Skip to main content
  • EN

Next Gen SWG

This is a discussion board on Netskope’s Next Generation Secure Web Gateway, a cloud-based web security solution that prevents malware, detects advanced threats, filters by category, protects data, and controls app use for any user, location, device. It unifies our industry-leading CASB, SWG, and DLP into common policy controls with custom reporting and rich metadata for ad-hoc queries.

  • 185 Topics
  • 456 Replies
185 Topics
Rohit_Bhaskar
Netskope Employee
Rohit_BhaskarNetskope Employee
posted in Next Gen SWG
Is the data is getting sync with SF??????

Is the data is getting sync with SF

91
Rohit_Bhaskar
Netskope Employee
M
mdmeow12123
asked in Next Gen SWG
Offline Agent Reporting

Is there a way to setup a report or alert to capture devices that have not reported traffic in x number of days?It turns out that after an audit, we have quite a few agents where Netskope is installed but not steering any data to the our tenant.  We believe that in these cases the agents subsystems are not fully functioning. The users are not allowed to disable the agents. Thank you. 

154
M
S
steff94
asked in Next Gen SWG
DNS Policy - Only whitelisted FQDNs or Domain-Wildcards

Hello all,I wanted to ask if there is any way to configure Netskope to block all DNS revolving of public DNS namens by default?We want to manually specify a list of FQDNs or Domain-Wildcards to be allowed to resolve (ie. *.teams.microsoft.com or dns.msftncsi.com). We saw the option to Blackliste a FQDN or Domain-Wildcard in the DNS profile but there seems no option to block ALL except of ... Best regardsStefan

120
S
F
Netskope Partner
farhanNetskope Partner
asked in Next Gen SWG
Netskope Client in Disable state MAC Installation via Email invite.

Hi Team we are try to install the NS client on Macos 12.3 Macbookpro via email. (POC)We install package successfully but we  tenant and G/w is not display in Configuration of NS client.Lookup the gateway and URL resolution is successful. in Nsdebuglog I can see :   

00
F
Netskope Partner
P
patrickmendosa
posted in Next Gen SWG
Issues with Facetime

Re: Support Case00347414 I am having issues with Facetime when Netskope is enabled. I am steering "All Traffic" I have created a certificate pinned app for the facetime process and bypassed * all domains from steering config.  Whether this cert pinned app is enabled, or not - the issue persists. I have ALLOW-ALL rules set for cloud apps, all web traffic, and cloud firewall. I also have numerous Apple domains set to Do Not Decrypt in SSL Decryption policy.  Looking for assistance from others who may have encountered this in there deployment.  @sshiflett any ideas? NS Debug Logs with Cert Pinned App disabled: 2023/11/20 11:36:43.519144 stAgentNE p2668 t18363 info tunnel.cpp:873 nsTunnel DTLS [sessId 120352348] Tunneling flow from addr: 1.0.0.1:51979, process: facetime to host: gateway.icloud.com, addr: 17.248.193.19:443 to nsProxy 2023/11/20 11:36:43.652241 stAgentNE p2668 t9523 error nsClientFlow.mm:200 nsClientFLow Find UDP flow id

10
P
juergen
juergen
posted in Next Gen SWG
How to enable “Periodic Validation on Device Classification” for NG-SWG

Summary With release R99 Netskope introduced a new feature “Periodic Validation on Device Classification” which is very important to enforce Zero Trust principles. Before that release, Device Classification of the client was only accomplished, when client service was started. With the new feature a validation interval can be configured for more frequent device posture checks. Requirements: NS Client version R99 or later is required. Please contact your Customer Success Manager, Netskope Support or your Account Team to get this feature enabled.  Today this feature is disabled by default!   Tenant Configuration Device Classification Profile The “Device Classification Profile” is a policy about a single or multiple checks, whether a device is compliant or not. This part of the configuration has not changed and will not be covered in detail in this post. Here is the link to public documentation. For testing on Windows a simple profile can be created to check if “notepad.exe” is

10
juergen
J
Netskope Partner
Jais100rbhNetskope Partner
posted in Next Gen SWG
Netskope Gateway Slection

Suppose we have two gateways i.e SWG and NPA gateways and both the tunnels are established between respective gateways and the client. How does Netskope client understand where the traffic should be routed?  

00
S
A
Anonymous
posted in Next Gen SWG
Android Studio Issues with MAC

Recently observed that Android Studio Issues on MAC devices even after exempted Android Studio from Netskope Proxy. Users using Android Studio are not able to connect to devices on wifi in the application. Is there is any issues with Android Studio with Netskope for MAC devices. 

