Product Forums

Encapsulation SSL/TLS Traffic to Netskope Cloud Proxy - Netskope Endpoint ClientHello good afternoon, as always, thanks for the collaboration and for the good vibes.I have a doubt, example, I understand that the Netskope client, establishes an encapsulated SSL/TLS tunnel between the client and the Netskope Cloud Proxy or Security Gateway.Now my doubt is the following, in my local firewall, example Fortigate, Palo Alto, and/or other vendros, as all those connections that are established between the client, the endpoint and the Security Web Gateway of Netskope, would visualize all that traffic as.Basic log example:Source 10.10.10.X Destination to the Netskope tenant of SWG- proxy-<tenant-name> goskope com, port 443/TCP App SSL/HTTPS.I would see in the logs of the source firewalls the endpoint and destination Netskope ? Or would you still see the original destinations such as -facebook , -box , -dropbox, -microsoft, etc, etc ?Please confirm this point if possibleThank you very muchB

Have you been curious to get access to see how Netskope Private Access works? We are offering a free 14-day test drive for you to see how NPA seamlessly connects users everywhere to private applications hosted anywhere in data centers or public cloud environments. What you can expect: Free 14-day hands-on experience Turnkey testing environment No software to download/install Application-specific connectivity and superior user experience Single management console for user identity, application, and access policies. Admin and User Guides to help you every step of the way Click here to sign up to access your testing environment today.

Activities functionalities among others, with and without certificate installation, e.g. PAC or explicit proxy or traffic sent through GRE/IPSEC. Hello good afternoon, thank you for your time and collaboration. I have some doubts, I understand that when using the netskope client SSL decryption is by default (since part of the client setup is also preload SSL certificates on the client) and as indicated in the documentation for use cases with PAC or explicit proxy or even forwarding via GRE/IPSEC, workstations, endpoints, ie endpoints, must install Netskope certificates, this clearly to perform the correct SSL decryption and to perform inspection. Now, what happens in the case that the certificates are not installed or cannot be installed (for multiple reasons), what are the functionalities that are lost? I imagine being able to filter by activities, to delimit upload and download, to give an example and to correctly identify the applications, since seeing everything as S

Dropbox activities Web Cloud App but dont block Desktop App Hello good afternoon, as always, thank you very much for your time and your collaboration. I am performing a test with Dropbox, I generated a policy that Blocks Cloud APP Dropbox, the following activities:Activity = Create, Delete, Edit, Invite, Login Attempt, Login Failed, Login Successful, Logout, Post, Rename, Share, Unshare, Upload, View, View All.Except "Download" I do not have the Download checkbox checked, so I am allowing it, and the download works correctly, which is the desired behavior. Now I installed the Dropbox application on the Windows workstation, where I have installed the Netskope Client, where I have been doing the tests and it turns out, that when uploading a file through the App, I upload a file and the upload is completely successful. I thought it would stay forever trying to synchronize, but the 2 and 3 test files, via the Dropbox desktop application, works perfectly. Now according t

One of the most common questions I get from administrators is how does Netskope determine the optimal Data Center (DC) when steering inline traffic. I’d like to simply tell you that the client and other Netskope services are intelligent enough to steer traffic to the optimal DC. While on the surface that’s true, there is some nuance to it. Before we dive in, let’s take a high-level look at Netskope’s architecture.     NewEdge is Netskope’s underlying network that powers all of our inline services. There are NewEdge DCs across the globe in more than 60 regions in cities such as London, Miami, San Francisco, Hong Kong, Delhi, Dubai, and numerous others. You can look at our publicly available Trust Portal to see the most up to date list of active DCs. By default, the client and other Netskope services can utilize any of these DCs for services such as SWG, DLP, content filtering, inline CASB, and more. While this is the default tenant configuration, administrators can also reque

Hello,  We started using NPA for our Radiologists; they connect from home [1Gb ISP connection] via NPA [two publishers] to our on prem PACS system.  PACS studies/Images are pretty big, some studies are 2 GB+ in size. We are on 97.0.0.7294 for the publisher and per the release notes, this version supports peak throughput of 500 Mbps. But unfortunately we are not seeing that. In testing the Peak, we notice is only ~120Mbps. We have set up a speedtest docker container just for this purpose and published it through NPA. Wondering if anyone has thoughts on how to increase the throughput so the images load faster as some of our rads reported slowness in loading the studies.   

I am trying to troubleshoot an issue with a solution called Browserstack which provides developers with the ability to test their websites and mobile applications across on-demand browsers, operating systems and real mobile devices. I have created a bypass so that traffic to the Browserstack tenant is not inspected which allows a system to successfully navigate to the page, the issue occurs when the Browserstack provided OS / Mobile Device emulators attempt to load code on the device. If the NS agent is disabled it works fine, when it is enabled it is broken. Has anyone else encountered a similar issue?

Hi all, thanks for reading. The regex [a-z0-9]{64} is allowed to be used as the main regex, but the UI return an error when trying to use that same regex as a regex filter in entity advanced settings. I validated that decreasing the length from 64 to 40 makes the regex to be accepted instead. Why is that? I cannot find any documentation differentiating between limitations for the main regex and the advanced filter ones. How does netskope evaluate if a regexx is supported or not Thanks in advance,Òscar

OktaAdvanced Server Access provides Zero Trust identity and access management for cloud and on-premises infrastructure. Using Okta as its source of truth, Advanced Server Access reconciles accounts to manage SSH and RDP access to Linux and Windows servers. Advanced Server Access extends secure privileged access to users, automates lifecycle management for server accounts, and eliminates the need for credential management.Okta Advanced Server Access can be configured to allow direct connection to servers or it can be configured to use a Bastion and/or an Okta ASA Gateway to provide the connection through a “Session Gateway Broker”An example of integration with Netskope leveraging Network Private Access is the following:   In this example we have a Linux and a Windows machine published through the Okta ASA Gateway, and a Linux machine published directly without the ASA Gateway.In this case we’ll configure 2 separate NPA Applications: NPA Okta ASA Gateway Application: defined for

Created a File Profile with a File Name (exclude.xlsx) and applied into a DLP Profile (tried with Match and Does not Match). When I running tests, none of them are working (not checking the exclude.xlsx file with the matching profile // not excluding the exclude.xlsx file).Can you please advise?Thanks

We've been seeing a huge uptick in macOS related connectivity issues (tunnel just drops and rebuilds). I've noticed lots of log entries like:error Unable to UDP open local Endpoint The peer closed the flow Can anyone explain what/why netskope is doing with UDP data - when TCP 80/443 (nsclient) are all that should be in play? 

Hello good afternoon, thank you for your time and for your collaboration. I have a question, checking the tenant, one of the default policies that are preconfigured at the SSL decrypt Policies level, is one related to the Office 365 Suite, which indicates that decrypt is not performed. It also indicates the following: Policy name: Default Microsoft appsuite SSL do not decrypt ruleAction: Do Not Decrypt"SNI-based policies will apply but no deep analysis performed via real-time protection policies" Based on this: ""SNI-based policies will apply but no deep analysis performed via real-time protection policies"" I understand that it is important to be able to deeply examine Office traffic, to correctly inspect, decrypt and distinguish SaaS Cloud Apps of Office 365, distinguish the movements made by users in Sharepoint, in Teams, in Onedrive, in Outlook, Office 365 in general. Now as indicated, if by default it does not perform Microsoft App Suite traffic decryption, then thi

During the course of the year we have seen instances where a signature from CTEP was involved in issues within our environment.   We have found the following documentation on CTEP signature updates (https://docs.netskope.com/en/netskope-client-traffic-exploit-prevention-system-threat-content-release-notes.html_)  but there does not seem to be a way to 'subscribe' to it to proactively receive notifications when this is updated.   Does anyone have any thoughts on how to be notified when signatures are added/removed etc.?

