Product Forums

Hi all,we are looking to deploy Netskope IOS app to allow access to NPA internal Apps.I'vedeployed the netskpope root/inter certificatesDeployed netskope appnetskope app configurationVPN config profile (for per app vpn)scoped required internal app to use Netskope VPN. the per-app VPN apps selected do not have connectivity using VPN until i open the netskope app first. This is what happens when the netskope app is opened, after this app is opened everything starts working.  Can we make the IOS netskope deployment zero touch?    

Can anyone provide information/documentation in relation to Netskope as far as "how it handles" or "what it does with" voice and video traffic?We have an ongoing discussion within our org and want to provide more insight/identify potential root causes for delayed call acceptance and/or performance degradation with regard to Netskope.

Hello Everyone,can you please guide me in enabling fail close even when client is not installed and access method is IPsec/Gre. what configuration i need to do on firewall in o

I'm using the Netskope Provider version 0.2.5 for NPA to query for a list of Publishers based on a site code.netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform RegistryAccording to version 0.2.4 of the provider, I can filter on stuff in the query:netskope_publishers | Data Sources | netskopeoss/netskope | Terraform | Terraform Registry This simple query for site code (=key) works well:data "netskope_publishers" "all" {        for_each = toset(keys(local.datacenters))        filter = "publisher_name sw ${each.key}"} However, I'd like to match also on "tags" which is a list of strings, and I'm failing to get that query right. I have also tried deploying a Publisher with a tag via the provider, but is there any way I can display that tag in the GUI?

It is recommended to ensure the Netskope Client is running the latest Gold Release.   Steps to Maintain Latest Release: Using Desktop Application tools like SCCM/IBM tools OR Use Netskope's Auto-Upgrade option to Latest Golden Release  

Netskope Private Access (NPA) is a Zero-Trust Network Access solution that provides seamless access for users accessing applications.  One of the Zero-trust capabilities within NPA, Periodic Reauthentication, is based on an integration with your enterprise Identity Provider (IDP) such as Azure AD or Okta.   This capability allows the Netskope client to challenge the user via your Identity Provider for credentials and MFA to maintain or activate access to internal applications.  Administrators configure intervals for groups or OUs based on the security posture required.  For example, the below configuration would require a user to authenticate to my IDP every 12 hours with a 1 hour grace period before access would be revoked:   Depending on your enterprise’s security requirements, you may wish to always enforce MFA or specific access requirements.  This becomes a challenge if your Identity Provider caches sessions for a period of time which is increasingly common.  The mini browser used

Hello,I am new user of the community and I need help. I´m using the Jumpcloud to login the devices in my company in MAC, Linux and Windows and need that the client Netskope already be installed logged in with the operating system user.Currently, I install clients via script on 1200 devices and I need to ask users to log in to the tool to activate it. I know that with AD is possible, but the Jumpcloud (https://jumpcloud.com/) not work as a domain controller.  Is possible?

Netskope Advance Threat Protection does have a sandbox/research feature to investigate files that are downloaded with a sandbox examination, amongst other things.  Having an alert later on that a file is malicious gives a reason for follow-up on that person/computer. They also have a policy suggestion, where novel files are not downloadable until after they pass a sandbox exception.  The devil is in the details "The Netskope advanced threat engines can take up to 10 minutes to analyze the file."  Also, in practice, if you the download just fails for 10 minutes of clicking on it, no pop-up warning you that it is in review. So I am dying to know - has anyone actually done this policy? I am also fascinated by the policy example, where the policy is applied to downloads of Adult Content and Adult Content - Porn.  The net effect would be "As a company it is OK to go to a porn site and download from it, but you have to wait 10 minutes while we check out the

Hi Folks,I have an Arch Linux device which we would like to get behind Netskope. The OS on this device can't be changed and while I am thinking we could take a few different options I thought I would have a crack at convincing the Netskope Client to work.It installs and enrols just fine, however, once running there seems to be an issue between the client and the stAgentSvc. The `nsclient` command will report unable to connect to service. Diving a little deeper with `strace` and I can see a connection reviews to the UNIX socket `~/.netskope/stagent/apps`, which would indicate the stAgentSvc is not in a good state.I have not been able to identify where or what might be the cause of stAgentSvc not working - despite a fair chunk of reviewing debug logs and strace output. Has anyone come across this problem on a Linux device before and resolved it?Thanks in advance for any help.

