with self signed certificate, as I did not intend to allow it globally, I added a policy, of SSL decrypt, to not make decrypt to a custom web category, that contains these sites, to omit or bypass the blocking. Well this worked, but with this I feel that we lose visibility and inspection to these sites, therefore, please clarify what is the position, recommendation, proced

Hello enthusiasts, I have been configuring the device classification rule for iOS devices with criteria “REQUIRE PASSCODE” only. Although I have removed the passwords in test device (iPad) the Netskope found to be unable to detect the device as “unmanaged” hence the Realtime policy I configured against the “unmanaged devices” did not work as expected. I would request all the folks who have expertise in this matter to help me with your valuable guidance to troubleshoot and fix this. Meanwhile I am testing all the possible scenarios to fix this. Regards,Saifin Thomas

Some context related to user regulation, we found that once users are imported, we can not delete them on the console.We would like to control that only certain users can use Netskope service but integrated idp will have all employee information including ex-employees, so they can still using Netskope SSE and we can only manually set blocking policy to stop their access.In this case, we haven’t come out a way to grant only rightful users to enable Netskope clients, and stop/remove Netskope clients from their byod.Does anyone have any suggestion on this?How can we develop a better user regulation mechanism to enable correct amount of licensed user?Thanks a lot.