Product Forums

Tired of outdated VPNs? Discover how to make the leap to Zero Trust Connectivity from a Netskope customer! Jeff Wehrman, Sr. Staff Cybersecurity Engineer, at Dexcom will share how he successfully retired their VPN with ZTNA Next in this webinar.   November 15th - 8am PST November 16th - 3pm AEDT   What you will learn: Hear about the major ways that remote access has evolved over the past three decades Learn deployment lessons from a Netskope customer who has successfully retired their VPN Witness Netskope ZTNA Next in action with a live demo

Summary With release R99 Netskope introduced a new feature “Periodic Validation on Device Classification” which is very important to enforce Zero Trust principles. Before that release, Device Classification of the client was only accomplished, when client service was started. With the new feature a validation interval can be configured for more frequent device posture checks. Requirements: NS Client version R99 or later is required. Please contact your Customer Success Manager, Netskope Support or your Account Team to get this feature enabled.  Today this feature is disabled by default!   Tenant Configuration Device Classification Profile The “Device Classification Profile” is a policy about a single or multiple checks, whether a device is compliant or not. This part of the configuration has not changed and will not be covered in detail in this post. Here is the link to public documentation. For testing on Windows a simple profile can be created to check if “notepad.exe” is

Dear Friends, Good Morning! Can somebody tell me how to remove the Netskope client from a Mac?We are unable to uninstall it from the application list, therefore please advise whether there is another way to uninstall Netskope agent from a Mac workstation, such as a command or script.

Suppose we have two gateways i.e SWG and NPA gateways and both the tunnels are established between respective gateways and the client. How does Netskope client understand where the traffic should be routed?  

Hi,  We have a real time policy to trigger alerts for any DLP violations for Chat & Other IM Categories. We have however not been successful in getting any alerts with DLP profiles on. I would like to know if DLP works on Telegram and Whatsapp for users that's accessing these apps via browser. I have noticed from the CCI that some of the activities are not supported. Happy to hear your thoughts on the same if you had a similar use case. Thanks!

Recently observed that Android Studio Issues on MAC devices even after exempted Android Studio from Netskope Proxy. Users using Android Studio are not able to connect to devices on wifi in the application. Is there is any issues with Android Studio with Netskope for MAC devices. 

We have an internal AWS hosted app, thats not reachable from the internet, and we need to provide access to an external partner that doesn't have the NS Client. Can I use NPA and configure a new private app with Allow Browser Access enabled to do this? Or, what are other good options? Thx

Hello Team, Users can't use the NPA Application when the DNS server is set to IPv6. It appears that NPA can't work with IPv6 DNS queries to match the SRP installed. I found some community posts for MAC OS where users recommended turning off IPV6. Does NPA work with IPV6 DNS servers, or are there any limitations?

Hi, I am facing some issues  with Git-hub download activity controlChecking here if anyone have an experience who can put some light and help to find solution Our requirement for Git-hub realtime protection is :-User allow to view any files (any file type)User allow to click on “Raw” and view the details of that fileWhen user click on ‘Download”, this activity should get blocked. Issue :-When user click on ‘Raw”, it is showing activity Download in the Netskope logs and getting blocked. I have checked the logs for both the activities ( when click on Raw Data or  Click on Download ) showing as Download. Any way we can only block the actual download action ( not when users are clicking on Raw data). Thank you in advance.Regards,Kunal Gandhi

Anyone using the new SMTP DLP functionality? If you are, how are you doing your alerting to users about blocking/intercepting emails? 

I really like the ability to now easily see all identified app instance in SkopeIT -> Applications -> Instances. However, not having the ability to export the list as a CSV is frustrating. Is this option coming soon? Thx.

How can I deploy clients on Mac devices using Sure MDM? I looked for documentation but didn’t find any.

Netskope SaaS Security Posture Management (SSPM) is a powerful, highly customizable platform which brings the security configuration and asset management of your entire SaaS portfolio under one umbrella. In our series of articles within the Netskope Community Site, we showcase some powerful capabilities and use cases to take your posture management to the next level.   In this article, we show you how you can use NGL to traverse the graph structure we use for modeling supported SaaS platforms to address advanced use cases for security, compliance and monitoring within your environments. The article is intended for a Google Workspace security administrator who has already onboarded their tenant to the platform and has an elementary understanding of how the Netskope SSPM platform works. For more information on how to get started with using SSPM with Google Workspace, you can view our earlier article on Securing Google Workspace.   Consider a User within Google Workspace, who is

I'm trying to build a module (currently just playing with locals directly in main.tf) which will build an instance of a private app. for each DC and tie it to the local publishers in that DC. That part is working, but I am failing to also tie the protocols fields correctly in and iterate over those as well, as the attached code will fail if either of the protocol ports fields are empty (in the case where an app only has tcp or udp ports defined). @sshiflett ?

