Skip to main content
  • EN

Product Forums

Explore Netskope Community Forums: Dive Into Next Gen SWG, CASB, Security Posture, ZTNA & DLP Solutions

797 Topics
gian202b
Netskope Partner
gian202bNetskope Partner
posted in CASB
CloudApp Policies - application unavailable

This use case is about Generative AI, but I've run into this issue with other categories as well.  I create a Generative AI block and then I'm adding exceptions as needed by the business. The issue is that I have to create a URL list for those applications that do not show in "CloudApp" options. (ie. Grammarly).  What I don't understand is why is the app not available? I get that Netskope can't distinguish between activities within the app, but when I look at the Alerts and logs it's clearly categoring the URL to the application. I'm now forced to create a rather large URL list to allow Gram

3347
rodolfobsantos
Netskope Partner
farhan
Netskope Partner
farhanNetskope Partner
asked in Cloud Firewall
Netskope DNS Security and Limitation compare to Other DNS Security

Hi Team,I have a query regarding one of our customers who is currently using an existing DNS SEC setup for both outbound and inbound traffic. Customer already have NGSWG procured. Their current traffic flow is as follows:[Roaming user] USER Endpoint >>> Active Directory DC >>> DNS Forwarder >>> DNS SEC CLOUD.For Internal their is a differ IP configured for them to resolve but need to connect with Citrix VPN.They want to understand how the traffic flow works with Netskope DNS SEC, which differs as it intercepts DNS queries for inspection.Here’s the scenario: When a user queries a domain, the request first goes to the Netskope cloud for Deep Packet Inspection (DPI). If the domain is malicious, it gets blocked; otherwise, it is allowed and forwarded through the Secure Web Gateway (SWG).My question is: If the user’s machine is configured with the DNS IP of the Active Directory (AD), does Netskope return the allowed traffic back to the client machine and then forw

2388
eneufeld
Netskope Employee
S
Netskope Employee
scarlileNetskope Employee
posted in Next Gen SWG
Checking URL for category and URL List using Rest API

How can we check which category and URL list a specific URL belongs to?Rest API provides a useful method to extract this information. How to use Rest API:-Go to Settings/Tools/Rest API v2  Select API DocumentationEnsure there is a token which has:- /api/v2/nsiq/urllookupSearch or scroll down to /api/v2/nsiq/urllookupClick to try out the API Edit the text to select the URLs  you want to check for category and URL list Click Execute  You will get a response back which will show whether the has succeeded or not, but also some info which might be useful for your API tool of choiceIf you get an error, check your API token, and any brackets, or commas in the requested body above. The response will show the categories (pre-defined & Custom) and URL lists To verify the categories are correct, check the tenant UI If you need to modify the URL lists, check out:-https://community.netskope.com/real-time-protection-key-policies-72/how-to-automate-url-list-updates-via-api-7167 

3391
A
zywong
Netskope Partner
zywongNetskope Partner
asked in Next Gen SWG
Does site that failed SSL inspection reflect in SkopeIT logs?

Hi Guys,I was trying to figuring out on Windows Updates or Windows Store failing to check for updates or downloading apps. While i was moving around to check on SkopeIT logs for some clue to it and i could not see anything that shows any failure or etc may i know does SkopeIT do shows any signs of failing SSL inspection or any sort? Because the last resort that i did was to do a bypass on Windows Update’s URL then everything started to work and update can continue, i do see logs only reflecting that it is passing through properly but anything that failed before i applied the bypass is not reflected. Thanks in advance~

1062
zywong
Netskope Partner
C
chrisisinclairNew Member III
posted in Private Access for ZTNA
Extremely Slow File Storage Access Speeds?

Is anyone else having issues with accessing private storage through NPA (private access) becoming extremely slow? We are mostly a windows shop and a large portion of our end users are having an issue where when they move any file from one of our Netapp on prem storages or even a Windows based file server the speeds are insanely slow when users are using ZTNA. It seems like this mainly affects transfers of lots of small files vs large single files. With the client uninstalled and the user back on our traditional VPN we get about what we would expect (a few megabits a second depending on the end users internet speed). Enabling the client puts us down to ancient baud modem level speeds - sometimes as low as 300 bits a second!

105012
elawaetz
J
jschueleNew Member III
asked in CASB
REST API V2 failing for Sumo Logic

Sumo Logic has a Netskope app that can be installed and configured to use API v2 to ingest logs. I created a new token in Netskope as described in the doc. I then installed the Netskope app and created the collector in Sumo Logic. It shows healthy, but there is an error saying “ 403 - error connecting to endpoint, received 403: {“message”: You cannot consume this service”}. Any ideas whats wrong? 