We are just getting started with the Advanced Analytics and one of the 1st reports we were asked to run is Top Uploads for the past 7 days.  Report ran great and is full of useful data.  One area I cannot figure out though is Uploads to YouTube.While I do not believe we have "content creators" uploading while at work, the data is still questionable.  Searching the web for info all leads back to uploading a video.  I did find YouTube does have tracking capabilities beyond cookies. Looking at just one user at our corporate office, showed only around 1Mb of data uploaded.   This is more inline with what I found online with the tracking.  The top user for the week was around 805Mb.  So not  “content creator” I would think, but makes me wonder just how much tracking is going on.This top user also had 60 hours of viewing time.  (To be addressed separately) But could the tracking account for 805Mb?Anyone else seeing this an

Hi 🙂 In my laboratory I did the configuration to be able to resolve names.At first it worked, I was able to access the application by name/FQDN via HTTPS, network sharing and gpupdate. It stops working out of nowhere, sometimes when restarting the NPA it starts working again and sometimes it doesn't even restart. I stopped the service, stopped the process, renamed the logs folder, to only have new logs.I enabled debug, reproduced the error and got the logs.I found error message 11001 and several other errors.Has anyone seen this error? Any tips?

DC and DR internet links have been choked as there is a heavy utilization over netskope. we raise a ticket over TAC but no resolution found as per my knowledge user client traffic is acting as DPOP traffic where in we are not able to trace out this abnorml

The majority of performance related issues faced while attempting to leverage Netskope for visibility and control on conferencing apps is root caused to improper configuration of the web conferencing app best practices associated with the UDP traffic.   Why: UDP protocol is best suited for real time audio and video traffic If customer has not enabled the necessary UDP ports when on premises, real time traffic will fallback to TCP and steered through Netskope “Using TCP in a near congested network will cause retransmissions, which in turn can create a choppy video or low bandwidth error experience. UDP does not retransmit, and will provide a better video experience.” How: Please ensure you have opened/sent direct the necessary UDP ports for the below apps: If that connection can not be established, Zoom will also try connecting using TCP on port 8801, followed by SSL (port 443). Microsoft Teams: UDP port 3478 to 3481 (see article for details) Google Meet: set up outbound U

Summary During certain troubleshooting situations, Netskope Support may request various debugging output from the Google Chrome Developer Tools (DevTools for short). Specifically, HAR (HTTP Archive) is a file format used by several HTTP session tools to export detailed traffic data for analysis. Environment Users experiencing cloud app page loading or performance issues while using a browser. Application access issues Reverse proxy (SAML/Auth).   Cause Netskope Support and Engineering require HAR debug output from the affected client to provide app traffic data for analysis. Resolution If requested by Netskope Support, please provide the HAR debug output with the following instructions (please reference the following link for additional details: (https://toolbox.googleapps.com/apps/har_analyzer/)  Warning Please be cautious that the HAR capture will have sensitive information like Application login Username, Password etc in clear text. 

Sonoma is coming out on the September 26th. Does Netskope have any statement on whether it is supported? If so, which version of NS client?  I have not been able to see anything here or the support portal. Thank you. 

Hi team,There is one use case of server where they required a PAC file to be configured in there servers to connect the netskope dataplane can you let me know any configuration or pre-requisites is required to server connect with Netskope Dataplane Also please let me know the use cases of static server which required internet.

Dear,Today I have two policies for using WhatsApp web, one for all employees to access and send written messages, but downloading and sending files is blocked.Second policy that is full.Today I release it via online account.What I need today is that only those who have a corporate cell phone can access this, using a corporate cell phone, from what I was able to search for by cell phone number, it is not possible to make this limitation, but I don't know if I can do it through the mac address of the cell phone from the device and so I no longer use the network account.Could you please help me

Hello, I am noticing that when we have users in office connected to our Wi-Fi on site, Netskope is saying they are remote. Netskope Configuration shows "Private Access: Connected". My current user that is experiencing this is showing an on-prem IP address though. Has anyone experienced this?

is there a way to create an alert to detect the movement of files that have a mismatched file extension?i know Netskope will do its inspect of the file but i would like an alert on this as an indicator of risky behavior.

How would you write the rule expression for this:(P0) - Passwords (Contextual)(C0) - Custom Passwords(C1) - Custom Word 1(C2) - Custom Word 2I want to look for P0 or C0 as long as either is NOT NEAR C1 or C2. The UI doesn't let me build the write logic. Ideally, I think I would want this (which isn't allowed in the UI): ( P0 OR C0 ) NOT NEAR (C1 OR C2)

We recently retired our VPN infrastructure and are using NPA for all private apps. I have attached a PDF that shows the configuration changes required on Mac systems for NPA to function properly. This covers disabling Secure DNS, Privacy & Security settings, disabling IPv6, disabling the QUIC protocol in Chrome, public DNS servers. Enjoy 😉

What is Web Socket terminology used in Netskope?

Hello team,We need to develop a custom template for a customer in order to monitor some specific settings in their configuration.Does Netskope allow the inclusion of custom SaaS Security Posture profiles?

Hello,We’re looking for some information regarding PII regulation profiles equivalent to GDPR but customized for the LATAM requirements or regulations.Do we have predefined profiles for this region?

  Hello community, I would like to know if Netskope can control some of the following activities across social networks or collaboration tools: - Login, logout, block, approve, join, mark, request, unfollow, create and delete… Thank you in advance.