Skip to main content
  • EN

Solved

221 Topics
M
mattwalkerNew Member
asked in Additional Discussions
IDP Install for non-domain joined sytems

Hi All!  Hoping someone can help pin down an issue we're running into with deployment of the Netskope Client via IdP. FWIW - We're using Okta as our IdP.  IdP Install reference: https://docs.netskope.com/en/netskope-help/netskope-client/netskope-client-deployment-options/deploy-netskope-client-via-idp/We have the Okta account set up in Settings>Security Cloud Platform>Forward Proxy SAML. We also have the .msi file on the computer. We run the following install script:  msiexec /I NSClient.msi tenant=**MASKED** domain=goskope.com installmode=IDP mode=peruserconfig autoupdate=on /qn After running the script, the Netskope client installs, and the user is prompted to enter in their Okta credentials. The user completes Okta authentication (we can see the successful log within Okta) but then the Netskope enrollment window flashes to a "Hmmm... can't reach this page" error.   Has anyone here run into a similar issue or know how

4024
S
Netskope Employee
8 days ago
K
kdibbleNew Member III
asked in DLP
Not Near Best Practices

We are working towards implementing a rule that looks for plaintext credentials within shared documents. In doing so, we’ve utilized the Passwords (contextual) pre-defined entity. We’ve noticed that this entity is catching teams and zoom meeting passcodes. We do not want to catch these passcodes in the rule and are trying to create a “not near” advanced expression. I’m looking for guidance on how to perform this. For example here is what we have: P1 = Passwords (Contextual)D5 = Custom Dictionary of words like “meeting”, “teams”, “zoom”, etc… Both options we’ve tried: 1.) ( P1 AND ( NOT ( P1 NEAR D5 ) ) )2.) (P1 AND NOT (P1 NEAR D5)) Any help would be appreciated.  

1179
A
28 days ago
D
dkolb-netskope
asked in Additional Discussions
Secure Enrollment Authentication Token Question

Hello,I was wondering if the Secure Enrollment Authentication Token gave a warning before expiring?I could not find any documentation that said there would be any banners or notifications when the token is about to expire so I wanted to know if there is some sort of warning for it.Thanks in advance!

641
S
Netskope Employee
1 month ago
M
maxkorNew Member III
asked in Private Access for ZTNA
Devcie classification unmanaged

Hi All, My device classification policy matches when all three criteria are met...There are a lot of users complaining that they can't access ZTNA, so I checked and they're unmanaged...I fixed it by pushing an update to the client and restarting the service/computer. It's probably not possible to do it every few days for users what is can be the root cause of pull users out from device classification policy.   

1409
M
1 month ago
N
ngriffinNew Member
asked in CASB
Netskope API Programming with PowerShell - Getting 401 Unauthorized Error Code

I’m attempting to connect to the Netskope API via a PowerShell script. I’ve created an access token with the appropriate endpoint configured. The script is receiving a 401 response which indicates that I’m not authorized yet. I’m not sure how to present the access token in the header. Is there any documentation or examples on how to authorize to the API endpoint I’m trying to connect to? Here’s a snippet of my PowerShell script:# Variables$netskopeAccessToken = "<insert_access_token_here"$type = "File, Folder"$filter = "(app eq 'OneDrive') and (exposure eq 'External')"$netskopeUri = "https://<domain>.goskope.com/api/v2/ui/casbapi/inventory/resources"# API Header$headers = @{ 'Authorization' = 'api_key' + $netskopeAccessToken 'Accept' = 'application/json'}# API Body$body = @{ type = $type filter = $filter}$response = Invoke-RestMethod -Uri $netskopeUri -Method Get -Body $body -Headers $headers 

691
N
2 months ago
W
wdeguaraNew Member III
asked in Additional Discussions
Netskope and Docker

Just wondering whether any community members who are Docker users have been able to get Netskope working with it ?

35793
J
2 months ago
danisilfi
Netskope Partner
danisilfiNetskope Partner
asked in Private Access for ZTNA
npa_api_policy_enabled is not enabled

Dear Netskope buddies,  Im trying get the list of npa policies from my tenant through API method and, when i launch the command (im using postman, but the result from the API web Netskope its the same) i get the following message: “NPA policy feature npa_api_policy_enabled is not enabled”Do you know why the tenant its getting me this message?The option /api/v2/policy/npa is allowed in REST API v2 sectionI have searching in the tenant something similar to this, but i didnt find any option to configure this feature.If this feature is configurable, please, could you tell me where can i find it to enable? Thanks in advance,  Best regards,    

513
ejang
Netskope Employee
2 months ago
J
juanmNew Member III
asked in Additional Discussions
SCIM-Based User Provisioning with GSuite

Hi all! It is supposed that Netskope can import the OUs and User Groups from GSuite user platform directly using SCIM but, I couldn't find the way to do it. In addition, all the documentation I find is related to SCIM integration with Azure AD and Okta. I've been looking for a way into GSuite Admin Console and there is nothing similar. Anyone here has had the same issue? Thanks!