00
A
K
Netskope Partner
kunalgandhiNetskope Partner
posted in Next Gen SWG
Control download activity for Github application

Hi, I am facing some issues  with Git-hub download activity controlChecking here if anyone have an experience who can put some light and help to find solution Our requirement for Git-hub realtime protection is :-User allow to view any files (any file type)User allow to click on “Raw” and view the details of that fileWhen user click on ‘Download”, this activity should get blocked. Issue :-When user click on ‘Raw”, it is showing activity Download in the Netskope logs and getting blocked. I have checked the logs for both the activities ( when click on Raw Data or  Click on Download ) showing as Download. Any way we can only block the actual download action ( not when users are clicking on Raw data). Thank you in advance.Regards,Kunal Gandhi

00
J
A
Netskope Partner
akashsaxenaNetskope Partner
posted in Next Gen SWG
Client deployment on MAC via sure MDM (42 gears)

How can I deploy clients on Mac devices using Sure MDM? I looked for documentation but didn’t find any.

00
S
T
TMRT
posted in Next Gen SWG
SMTP Proxy Tidbits (SPF and Proofpoint Tweak)

  If you are deploying Netskope SMTP Proxy few notes of interest. (Various screenshots of interest attached).   1. If your upstream has SPF check ensure to add following record to your DNS server  so that the SPF check does not fail   _spf.goskope.com   2. To allow Netskope IP's refer to the following list   2.a If you are using Proofpoint as the upstream MTA there is a tweak to allow these IP's. Proofpoint does not accept CIDR ranges. Also adding in CIDR notation e.g. /24 did not help in my case. Use the following format (first 3 octets only) (screenshot attached)   163.116.128 8.36.116   NOTE: for complete list of IP's subscribe to this article. There is a table for SMTP Proxy " Netskope Email DLP (SMTP) List for Allowlisting The following list of IP ranges represents where SMTP traffic may egress from Netskope's NewEdge Security Cloud, and should be used for permitting traffic with upstream email providers. Netskope's recommendation is th

00
H
Netskope Partner
E
eran
asked in Next Gen SWG
REST API V2

Hi,I'm trying to use the REST API V2. All the documentation I find refers to two REST API options in the Settings -> Tools menu: REST API V1 and REST API V2.However, the Admin console shows (in Setting -> Tools) only one option: "REST API".Is this the REST API V2? If so, where is the Swagger API Documentation (https://docs.netskope.com/en/netskope-help/admin-console/rest-api/rest-api-v2-overview-312207/#swagger-api-documentation)?If not, then how can I create a Token for using REST API V2?Thanks!  

00
Z
Netskope Partner
M
mdmeow12123
posted in Next Gen SWG
Mac OS Ethernet Dongles and Netskope

Hi Folks,We have a few users that have real difficulty with reestablishing connectivity via netskope when their macs come out of sleep/hibernate. The common thread between them is that they are also using dongles with ethernet connections to the internet. One fix that appears to help some users is turning off IPV6 ( changing to link-local) on any ethernet dongle that is attached. Curious if others are seeing this issue. Thanks!

00
R
O
originalsauce
posted in Next Gen SWG
IOS silent deploy of VPN profile - not working until netskope app opened

Hi all,we are looking to deploy Netskope IOS app to allow access to NPA internal Apps.I'vedeployed the netskpope root/inter certificatesDeployed netskope appnetskope app configurationVPN config profile (for per app vpn)scoped required internal app to use Netskope VPN. the per-app VPN apps selected do not have connectivity using VPN until i open the netskope app first. This is what happens when the netskope app is opened, after this app is opened everything starts working.  Can we make the IOS netskope deployment zero touch?    

00
O
A
Netskope Partner
adityasharma08Netskope Partner
asked in Next Gen SWG
FAIL CLOSE

Hello Everyone,can you please guide me in enabling fail close even when client is not installed and access method is IPsec/Gre. what configuration i need to do on firewall in o

00
S
J
jweaver
posted in Next Gen SWG
Referrer Allow Rule Not Working

I have a Real Time Protection DLP rule that is blocking uploads to unauthorized cloud storage sites. This rule hit when a user uploaded an invoice to a platform we use, Divvy. Divvy's storage is backed by S3. As such, the event shows that there was an Upload action on S3, with the referrer being https://app.divvy.co. As this platform is trusted and will be in frequent use, I want to whitelist these actions. As such, I:created a HTTP Header policy, designating that I want to check the Referrer header, and set the value to https://app.divvy.cocreated a RTP policy above the the existing DLP policy that is blocking (well, alerting the user on) the upload. The policy allows Upload to S3 if the referrer matches the one I created above.NOTE: The Allow policy, while above the Block policy, is in a different policy group. I don't think this matters, but figured it was worth stating. Of course - you know where this is going. The action continues to be alerted on, despite the explicit a