801
ejang
Netskope Employee
J
jpark124New Member III
posted in CASB
v2 API documentation parity to v1 available endpoints

Hello, New to Netskope.  I was able to find the v1 API documentation https://docs.netskope.com/en/netskope-platform-rest-apis.html as well as the v2 API documentation https://<tenant>.goskope.com/apidocs/?include_beta_routes=0 We're looking to utilize the versatility of the v2 permission based token.  I didn't see the v1 API endpoints available in the v2 API documentationexample: https://docs.netskope.com/en/manage-quarantine-files.html for v1 wasn't in the v2Is there additional documentation that I'm missing?  or is there a roadmap/timeline to when the v1 endpoints will be available in v2? Thank you for your time and insight into this. -Han Park

38611
N
shboul
Netskope Partner
shboul
asked in Next Gen SWG
Adding Tailscale VPN as an Exception in Netskope Tenant

Hi,I'm working on implementing Netskope, and I need assistance with configuring an exception for Tailscale VPN. Since Tailscale operates differently from traditional VPNs, I’m facing challenges in setting it up as an exception. Has anyone successfully added Tailscale VPN as an exception in Netskope tenant?

1191
S
Netskope Employee
N
nesi10062New Member
asked in Private Access for ZTNA
REST API V2 - create new private app issue

Hi guys I need your help, I’ve created an REST API V2 token and added the relevant endpoints as described in this doc: https://docs.netskope.com/en/netskope-help/data-security/netskope-private-access/private-access-rest-apis/after trying every combination to create a new publisher app with the Swagger UI, I get this response:{ "message": "User Portal App cannot be created.", "status": "error"}what am I doing wrong? 😤

3006
S
Netskope Employee
S
secproceoNew Member
asked in Private Access for ZTNA
Creating Large Subnet for NPA Access

Team,Good morning and Happy Friday.I wanted to create a separate topic from my previous question. :)I'm creating a large NPA subnet for my networking and server teams, which will need access to the same resources.Instead of having 50 different subnets that include all servers, routers, switches, etc. I created the configuration below. I will also enable the use “Use Publisher DNS” option.  Question: Should I include the wildcard hostnames of our internal domains? Below is an example.Thanks again for your input.   

951
zywong
Netskope Partner
C
crimsonNew Member
asked in DLP
Default Global DLP Policies Best Practice?

Hello all,I’m looking for recommendations/examples of global default DLP policies.Currently, my organization has a default block policy at the bottom of the tenant for categories that we’ve deemed to have no business use case (weapons, security risk, etc) or to be risky for usage (cloud storage, social media, etc.).In a similar fashion, I’d like to have DLP rules at the bottom of the tenant to act on web traffic before Netskope allows it through. I’ve done some testing with just outright blocking any activities that could be used to exfil data (upload, post, send, edit, etc.) and very quickly ran into issues, and example being background traffic for the Microsoft Edge browser being classified as upload and resulting in a large number of user notifications. I’m currently working through using app tagging to exclude any standard user applications from this policy.Given that not all websites have support for DLP, I’d ultimately like the behavior to be “If the website supports DLP, check t

1800
C
M
maxkorNew Member III
asked in Private Access for ZTNA
Browser access portal

Hi all,When I try to create more than one application this option is not enabled.The browser access portal does not support more than one application? I need to publish 5-6 different apps/services through the portal. How do I accomplish that? 

1422
E
E
eranNew Member III
asked in Next Gen SWG
REST API V2 - /adem/

Hi,I’m trying to use /api/v2/adem/deviceoslist on the REST API v2.Before adding the specific permission for the endpoint - I’m getting "You cannot consume this service".After adding it, I’m getting "Unauthorized".Both times the error code is 403.How can I use this Endpoint?Thanks

2844
Mauro Marin
Netskope Employee
Leandro Timotio de Lima
Netskope Employee
Leandro Timotio de LimaNetskope Employee
published in DLP
(VIDEO) Block Source Code Upload to Email

Policy:Block Upload DLP Source Code Description:In this example we will prevent sending emails (Gmail) with files that contain "source code" in their content. Video: Leandro Timotio de LimaCustomer Success ManagerLinkedin

2021
A
Leandro Timotio de Lima
Netskope Employee
Leandro Timotio de LimaNetskope Employee
posted in CASB
(VIDEO) How to alert the end user accessing a cloud application with a poor reputation.

Policy:User Alert Poor ReputationDescription:Example of how to create a rule to alert the end user about the use of a cloud application with poor reputationVideo:Leandro Timotio de LimaCustomer Success ManagerLinkedin

1501
A
E
ElTetuNew Member III
asked in Private Access for ZTNA
Apps published on User Portal

HiI’ve seen on documentation how to create a User Portal, where logged-in users can obtain a list of Browser Access (only) applications they are authorized to access and launch from the portal, but I cannot see anywhere how to select the applications that are available on this User PortalI mean, how do I choose what Private Applications can see the logged-in users on the portal? Are these applications the same for all users or the users only see the ones they are allowed to access?Thanks!