 If you are deploying Netskope SMTP Proxy few notes of interest. (Various screenshots of interest attached). 1. If your upstream has SPF check ensure to add following record to your DNS server  so that the SPF check does not fail _spf.goskope.com 2. To allow Netskope IP's refer to the following list 2.a If you are using Proofpoint as the upstream MTA there is a tweak to allow these IP's.Proofpoint does not accept CIDR ranges. Also adding in CIDR notation e.g. /24 did not help in my case.Use the following format (first 3 octets only) (screenshot attached) 163.116.1288.36.116 NOTE: for complete list of IP's subscribe to this article. There is a table for SMTP Proxy "Netskope Email DLP (SMTP) List for AllowlistingThe following list of IP ranges represents where SMTP traffic may egress from Netskope's NewEdge Security Cloud, and should be used for permitting traffic with upstream email providers. Netskope's recommendation is that customers' add all IP ranges when configuring allowlisting w

Hi,I'm trying to use the REST API V2. All the documentation I find refers to two REST API options in the Settings -> Tools menu: REST API V1 and REST API V2.However, the Admin console shows (in Setting -> Tools) only one option: "REST API".Is this the REST API V2? If so, where is the Swagger API Documentation (https://docs.netskope.com/en/netskope-help/admin-console/rest-api/rest-api-v2-overview-312207/#swagger-api-documentation)?If not, then how can I create a Token for using REST API V2?Thanks!  

Hi Folks,We have a few users that have real difficulty with reestablishing connectivity via netskope when their macs come out of sleep/hibernate. The common thread between them is that they are also using dongles with ethernet connections to the internet. One fix that appears to help some users is turning off IPV6 ( changing to link-local) on any ethernet dongle that is attached. Curious if others are seeing this issue. Thanks!

Has anyone have a setup where you roll out Netskope client to all your endpoints and configure Azure AD conditional access to allow connections to Microsoft services if they come via Netskope IP? we are doing this as part of our own ZTNA setup to only allow trusted devices/location.  The setup works well with one minor problem. Netskope will have occasionally tunnel down/up (e.g. switching from LAN/docked to Wifi, etc) and that causes netskope to disabled momentarily before re-enabling again. (which means momentarily it shows attempting connection from non netskope IP) This then lead to services e.g. teams, outlook etc require authentication immidiately which is not the best end user experience.  Has anyone encounter this and able to suggest solution/workaround? I dont want to change trusted location to country based as that defeat the purpose of the ZTNA we are doing.

Can anyone else confirm? It seems starting yesterday anytime you interact with ChatGPT with Netskope enabled (steering and decrypting) you get the following attached error. Using a Do Not Decrypt rule fixes the issue.

Hi all,we are looking to deploy Netskope IOS app to allow access to NPA internal Apps.I'vedeployed the netskpope root/inter certificatesDeployed netskope appnetskope app configurationVPN config profile (for per app vpn)scoped required internal app to use Netskope VPN. the per-app VPN apps selected do not have connectivity using VPN until i open the netskope app first. This is what happens when the netskope app is opened, after this app is opened everything starts working.  Can we make the IOS netskope deployment zero touch?    

Can anyone provide information/documentation in relation to Netskope as far as "how it handles" or "what it does with" voice and video traffic?We have an ongoing discussion within our org and want to provide more insight/identify potential root causes for delayed call acceptance and/or performance degradation with regard to Netskope.

Hello Everyone,can you please guide me in enabling fail close even when client is not installed and access method is IPsec/Gre. what configuration i need to do on firewall in o

I'm using the Netskope Provider version 0.2.5 for NPA to query for a list of Publishers based on a site code.netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform RegistryAccording to version 0.2.4 of the provider, I can filter on stuff in the query:netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform Registry This simple query for site code (=key) works well:data "netskope_publishers" "all" {        for_each = toset(keys(local.datacenters))        filter = "publisher_name sw ${each.key}"} However, I'd like to match also on "tags" which is a list of strings, and I'm failing to get that query right. I have also tried deploying a Publisher with a tag via the provider, but is there any way I can display that tag in the GUI?

It is recommended to ensure the Netskope Client is running the latest Gold Release.   Steps to Maintain Latest Release: Using Desktop Application tools like SCCM/IBM tools OR Use Netskope's Auto-Upgrade option to Latest Golden Release  

Netskope Private Access (NPA) is a Zero-Trust Network Access solution that provides seamless access for users accessing applications.  One of the Zero-trust capabilities within NPA, Periodic Reauthentication, is based on an integration with your enterprise Identity Provider (IDP) such as Azure AD or Okta.   This capability allows the Netskope client to challenge the user via your Identity Provider for credentials and MFA to maintain or activate access to internal applications.  Administrators configure intervals for groups or OUs based on the security posture required.  For example, the below configuration would require a user to authenticate to my IDP every 12 hours with a 1 hour grace period before access would be revoked:   Depending on your enterprise’s security requirements, you may wish to always enforce MFA or specific access requirements.  This becomes a challenge if your Identity Provider caches sessions for a period of time which is increasingly common.  The mini browser used