3015
maheshchavan
Netskope Partner
2 months ago
AllenWu
Netskope Partner
AllenWuNetskope Partner
asked in Additional Discussions
Data Retention of Audit Log

Hi there, Does anyone know for how long Netskope will keep admin’s audit log on the console?Failed to find more info from kb and not sure if purchasement of extended data retention or AA will cover this and extend the data retention period of audit log to at least 1 year.https://docs.netskope.com/en/audit-log-1/ Thanks

521
S
Netskope Employee
2 months ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Policy restrict access source country

I have specific NPA policies created that are configured for Client access. However, I would like to also add the Criteria = Source Country option to restrict to clients in the US only, which is possible in my Cloud App policies. This option is currently grayed out and wondering why and will it be available in the future? I can see in the event logs that the POP Name is being registered, so it knows that much at least.. Thx

982
S
Netskope Employee
2 months ago
J
jschueleNew Member III
asked in Private Access for ZTNA
NPA Browser Access Session Limits

After enabling Browser Access for an app behind NPA, is there a way to enforce session limits? Thx

392
J
2 months ago
2
2022RossNew Member
asked in Cloud Firewall
Block internet access on servers

Try to deploy netskope on a server to block internet access  with an exception of  windows updates. I’ve been directed to the Cloud Explicit Proxy documentation but it seems like an overkill to what im trying to achieve.Anyone implemented this ?​​​​​​

781
N
2 months ago
S
simonmaNew Member
asked in Private Access for ZTNA
Publisher App Reachability

Hello,Assuming a private apps is defined with a single hostname (with the exception of CIDR or wildcard domain) and reachability status is normal, what is the default traffic behaviour if the publishers associated with the app are suddenly unable to each the app? Is the traffic dropped?Is reachability only relevant in scenarios where a single hostname in an app is defined? The private app FAQ document states the following. When an app is specifies with multiple ports or a port range, the Publisher will use only the first port from the list or range to check availability. For example, port range 70-90 will return unreachable, even if you are listening on port 80, because the only port that will be checked is 70 (this is a known limitation). If an app definition specifies multiple ports and/or port ranges, it will check whether any of them is reachable. For example, if you specify 22, 70-90, if it’s able to reach port 22, it will mark the app as reachable. Can anyone clarify these state

1031
N
2 months ago
E
eldadNew Member III
asked in Next Gen SWG
How to create users group

Hi community,I'm wondering where I can create new users group to use when I create new client configuration. Thanks,

7599
N
2 months ago
S
secproceoNew Member
asked in Discussions
Netskope Client for iOS

Can the Netskope client be installed for iOS (iPad) without using Intune? I need to install it for one device. If so, are there instructions? Thanks. 

693
S
3 months ago
shubhamk
Netskope Partner
shubhamkNetskope Partner
asked in Netskope Cloud Exchange (CE)
Adding Netskope tenant on Cloud Exchange

Dear Team,I am in the process of setting up Cloud Exchange, and the deployment has been successful, including access to the UI. However, I am encountering issues when attempting to add a tenant to the Cloud Exchange. The following errors appear in the logs:[CE_1045, CE_1044, CE_1126]I have reviewed the configuration and validated the tokens, but I am still unable to onboard the tenant.Could you please assist in troubleshooting this issue?Detailed Error: 09/10/2024 10:20:10 PM    CE_1045    error    Error occurred while validating v1 token, Exception occurred while parsing JSON response.Traceback (most recent call last):  File "/usr/local/lib/python3.9/site-packages/requests/models.py", line 971, in json    return complexjson.loads(self.text, **kwargs)  File "/usr/local/lib/python3.9/json/__init__.py", line 346, in loads    return _default_decoder.decode(s)  File "/usr/local/lib/python3.9/json/decoder.py", line 340, in decode    raise JSONDecodeError("Extra data", s, end)json.decoder.JS

532
ejang
Netskope Employee
3 months ago
K
KrugerNew Member III
asked in Next Gen SWG
email Notifications on changes

Hello,Is there a way to get an email notification for configuration changes to the netskope tenant? ie: any inline policy update or creation etc..  Thanks!

541
N
3 months ago
N
nikunj.godawatNew Member
asked in Next Gen SWG
In what scenarios is a SWG steering bypass required?

In what scenarios is a steering bypass required and recommendation to avoid the steering bypass.