Hi Folks, I am sharing my modest knowledge with the Netskope community. I hope this helps a few of you on understanding the basic Netskope traffic flow and log analysis. POP Selection Versions prior to 96.1 : 1. The Netskope Client uses DNS over HTTPS (dns.google) to resolve the Netskope gateway's IP address (gateway-tenant hostname.goskope.com)2. If DNS over HTTPS is unsuccessful, the client will fail over to the LDNS technique (UDP 53) to resolve the IP address for gateway-tenant hostname.goskope.com. Version starting with 96.1: There is no longer a requirement to resolve NS Gateway domains using the Google DNS service (dns.google). The GSLB services deliver a POP list based on the client IP address while performing a REST API request to gateway.gslb.goskope.com.  Note: GSLB option will be only available when the backend tenant flag is activated. Basic Traffic flow Let’s take an example of the SaaS Application Box.

I was looking through the DLP profiles and did not find any support for triggering on Microsoft Purview Information Protection (formerly Azure Information Protection / MIP / AIP ) sensitivity labels for real-time protection policies. My goal is to coach/block users from uploading documents with certain labels to unapproved cloud storage.  I can extract the labels from the office documents metadata, but there doesn't seem to be a way for Netskope to detect the labels even with custom dictionaries or EDM.  Has anyone gotten sensitivity label detection working in real-time protection DLP policies? 

Hello Team,We have enabled  Netskope cloud firewall feature for customer, and we are not able to ping google or yahoo we wanted to test few connection, when netskope is enable still wont be able to ping. Please guide me here if Enable cloud firewall feature will it block ping by default, if yes then how can i enable it to ping google or websites on internet.

Note:  SCCM distributions are highly customizable, and the below information is based on sample environments.  You should always consult with your SCCM administrator to create optimal Application Definitions and Policies based on your environment.   Introduction Microsoft’s System Center Configuration Manager (SCCM) is an endpoint management solution that has been combined with Intune, Autopilot, and other tools into Microsoft Endpoint Configuration Manager.  SCCM is traditionally deployed with management and distribution points on-premises or in public clouds that are used to deploy updates, configurations, and software to managed endpoints.   When on-premises, communications between the managed endpoint and SCCM distribution points are handled via enterprise networking and security tools such as site-to-site tunnels. Traditionally, remote access VPNs were used to connect remote endpoints to SCCM distribution points.  In distributed environments, this pre

Hello all, thanks for reading. We are working on migrating URL lists from ProxySG to Netskope. There are several URL lists defined for ProxySG whose matching behaviour is as follows:Imagine there are two URL lists defined: List1 and List2List1:api.facebook.comList2:facebook.com The following URLs will match as follows in proxySG:api.facebook.com -> matches List1sub.api.facebook.com -> matches List1sub.facebook.com -> matches List2facebook.com -> matches List2**Notice it matches the URL list containing the most similar entry How is Netskope handling the above scenario where a URL can be matched in multiple URL lists? How does URL list matching works in Netskope?Does exact match implicitly include subdomains? (e.g. sub2.sub1.domain.com)Does exact match implicitly include any path? (e.g. [subdomain.]domain.com/path1/path2?param1=0&param2=1)Does regex match type require a full match from start to end of the value? e.g.Is regex match type the only wa

Netskope Client - Configuration changes are updated frequently Hello good evening, thank you for your cooperation. Example if I make modification of certain access policies Web-Urls or settings of activities allowed at Clouds App level, once I make the adjustment in the Tenant of Netskope, how long it takes to take effect the change on client workstations ? if I make a modification the change is reflected immediately in the client ? I have been looking in the documentation for this information, the exact information, frequency, etc. and nothing, I can not find it, if you help me with the above questions and information I would appreciate it very much. Thanks I remain attentive to your comments Best regards