661
E
S
secproceoNew Member
asked in CASB
Policy Notification URL

Team,Good afternoon.How can I add a clickable URL into the “User Notification” section in Netskope? I want to direct my users to go to a specific website. I would like the website URL to show in the block pop-up policy message. I did not see an option for this in the “INSERT VARIABLE” options. I think the syntax is something like <href=https://microsoft.com>See screenshotThanks. 

641
S
J
jschueleNew Member III
asked in CASB
Google Team Drive not visible in API-Enable Protection

I can’t see a newly created Google team drive in API-Enabled Protection. It has the same configuration as the other drives that are visible in our tenant. I am also a Manager of the drive. I verified it is active in Google Admin as well. Any idea’s what could be wrong?

91
J
P
pppExplorer
asked in Private Access for ZTNA
Problem with auto update

Hello Community,some of our clients stuck on version 114 or 117 - most updated without a problem. Has anyone encountered something similar and maybe solve it? Best regards

1842
P
C
CuriousExplorer II
posted in Private Access for ZTNA
NPA Publisher SSH auth via AD and Radius for MFA

Hi Everyone,  Thought I would share some information about Authentication to AD and using Microsoft NPS for radius auth providing MFA when connecting to the Publishers with SSH.  This is useful instead of using the default shared account. The information I obtained to get this working was obtained from the following sources, it was quite straight forwarded and implemented without much difficulty… and I am no Linux admin. Introduction to network user authentication with SSSD | UbuntuHow to set up SSSD with Active Directory | UbuntuTroubleshooting SSSD | UbuntuAzure MFA for SSH using NPS/MFA Extension Good luck with it, hope someone else finds this helpful. 

1821
C
C
cswordNew Member III
asked in Netskope Cloud Exchange (CE)
Web Scraper Plugin for Threat Exchange not recognizing CIDR blocks to push to URL list

Can CIDR blocks be scraped and pushed to a Netskope URL list using the web scraper plugin for threat exchange? I have one setup to pull from the Proofpoint Emerging Threats IP block list (https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt) but it seems to only push individual IPv4 addresses and ignores anything with a CIDR. 

100
C
S
secproceoNew Member
asked in Private Access for ZTNA
Creating Subnet for NPA Access

Team, Good morning, and Happy Friday! I had a meeting with my server admins and network engineers. I was told they must access hundreds of servers through RDP and network gear, such as routers, switches, and administration consoles. In addition, smaller subnets /24s may be created. My plan is to make administration of NPA easier, I was going to add a /16 or /8 subnet range in my NPA configuration that includes all the above devices. I wanted to know if anyone had any issues or limitations with NPA using large subnets. The extensive subnet ranges will only be used for two groups. All other teams will have one-to-one NPA configuration. Thanks again for your time and input.

1074
S
M
Netskope Employee
MM_NSNetskope Employee
posted in Next Gen SWG
Netskope Client and PAC files

If you have PAC files or WPAD deployed to user base here are recommended settings:   1. Following traffic needs to go via PAC addon-<TENANT-NAME>.goskope.com     2. Following traffic needs to go DIRECT gateway-<TENANT-NAME>.goskope.com gateway-backup-<TENANT-NAME>.goskope.com dns.google     3. Do not use Netskope consolidated IP ranges in the PAC file. If you add global range the "addon" traffic will also fall under that range.     Sample PAC file:   Here is a typical PAC file syntax. Check what's the ultimate "return" statement. The address "163.116.128.80:8080"  in this PAC file is the Netskope Explicit Proxy over Tunnel IP address.    { <snip> .. .. /* Don't proxy to access to Netskope URLs for clients     */       if (shExpMatch(host, 'gateway-<TENANT_NAME>.goskope.com'))          { return 'DIRECT'; } (repeat for

16732
NicolaScand
Netskope Partner
Sushil007
Netskope Partner
Sushil007Netskope Partner
asked in Next Gen SWG
Trend Micro Security Agent No internet Connection error

When I have installed the netskope client, my trent micro security agent gives the error Check you internet Connection and I am not able to scan. What should I configure in my netskope tenant to allow the internet connection?

1083
A
elawaetz
elawaetzExplorer III
asked in Private Access for ZTNA
Providing URLs in the NPA block pop-up / user notification

We have configured a User Notification / pop-up when users receive a Block action in NPA, to advice them, that they have tried to access an application which is blocked.We also coach them to raise a ticket for this on our ServiceNow system, and ideally we would like to provide a link in the pop-up, that leads users directly to our ServiceNow instance.It says in the description:“The "User Notification" template can be customized by directly editing the HTML below. Use the insert button to insert Netskope template variables. Only simple text and links are supported.”I have already learned, that apparently variables are not an option for the NPA pop-up.How about inserting URLs into the notification?I have tried various options, but it doesn’t seem to make its way into the pop-up. --Erik 

880
elawaetz

Badge Winners

Show all badges

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings