Product Forums

We recently enabled SWG, and file transfer download speeds are extremely slow. Is anyone else having this issue? We enabled DTLS as recommended by Netskope, but that did not fix the problem.

Hello friends,Someone has already had the problem of adding an application in bypass .. accessing this application in the cloud is via CLI , when accessing I receive this error when the client is active and NPAwithout NPA active, only the client passed the err "an unknown error occurredI noticed some errors without debugging  NSCom2.cpp:1850 NSCOM2 message INST_CERT_IN_FF sent from server to "nsClientUI_s2" client with count 1 stAgentSvc p1404 ta9c error registry.cpp:160 registry RegOpenKeyEx failed, err: 2stAgentSvc p1404 ta9c warn proxy.cpp:155 nsUtil Failed to auto detect proxy or download PAC file, error 12180stAgentSvc p1404 t3a4c info fileUtil.cpp:83 nsUtils failed to open file for reading: C:ProgramData etskopestagent/data/authtoken.pem, err: 2 stAgentUI p117c t3374 error NSCom2.cpp:1527 NSCOM2 client socket connect failed 10061 Does anyone know what could be goi

We have some sites we need to bypass so that the traffic comes from our own IP address ranges. When those sites are behind AWS Elastic Load Balancers or Azure Frontdoor we're suffering frequent steering failures. E.g.User tires to access OurSite.Example.com from our office LANOurSite.Example.com is a CNAME record that resolves to ELB-Frontdoor-Unique-ID.CloudService.com, ELB-Frontdoor-Unique-ID.CloudService.com itself resolves to a generic ELB-Frontdoor.CloudService.com address, and ultimately ends up with one or more IP addresses.OurSite.Example.com is in our bypass list.Hosting systems that provide OurSite.Example.com have filters/firewall rules configured to prevent access to the site unless the source IPs are ones assocaited with our office LAN.Client logs show OurSite.Example.com is bypassed.When it works that's all that shows in the logs.When it fails the logs then show that the traffic to ELB-Frontdoor-Uni

How are other customers tuning the UBA Bulk Upload (and Download)? These 2 policeis seem to be the noisiest and have the most "false positives". There is no way that I can tell to have an exception for specific apps. For example, the Brave sync applications. This local app is constantly uploading small data about its browser (for sync purposes). I would love to exempt that from the Bulk Upload UBA policy.

Just want to know how the Netskope certificates get installed on the system automatically by any backend mechanism and how the system knows that the installed certificates in from Netskope. This would be very helpful for me to know the backend mechanism.  

Hello all, We are at the tail end of our Netskope deployment and having some hesitation with rolling out to one department. This department has users that work remote on company issued devices and have to complete an RDP connection to a device on-site. We've tested eliminating the need for the RDP connection with NPA, however the files they need to access are quite large (2GB +) and are located on an on-prem server. When they have used our VPN or NPA it can take upwards of 20 minutes just to pull down one file. We want to have our SWG policies apply to this group, but not have NPA active for them. I've tested creating policies to block NPA access, but that creates an unnecessary amount of noise for the user. I'm hoping someone can point me in the direction of how to disable NPA for these users prior to deploying the agent. Thanks for the help!

What are the sources of the "Compromised Credentials" information?Does "Compromised Credentials" include credentials traded on the dark web?

The client is migrating virtual servers and the NPA publishers are located in them. The query is where I can change the name of the network card because it does not allow me to modify the value and it is necessary to clone the equipment and make it functional.

I need deploy Netskope Client with a Windows Golden ImageMy support team have a golden image and install Netskope client. Close the Image and deploy this imageBut in Netskope report I an see that appear Duplicated "Unique Device ID"This Duplicated "Unique Device ID" can deleted? having a duplicate GUI for the NEtskope client affects or notWhat is the best method to distribute the netskope agent using a golden image?

Hello All,I'm hoping someone can help me. I am just trying to find out if Netskope has a language pack (Spanish, French, etc...) or the capability to detect DLP incidents in various languages, similar to how Symantec/Broadcom can. If so, can someone point me in the right direction of the setting in the tool? If not, can someone tell me if this capability is on the Netskope roadmap for the future? Thanks in advance! 

Hi Team, I have a problem with the android client:if I turn off the phone and turn it back on the NS client does not activate automatically but it is necessary to click on the application to start the VPN profile. Is it expected behavior? Thanks,Nicola

Installation on cell phones of Netskope client ( IOS and Android ) Hello community, good afternoon: A question, can you support me with the following points please, thank you for your time. Android --For the installation of the Netskope client, on Android phones is completely transparent ? that is to say you install the application, you accept that the VPN profile is generated and everything is transparent for the blocking of websites on the cell phone is executed ? or you must manually install a certificate ? if you have to install it from where you download ? or should be completely transparent to complete the installation process and is ready for use, once connected ? IOS--For the installation of the Netskope client, in IOS cell phones it is totally transparent ? that is to say you install the application, you accept that the VPN profile is generated and everything is transparent so that the blocking of c

Netskope Client iOS and Android Apps  Hello community, how is everything going ? As always, thanks for the collaboration and good vibes.I have some issues with a couple of apps. 1.-Whatsapp App:Whatsapp App from IOS and Android, I performed the installation of the client, profile, etc all good all operating correctly for both IOS and Android. By Netskope Whatsapp is not an app qualified as certificate pinning at least not by default or suggested to add.The issue arises in the case of sending images, chats and messages, links all OK in both cases IOS and Android, the problem arises with sending files and images, when you try does not allow it. There is no blocking or impediment at the level of policies, permissive policies are generated to the APP and URLs, but the issue remained the same. Reviewing the domains in the CCI I noticed the domains whatsapp.com and whatsapp.net. When generating an exception at Steering