451
J
3 months ago
thiagofc
Netskope Partner
thiagofcNetskope Partner
asked in Private Access for ZTNA
Question about a standard scenario for a Dial-up IPSEC/SSL VPN-RA

In a standard scenario for a Dial-up IPSEC/SSL VPN-RA we have:A DHCP IP-Pool is set up on the VPN Gateway to assign IP addresses to clients. The DNS resolver is also configured, usually using the Active Directory (AD) DNS for these assignments. The internal/remote networks that will be advertised in the VPN clients' routing table for split-tunnel access are defined.By default, a Windows interface has NetBIOS over TCP (ports 137/138) enabled.So, when connecting to the VPN, a typical SMB access like \\AD-Domain\C$ (using ports 445 and 139) for file sharing works successfully. In other words, with the old VPN model, resources can be accessed without much firewall configuration or concerns about application ports or DNS resolution.In a ZTNA/NPA environment, I’d like to better understand the precautions I should take in the same scenario. Here, we have a remote machine properly joined to the AD Domain. When it connects to the VPN, it receives its internal-use IP and internal DNS. With this

262
thiagofc
Netskope Partner
3 months ago
N
ndudaExplorer
asked in Next Gen SWG
Crowdstrike MacOS exclusions

Crowdstrike customers, how are you doing the exclusions for MacOS listed here, https://docs.netskope.com/en/netskope-help/netskope-client/netskope-client-interoperability/antivirus-applications/exceptions-for-anti-virus-applications/Specifically, I’d be curious to see what your exclusion patterns are. For paths with spaces (i.e. /Library/Application\ Support/) are you using “/Library/Application\ Support/” or “/Library/Application Support/”. Crowdstrike documentation states we shouldn't need the \ but does that work in practice?

3263
T
3 months ago
C
clnicholsonNew Member
asked in Private Access for ZTNA
NPA Internet Access Issues

I'm doing a deploy of NPA across my environment and hitting a series of snags.  The issue seems to be related to my Mac users having issues with DNS resolution or pages loading failures.  These are largely my SaaS based SSO apps but they can be anything.  We are using Duo Security for MFA but that has been added as an exception.  The problem is intermittent.  Some users experience it all the time, I only experience it periodically though it used to be all the time for me too.  All users are in the same Steering Configuration.   We are all using MacOS Ventura so this may be related to the bug from last year.  

5255
S
3 months ago
V
vahidNew Member
asked in Private Access for ZTNA
Netskope Publisher Auto Update

Hi,I have a question (or two) about netskope publisher auto update feature.Does this auto-update feature only work i.e. kicks in when there’s a new version of netskope publisher? assuming I set it to latest update on weekly basisLet’s say I’m on version 117.0 and there’s a new version 118.0. This will get updated to 118 during whatever time I configure the auto update.If there’s no new version of netskope publisher, will it still update the underlying OS/system packages?Thanks 

1384
S
Netskope Employee
3 months ago
S
sahil1231New Member III
asked in DEM: Digital Experience Management forum
DEM: Monitored Applications

Hi community, We are exploring the DEM feature ad under DEM>Settings>Monitored Applications. What does this “Monitored Applications” feature do? Is there any extra costing involved after enabling this option? Does this require any different licenses? Where the data can be seen form this “proactively monitored apps”? 

635
S
3 months ago
S
Netskope Employee
sartioliNetskope Employee
asked in Next Gen SWG
Windows 365 or Azure Virtual Desktop and Netskope Client - Best Practices

In order to ensure the correct functioning of the Azure Virtual Desktop or Windows 365 machine when deploying the Netskope Agent on it we have to take care of some Steering Exceptions: MANDATORY: Destination Location Steering Exceptions for Azure Virtual Desktop RDGateways IPs (Remote Desktop Gateways service tags related IPs) OPTIONAL: Destination Location Steering Exceptions for Azure Virtual Desktop Monitoring IPs (Azure Monitor service tags related IPs) OPTIONAL: Application/Process (Certificate Pinned Application) Steering Exceptions for Azure Virtual Desktop agents running on the Virtual Desktop Destination Location Steering Exceptions Microsoft provides a Json file with all the Azure destinations at the address: https://www.microsoft.com/en-us/download/details.aspx?id=56519 Unfortunately though this list contains all the destinations used by the Azure infrastructure, divided by “Service Tags” (services). As we definitely don’t want to exclude all the Azure destination fr

22586
B
4 months ago
J
jschueleNew Member III
asked in CASB
Jamf and Secure Enrollment

We use Jamf to deploy the NS Client to our Mac fleet. After enabling the new secure enrollment features (Settings > Security Cloud Platform > MDM Distribution > Secure Enrollment) and generating the access tokens, it appears we add them to our existing Jamf deployment policy. If I am reading the directions right the tokens must be renewed, and the Jamf policy updated, every 90 days by default. Is that correct? 

2422
ns-ssalomon
Netskope Employee
4 months ago

Badge winners

Show all badges
Terms & ConditionsCookie settings