Hello, I am seeking some guidance as to how/where Netskope certificate files are imported onto MacOS. We have had numerous issues with Deloitte practitioners (mainly developers and individuals running code/CLI) where the Netskope cert prevents the application from running due to residing atop the cert chain, and therefore is not trusted by the application service. We have copies of the cert files (ca.deloitte.eu.goskope.com and caadmin.netskope.com) and have set the cert to Always Trust in Keychain; however, SSL errors are still being returned by the system. An example is below, using the brightcove.com service: 2022-09-27 09:10:16.604476-0600 USGA Dev[2698:26211] Task <BB14C893-A867-4C5C-977F-8624C991653B>.<1> finished with error [-1200] Error Domain=NSURLErrorDomain Code=-1200 "An SSL error has occurred and a secure connection to the server cannot be made." UserInfo={NSLocalizedRecoverySuggestion=Would you like to connect to the server anyway?, _kCFStreamErrorDo

How does Netskope process DLP Rules? I have a few different DLP Policies in place (ie. GLBA / Financial / PII / CCPA - in that order specifically and all Allow rules) - I know there is overlap in terms of what these rules look for.  The question is, if a document matches the GLBA rule, will it still process the subsequent DLP rules? Furthermore, if a document contains both US Bank Account and a SSN, will the document report both hits? Or just 1?

Quick Setup of SSH for Publisher prior to running on Centos 7Comamnd to build PublisherLink: https://docs.netskope.com/en/deploy-a-publisher.htmlPlease Note:  create another admin user in centos as when you run the pubisher command as it locks you out of root after step 3 in the link. You need to login via the other user and run the commnd below.Login with other user via SSH user created then excute the following command curl https://s3-us-west-2.amazonaws.com/publisher.netskope.com/latest/generic/bootstrap.sh | sudo bash; sudo su - $USER; exit Wait up to 10 min subject to your line speed.Setup SSH Server sudo yum –y install openssh-server openssh-clientssudo systemctl start sshdsudo systemctl status sshdEnable OpenSSH Servicesudo systemctl enable sshdservice sshd restartsudo systemctl status sshd(To check Status is Active)IF you cant SSH enable the followingFirewall Settingssudo systemctl start firewalldsudo firewall-cmd --permanent --add-service=sshsudo firewall-c

Google Play Store on Chromebook wasn't working properly after installation of the Netskope Chromebook app. I added a certificate-pinned application specifying these URLs and added a steering bypass for ChromeOS. The store works and apps can be downloaded. Note: We have a managed google play store on android & ChromeOS that only has approved apps. play.googleapis.comgoogleusercontent.comandroid.clients.google.comggpht.comgvt1.comdownloads.providers.android.com  

A Security Practitioner's Perspective Blocking Time Sensitive Materials from Public Exposure By: Stevan Pierce and Jose Ramirez   Background Netskope DLP technologies are typically known to be used for blocking a variety of materials such as Intellectual Property, databases containing employee or customer data, hashes of data to be used in Exact Data Matching, etc, etc.   Netskope is also able to provide protection of time sensitive materials from public exposure and allow for the dissemination of the material internally.  A prime use case would be blocking the ability of employees to share information about a company acquisition; and, at the same time, allow those employees to talk amongst themselves using company resources such as those which are sanctioned, i.e. Slack or Google GMail.   The example we are using to showcase this capability of time sensitive material controls is the release of an article on Forbes, Netskope – Security Transformation For Digital Tra

Hi AllWe have several tenants we manage and we have just  setup our first client that is only using NPA and i received a shock when looking at the overview dashboard which showed 0 users yet all 73 users where connected and working. Can i suggest that a Widget Dashboard is given for the users just using NPA that shows at least the number of users connected. I thing this would be great for all netskope admins as at the moment does not give you a true representation of the number of user working. Would be great if you could drill into this dashbaord showing the following key information in a list1.) Username2.) user Group relating to the private apps that can be steer3.)Time of connection4.) Time of disocnnection5.) Source IP6.) Traffic