As for today NPA on NSClient doesn’t capture DNS requests sent over TCP 53 unless “Publisher DNS” is configured in the Private Application. Netskope is aware of this limitation and we are working to support it in the future.This means that for the time being for Private Applications that are not configured to use “Publisher DNS”, if the initial DNS resolution is performed over TCP 53, NPA will bypass the DNS resolution resulting on the NPA Application to fail to work. Despite the general recommendation is to avoid enabling/using DNS over TCP (TCP 53), this often depends on the DNS resolver, and unfortunately certain applications rely on their own DNS resolvers instead of the OS one. Recently we verified that Microsoft Edge uses an embedded DNS resolver that, even when configured not to use secure DNS (DNS over HTTPS), it still tries to use DN

Ping Identity’s PingOne platform provides the ability to define a SAML-compatible application that can be used for granting access to the Netskope Admin Console. This guide will walk you through the steps for creating a custom application to meet this use case.   Ping does not provide a pre-built application for SAML SSO - a custom application is required Ping One does not support SCIM for User and Group provisioning - you will need Ping Federate with the SCIM SaaS Provisioner integration.   Instructions Follow the below steps to create the custom SAML int

Hello everyone, My organization currently uses MIP to manually apply labels to Office files. We are looking to start using Netskope API Data Protection to automatically apply labels to files in SharePoint that contain sensitive data but I have a couple challenges I am not sure how to handle.  1. Microsoft Information Protection by default will not override any manual labels applied or override any label with a higher priority. We would like to keep this capability when using Netskope to apply labels but I cannot find any way to accomplish this.  2. We would like to build automated workflows to notify users when a file they own has had it's label upgraded because it contains sensitive data. This works great the first time the label is applied but a DLP alert will occur every single time the file is edited even if the file already has the upgraded label. I think a potential solution to challenge 1 wo

Netskope Next Gen SWG helps organizations take back control over user->cloud activity that firewalls either miss or can't understand.  Cloud Firewall complements Next Gen SWG to address the non-web apps. Check out our new video to explain what a Cloud Firewall does, and let me know if you have any questions   https://community.netskope.com/t5/Video-Library/Introduction-to-Netskope-Cloud-Firewall/ba-p/4829  

I'm looking for a way to block file uploads using Telegram web. As Netskope is unable to detect "Uploads", it is not able to block uploads.  I tried blocking "Downloads" as this was an activity registered, when I tested, it failed.

netskope 102 is not getting uninstalled from the machine nor with the cleaner.

Just to check how Netskope is categorizing the URL's Malicious? just want to understand backend Technology and the process around it. Are you using any third-party Intelligence  or own AI/ML technologies.

Has anybody else observed latency and loading issues with Google Docs for Mac/Chrome users who are accessing them via the Netskope Client via the SWG? We're seeing sporadic behavior where documents shared with users will take 3-7 minutes to load, comments will fail to post, and sometimes pages just age out. This is not isolated to a specific region or POP, but disabling the Netskope client immediately resolves the issue.  It's become enough of a problem that we are considering putting in an ssl decryption or steering exception for Google Docs. This behavior will manifest for several hours, go away, and then reappear. Just curious if anyone else has seen it and/or has any suggestions on any potential fixes. 

Multi-user in non-AD environments - Users in Google and Okta Hello, good afternoon, I hope all is well. I have the following question. In an environment where you have users with Okta and others from Gmail, for user accounts, how would you do in environments where you do not have Active Directory for multi-user workstations ? I mean example: We have approx 30 workstations shared, by 3 or 4 people, where different people login to that workstation in different work shifts, with different local account on those workstations.So these machines use local accounts but I need to differentiate the access privileges of each of those 4 people/accounts to different access level for Netskope policies. How do I use multi-user or Multi-User Mode in this kind of environment? Is it possible to do it IDP-like with Okta accounts as with Google Workspace accounts ? 

Synchronize users from Google Apps/Workspace and Okta for user/group provisioning and Admin Console SSO Hello good afternoon, thank you for your support, for your collaboration and for your valuable time.Is it possible to synchronize users/groups from Google Apps/Workspace accounts ? in order to provision user/groups for policy management ? Can I synchronize users from Okta and users from Google Apps/Workspace at the same time?Is it possible to use SSO for the use of Google Apps/Workspace user credentials for the Tenant Admin Console? Thanks for your time, good vibes and your collaboration. I remain attentive Best regards

Hi team, I have a doubt whenever i tried to understand i get stucked and got confused in that.Correct me as per my understanding.The sanctioned application are those who only manages by our organization like o365, Gsuite salesforce who having a Admin privileges.Unsanctioned apps are those who not control by our organization like zippyshare anydesk pinterest facebook whatsapp etc.Also i get confused over managed and unmanaged application is that the managed apps are sanctioned apps and unmanaged are unsanctioned apps.For example Sanctioned apps are those who used by dialy bases on organiztion like some org used Gsuite and chatgpt again gsuite i sanctioned and chatgpt is unmanaged apps but the used both one for mailing and other is for info learning. on the second scenerio same org the unsantioned apps are o365 coz they are using gsuite on org. Please help me with this confusion with user example.

Hi I am facing issue in my laptop having the Re-authentication for Private Apps feature enabled every 24 hours. Unfortunately there is no re-auth pop-up coming when these 24 hours expires. I have no indication from the Client whether I need to re-auth now to access the Private Applications. This is hindering my day to day work. I have also checked it with my other colleagues and facing similar issue.  The documentation says that "If the interval expires, the Netskope Client prompts the IdP sign-in window for re-authentication. If the grace period expires, the Netskope Client disconnects from Netskope Private Access" which is not happening.