Netskope Global Technical Success (GTS)
Netskope Socks5 Proxy - General Q/A
Netskope Cloud Version - 132
Objective
Netskope Socks5 Proxy - General Q/A
Pre-requisite
Netskope Cloud Firewall License with Socks5 Proxy Feature enabled
Context
This document contains general Q&A related to Netskope Socks5 Proxy Feature
Author Notes
To have a practical understanding about Netskope Socks5 Proxy, Please review the following KB article:
Let’s begin
- Question 1: What is Socks protocol?
Answer: Socks is a protocol that allows connections to any destination through a proxy server. Many customers prefer not to expose their machines directly to internet traffic, so they use a proxy to establish external connections. In such cases, customers use a Socks proxy as a secure boundary between their internal and external networks.
- Question 2: How can Socks Proxy feature be enabled?
Answer: Socks Proxy feature is supported only for Cloud Firewall tenants. Enable ‘Socks5 Proxy' by raising a support case. Once enabled, a new SOCKS Proxy page appears under ‘Traffic Steering’ in the Security Cloud Platform UI, allowing configuration and monitoring
Customer can use any of these 2 IPs - 163.116.128.80 / 163.116.128.81 and port 1080 to connect to Netskope’s Socks Proxy and also they should make sure the traffic is tunneled to Netskope through any of the steering methods (NSClient / IPSec / GRE).
- Question 3: What does Socks Proxy support?
Answer: Socksproxy is supported only for TCP non-web applications, so it is recommended to enable socksproxy at application level and not at system level. This feature is not supported for web traffic on standard (80/443) or non-standard ports.
- Question 4: Why is this important for Customers? What is the Use Case?
Answer: Customers can configure their FTP Clients to connect to a Socks5 proxy running in our DP and apply all inline policies for detection and protection. DNS resolution also goes through the proxy and customers will not have direct internet access even for DNS resolution. FTP clients need to connect to Socks Proxy server and port.
- Question 5: What pain point does this solve for Customers?
Answer: This feature helps the customers to control their users to have non-web traffic access through a proxy and apply control over it.
- Question 6: What additional capabilities does this feature provide?
Answer: This feature provides FTP through Socks5 proxy where no username/password authentication is required as they are connected through IPSec/GRE/Client only. For the DNS resolution, Netskope DNS Servers (CDNS) will be used. For the Socks Proxy traffic, Both Network events and DNS events can be administered.
- Question 7: What failover capabilities exist for this feature?
Answer: Each Netskope DataPlane has 2 Pods for Socks Proxy. In case of Socks proxy Pod failure, The Cloud Firewall framework will ensure that traffic is load balanced to remaining Socks proxy pods.
- Question 8: What does this feature in overall support?
Answer: SocksProxy is supported through all 3 Steering methods ( IPSec / GRE / NSClient )
- FTP servers with both IP and FQDN are supported
- FTP servers on non-standard ports are supported
- FTPS is supported but make sure SSL protocol is allowed
- Question 9: How can the alerts/events be differentiated for Socks Proxy and other steering methods?
Answer: Events/Alerts will have ‘- SOCKS’ as suffix in Access Method and Proxy Type will indicate it as ‘SOCKS5’
- Question 10: Can you impose Data (DLP) and Malware (Threat) protection on Socks proxy traffic?
Answer: Yes, Content Inspection for Data and malware is supported for Socks Proxy traffic. It does provide data and malware protection on files transferred using non-web protocols. However both of them needs an additional license i.e. ‘DLP for FTP’ and ‘TSS For FTP’ for DLP and Threat Protection respectively. Please contact your Account SE for more information.
Terms and Conditions
- All documented information undergoes testing and verification to ensure accuracy.
- In the future, it is possible that the application's functionality may be altered by the vendor. If any such changes are brought to our attention, we will promptly update the documentation to reflect them.
Notes
- This article is authored by Netskope Global Technical Success (GTS).
- For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.
