Ask the community

Netskope Private Access and Cloud Exchange running in Azure

Kmaheshwari
Netskope
Netskope

Netskope Private Access and Cloud Exchange running in Azure

Overview

Using Netskope’s Private Access (NPA) can help secure workloads in Azure like deploying Netskope’s Cloud Exchange there. In this solutions guide NPA is used to front end a Cloud Exchange server that doesn’t have direct inbound internet access. 

Kmaheshwari_0-1689610443042.png

 

Requirements

  • Netskope tenant with a NPA license
  • Azure account

Setup Steps

Netskope 

  • Configure a Netskope Publisher in your Tenant

 

Azure

  • Deploy Virtual Machine Netskope Publisher

 

Cloud Exchange

  • Setting up Cloud Exchange in Azure
    • Deploy Virtual Machine Ubuntu Server
    • Add Access to Cloud Exchange via NPA
    • Setup Cloud Exchange on Ubuntu Server

 

Verify
  • Netskope Tenant sees your publisher
  • Check your client for the NPA tunnel
  • Try to access cloud exchange on your private IP

Configure a Netskope Publisher in your Tenant

Go to your Netskope Tenant > Settings > Security Cloud Platform > Publishers

Click New Publisher

 

Kmaheshwari_0-1689609957532.png

 

 

Give your publisher a name

Save and Continue

Kmaheshwari_1-1689609957505.png

 

 

Generate Token > Copy

Done

Kmaheshwari_2-1689609957772.png

 

Deploy Virtual Machine Netskope Publisher

Log into your Azure account and go to Azure Marketplace. Search for the Netskope private access publisher. 

Click on Create

Kmaheshwari_3-1689609957920.png

 

 

Create your Virtual Machine with the appropriate permissions & Add a name for your instance and you can also search for Netskope publisher in the Image section below

 

Kmaheshwari_4-1689609957789.png

 

 

Key pair - Select or create a Key Pair so that you can ssh into it if needed. 

Network settings - I am going to have it automatically create a security group. When we add Cloud Exchange, we will use this same Network vpc and Security Group 

Allow HTTPS

Also Please make sure to replace the username: azureuser to ubuntu to successfully SSH into the Azure Netskope Publisher.

Open the SSH port and generate the new SSH key pair or use the existing one if you have one.

SSH connection would be needed to configure the Generated token and any other updates related to the Netskope Publisher.

 

Kmaheshwari_5-1689609957781.png

 

 

After creating the Azure Netskope Publisher try to ssh into the machine:

 

ssh -i PublisherNetskope_key.pem ubuntu@Machine-Ip

After the SSH it will land you into the Publisher Registration page:

 

Kmaheshwari_6-1689609957967.png

 

 

Press 1 and add the generated token from when you created the publisher

 

Kmaheshwari_7-1689609957778.png

 



Verify 

Netskope Tenant sees your publisher

Go back to your Netskope tenant and verify that your publisher is Connected. 

Security Cloud Platform > Traffic Steering > Publishers

 

Kmaheshwari_8-1689609957739.png

 

Setting up Cloud Exchange in Azure

Deploy Virtual Machine Ubuntu Server

Log into your Azure account and go to Virtual Machine. If you don’t see that on your main  dashboard you can search for Virtual Machine. 

Click Create > Azure Virtual Machine

Kmaheshwari_9-1689609957763.png

 

 

Give your new Virtual Machine a name and select Ubuntu 22.04 LTS

Kmaheshwari_58-1689610238058.png

 

Select an Instance type. To help you decide on size, check out our Sizing the System section here:

https://docs.netskope.com/en/cloud-exchange-system-requirements.html 

Select or create a key pair. If you create the key, you will need to save it to your hard drive. We will use this to SSH to Cloud Exchange in a couple of steps so be sure to know the path of where you put it. 

 

Since you are fronting this with Netskopes NPA, you don’t need any connection from the internet. 

Network settings - Edit these to match the Virtual Network that you put the NPA in. 

 

Kmaheshwari_30-1689610076813.png

 

 

Firewall security group - you will need a new security group since the NPA one is allowing https. This one doesn’t need to allow any inbound traffic from the internet. You will only be getting to it from the NPA tunnel. 

 

Kmaheshwari_31-1689610076801.png



Review the summary and Launch instance. 

Kmaheshwari_32-1689610076808.png

 

 

You will also need to add an Inbound Security rule so that your Publisher can talk to your Cloud Exchange. Mine are both in this subnet and I just created an allow for the entire subnet. 

Go to specific Virtual Machine > Networking > Inbound Port Rules 

Kmaheshwari_33-1689610076816.png

 

Add Access to Cloud Exchange via NPA

Before you can SSH to Cloud Exchange to finish the setup, you will need to tell Netskope to allow that traffic down the NPA tunnel by adding it to the App Definition. You will also need the private IP address of your Cloud Exchange server. 

 

Private Address of Cloud Exchange

Go into your Azure Virtual Machine and select your Cloud Exchange Server. It will list your Private IP. 

Kmaheshwari_34-1689610076827.png

 

Now that you know your IP, create a new Private App for TCP 443 and 22. 

Settings > Security Cloud Platform > Traffic Steering > App Definition > Private Apps

Kmaheshwari_35-1689610076804.png

 

 

Give your application a name, list the IP in the host field, add TCP 443 and 22, and Select your Publisher. 

Save

Kmaheshwari_36-1689610076804.png

 

Steer your Client Traffic

Before your NPA traffic will go through the tunnel, you need to add your Private Apps to your Client Steering Configuration. 

Settings > Security Cloud Platform > Traffic Steering > Steering Configuration

 

Kmaheshwari_37-1689610076805.png

 

 

Edit your config. 

Kmaheshwari_38-1689610076809.png

 

 

Steer private apps

Save

Kmaheshwari_39-1689610076809.png

 

After this is done please also make sure to assign the Policy for the private app to allow the required traffic for the app:

 

Go to the Policies > Real-Time-Protection 

Create the new Policy specifically for the private app



Kmaheshwari_49-1689610177080.png

 

 

Now to check if everything is working fine you need to again go to Private App > Troubleshooter

 

Kmaheshwari_50-1689610177037.png

 

 

Click on your user to check if the private app can be accessible:

 

Kmaheshwari_51-1689610177039.png

 

 

Make sure your client is enable or other results mentioned in the Troubleshooting:

 

Kmaheshwari_52-1689610177081.png

 




Verify

Check your client for the NPA tunnel

 

Kmaheshwari_53-1689610177082.png

 

Setup Cloud Exchange on Ubuntu Server

You will need to SSH to it to finish the setup. 

SSH with your public key.

The default user is azureuser.

Here is the command I will use. 

 

ssh -i CloudExchange_key.pem azureuser@10.0.0.5  

Kmaheshwari_54-1689610177036.png

 

Update the system and load Docker

A Netskope employee, Nathan Catania, has created this guide for you to follow to setup Cloud Exchange on your new Azure instance. 

 

https://community.netskope.com/t5/Blogs/A-Guide-to-Deploy-Netskope-Cloud-Exchange/ba-p/1143

 

Verify

Try to access cloud exchange on your private IP

Kmaheshwari_55-1689610177038.png

 

 

Check to see if you can get there over the public IP address. It should fail. You can remove this address from your Virtual Machine. 

 

Kmaheshwari_56-1689610177082.png

 

Kmaheshwari_57-1689610177039.png

 

 

This is how we can access the Cloud Exchange running in Azure as private app using the Netskope Publisher.



Subscribe

In order to view this content, you will need to sign in to your account. Simply click the "Sign In" button below

Sign In