Netskope Private Access and Cloud Exchange running in AWS

Gary-Jenkins · ‎07-14-2023

Overview

Using Netskope’s Private Access (NPA) can help secure workloads in AWS like deploying Netskope’s Cloud Exchange there. In this solutions guide NPA is used to front end a Cloud Exchange server that doesn’t have direct inbound internet access.

Requirements

Netskope tenant with a NPA license
Amazon Web Services account

Setup Steps

Netskope

Configure a Netskope Publisher in your Tenant

Amazon Web Services

Deploy EC2 Netskope Publisher

Cloud Exchange

Setting up Cloud Exchange in AWS

Deploy EC2 Ubuntu Server
Add Access to Cloud Exchange via NPA
Setup Cloud Exchange on Ubuntu Server

Verify

Netskope Tenant sees your publisher
Check your client for the NPA tunnel
Try to access cloud exchange on your private IP

Configure a Netskope Publisher in your Tenant

Go to your Netskope Tenant > Settings > Security Cloud Platform > Publishers

Click New Publisher

Give your publisher a name

Save and Continue

Generate Token > Copy

Done

Deploy EC2 Netskope Publisher

Log into your AWS account and go to EC2. If you don’t see that on your main AWS dashboard you can search for EC2.

Click Launch Instances

Add a name for your instance and search for netskope publisher

Select the Netskope Private Access Publisher

Once it brings you back to the configuration page, it will look like this.

Key pair - Select or create a Key Pair so that you can ssh into it if needed.

Network settings - I am going to have it automatically create a security group. When we add Cloud Exchange, we will use this same Network vpc and Security Group

Block SSH

Allow HTTPS - this will allow the tunnel traffic into the NPA system. You can lock it down to an IP address range if you are always coming from the same cidr.

Be sure to open up the Advanced details section to add your NPA registration code.

Scroll passed all of the options to the bottom field named “User data” and add the token. Once you have added your registration token, Launch instance.

Verify

Netskope Tenant sees your publisher

Go back to your Netskope tenant and verify that your publisher is Connected.

Security Cloud Platform > Traffic Steering > Publishers

Setting up Cloud Exchange in AWS

Deploy EC2 Ubuntu Server

Log into your AWS account and go to EC2. If you don’t see that on your main AWS dashboard you can search for EC2.

Click Launch Instances

Give your new instance a name and select Ubuntu 22.04 LTS

Select an Instance type. To help you decide on size, check out our Sizing the System section here:

https://docs.netskope.com/en/cloud-exchange-system-requirements.html

Select or create a key pair. If you create the key, you will need to save it to your hard drive. We will use this to SSH to Cloud Exchange in a couple of steps so be sure to know the path of where you put it.

Since you are fronting this with Netskopes NPA, you don’t need any connection from the internet.

Network settings - Edit these to match the Network vpc that you put the NPA in.

Firewall security group - you will need a new security group since the NPA one is allowing https. This one doesn’t need to allow any inbound traffic from the internet. You will only be getting to it from the NPA tunnel.

Configure the needed storage from the sizing guide.

Review the summary and Launch instance.

You will also need to add an ACL so that your Publisher can talk to your Cloud Exchange. Mine are both in this subnet and I just created an allow for the entire subnet.

Go to EC2 > Network & Security > Security Groups > <cloud exchange group>

Add Access to Cloud Exchange via NPA

Before you can SSH to Cloud Exchange to finish the setup, you will need to tell Netskope to allow that traffic down the NPA tunnel by adding it to the App Definition. You will also need the private IP address of your Cloud Exchange server.

Private Address of Cloud Exchange

Go into your AWS Instances and select your new Ubuntu Server. It will list your Private IP.

Now that you know your IP, create a new Private App for TCP 443 and 22.

Security Cloud Platform > Traffic Steering > App Definition > Private Apps

Give your application a name, list the IP in the host field, add TCP 443 and 22, and Select your Publisher.

Save

Steer your Client Traffic

Before your NPA traffic will go through the tunnel, you need to add your Private Apps to your Client Steering Configuration.

Edit your config.

Steer private apps

Save

After this is done please also make sure to assign the Policy for the private app to allow the required traffic for the app:

Go to the Policies > Real-Time-Protection

Create the new Policy specifically for the private app

Check if everything is working fine you need to again go to Private App > Troubleshooter

Click on your user to check if the private app can be accessible:

Make sure your client is enable or other results mentioned in the Troubleshooting:

Verify

Check your client for the NPA tunnel

Setup Cloud Exchange on Ubuntu Server

You will need to SSH to it to finish the setup.

SSH with your public key.

The default user is ubuntu.

Here is the command I will use.

ssh -i Alliances-Oregon.pem ubuntu@172.31.35.179

When I created my public key, I saved it in C:\User\gjenkins so I don’t need to add my path when I SSH.

As you can see, it timed out the first time. I had forgotten to add SSH (TCP22) to my AWS Firewall rule. Once added, I was able to get there.

Update the system and load Docker

A Netskope employee, Nathan Catania, has created this guide for you to follow to setup Cloud Exchange on your new AWS instance.

https://community.netskope.com/t5/Blogs/A-Guide-to-Deploy-Netskope-Cloud-Exchange/ba-p/1143

Verify

Try to access cloud exchange on your private IP

Check to see if you can get there over the public IP address. It should fail. You can remove this address from your EC2 instance.

This is how we can access the Cloud Exchange as private app using the Netskope Publisher