I am running a test from my Netskope client, Mobile Android version.
When I check the event logs of Page events, the following appears and I don't have any policy that generates bypass at SSL decrypt level or Real time rule.
I'm testing and I don't see it blocking the sites that it does block in a rule with the client on a workstation, but from the Netskope Mobile Client on Android the following appears:
Bypass Reason: Bypass_reason SSL Do Not Decrypt Bypass Policy Matched Bypass Traffic: yes Src Time: Tue Apr 18 20:22:00 2023 Ssl Decrypt Policy: yes User Generated: yes Type: connection Policy Name: Default do-not-decrypt Android traffic for versions Nougat and above
Are there any restrictions on client installation and use of Mobile Android ? Is there any extra step to do when installing the client on the mobile Android from the invitation ?
The Android version I am using in the test is "11". According to the Netskope site it is supported.
@MetgatzNK just to add some more context to this. The default do not decrypt for Android exists as the operating system has restrictions on importing root certificates. In general you must add a certificate to each app for it to trust a certificate for SSL inspection. The do not decrypt activates when Android traffic is sent to Netskope on a device where we don't detect the Netskope certificates imported. You can import the Netskope certificate to an Android device and then we can intercept and inspect traffic from the browser. Other apps may require additional configuration or will need to be bypassed from SSL inspection via a certificate pinned bypass in the Steering Configuration. In short, it is possible to inspect traffic from Android devices but requires additional configuration. I'd suggest reaching out to your local Netskope account team or potentially professional services if this is an enterprise deployment. Hope this helps and apologies for the delay!
most of the android users are accessing the content using the native android apps. Most of them are cert pinned app applications. Popular domains are consumed from those apps but also from browsers, so instead of asking the admins to create DnD (Don't decrypt) rules just for cert pinned apps, it's simpler to leverage a general exception for that access method.
This is the reason you are seeing android client sourced traffic matching a generic DND policy.
Yes, I understand what I commented, but at this point, the log that I commented above, this log was not based on any particular application, but simply all queries to websites, through the Android web browser, ie Firefox, Chrome, Brave, native web browser.
Moreover, this rule does not appear in the list of SSL default rules, but if Netskope is applying it, it is a base rule but it does not exist, it was not declared and was not created by us and it applies to websites, not SaaS applications, but to any site of the traditional type to all.
as I mentioned before this is something we have configured for you. There's no way to identify if the traffic is being sourced from the native app or the browser. So the traffic needs to be don't decrypted. The policy isn't visible for you because it's applied on the backend.
@MetgatzNK just to add some more context to this. The default do not decrypt for Android exists as the operating system has restrictions on importing root certificates. In general you must add a certificate to each app for it to trust a certificate for SSL inspection. The do not decrypt activates when Android traffic is sent to Netskope on a device where we don't detect the Netskope certificates imported. You can import the Netskope certificate to an Android device and then we can intercept and inspect traffic from the browser. Other apps may require additional configuration or will need to be bypassed from SSL inspection via a certificate pinned bypass in the Steering Configuration. In short, it is possible to inspect traffic from Android devices but requires additional configuration. I'd suggest reaching out to your local Netskope account team or potentially professional services if this is an enterprise deployment. Hope this helps and apologies for the delay!
Badges Winner
Edwin87has earned the badge Content Contributor - 1
Mandeep Singhhas earned the badge Content Contributor - 10
Mandeep Singhhas earned the badge Content Contributor - 5
Mandeep Singhhas earned the badge Content Contributor - 1