00
J
W
wilson
posted in Next Gen SWG
Patient Zero policy Realtime Policy has anyone actually done this?

Netskope Advance Threat Protection does have a sandbox/research feature to investigate files that are downloaded with a sandbox examination, amongst other things.  Having an alert later on that a file is malicious gives a reason for follow-up on that person/computer. They also have a policy suggestion, where novel files are not downloadable until after they pass a sandbox exception.  The devil is in the details "The Netskope advanced threat engines can take up to 10 minutes to analyze the file."  Also, in practice, if you the download just fails for 10 minutes of clicking on it, no pop-up warning you that it is in review. So I am dying to know - has anyone actually done this policy? I am also fascinated by the policy example, where the policy is applied to downloads of Adult Content and Adult Content - Porn.  The net effect would be "As a company it is OK to go to a porn site and download from it, but you have to wait 10 minutes while we check out the

00
S
S
Stewart
posted in Next Gen SWG
Netskope Client and Arch Linux

Hi Folks,I have an Arch Linux device which we would like to get behind Netskope. The OS on this device can't be changed and while I am thinking we could take a few different options I thought I would have a crack at convincing the Netskope Client to work.It installs and enrols just fine, however, once running there seems to be an issue between the client and the stAgentSvc. The `nsclient` command will report unable to connect to service. Diving a little deeper with `strace` and I can see a connection reviews to the UNIX socket `~/.netskope/stagent/apps`, which would indicate the stAgentSvc is not in a good state.I have not been able to identify where or what might be the cause of stAgentSvc not working - despite a fair chunk of reviewing debug logs and strace output. Has anyone come across this problem on a Linux device before and resolved it?Thanks in advance for any help.

20
S
A
Anonymous
posted in Next Gen SWG
Bandwidth utilization goes high over netskope tunnel

DC and DR internet links have been choked as there is a heavy utilization over netskope. we raise a ticket over TAC but no resolution found as per my knowledge user client traffic is acting as DPOP traffic where in we are not able to trace out this abnorml

00
S
jforrest
jforrestCommunity Manager
posted in Next Gen SWG
Facing User Issues while steering Web Conferencing Apps?

The majority of performance related issues faced while attempting to leverage Netskope for visibility and control on conferencing apps is root caused to improper configuration of the web conferencing app best practices associated with the UDP traffic.   Why: UDP protocol is best suited for real time audio and video traffic If customer has not enabled the necessary UDP ports when on premises, real time traffic will fallback to TCP and steered through Netskope “Using TCP in a near congested network will cause retransmissions, which in turn can create a choppy video or low bandwidth error experience. UDP does not retransmit, and will provide a better video experience.” How: Please ensure you have opened/sent direct the necessary UDP ports for the below apps: If that connection can not be established, Zoom will also try connecting using TCP on port 8801, followed by SSL (port 443). Microsoft Teams: UDP port 3478 to 3481 (see article for details) Google Meet: set up outbound U

00
jforrest
mherbinet
mherbinet
posted in Next Gen SWG
How to Capture HAR on Google Chrome

Summary During certain troubleshooting situations, Netskope Support may request various debugging output from the Google Chrome Developer Tools (DevTools for short). Specifically, HAR (HTTP Archive) is a file format used by several HTTP session tools to export detailed traffic data for analysis. Environment Users experiencing cloud app page loading or performance issues while using a browser. Application access issues Reverse proxy (SAML/Auth).   Cause Netskope Support and Engineering require HAR debug output from the affected client to provide app traffic data for analysis. Resolution If requested by Netskope Support, please provide the HAR debug output with the following instructions (please reference the following link for additional details: (https://toolbox.googleapps.com/apps/har_analyzer/)  Warning Please be cautious that the HAR capture will have sensitive information like Application login Username, Password etc in clear text. 

00
W
M
mdmeow12123
posted in Next Gen SWG
Mac OS Sonoma

Sonoma is coming out on the September 26th. Does Netskope have any statement on whether it is supported? If so, which version of NS client?  I have not been able to see anything here or the support portal. Thank you. 

00
M
Netskope Partner
F
Netskope Partner
farhanNetskope Partner
posted in Next Gen SWG
PAC file in Server

Hi team,There is one use case of server where they required a PAC file to be configured in there servers to connect the netskope dataplane can you let me know any configuration or pre-requisites is required to server connect with Netskope Dataplane Also please let me know the use cases of static server which required internet.

00
ukrishna
Z
zakeriya_shaikh
posted in Next Gen SWG
What is Web Socket terminology used in Netskope?

What is Web Socket terminology used in Netskope?

00
Z
E
Netskope Partner
Edison_VaLbuenaNetskope Partner
posted in Next Gen SWG
Netskope’s ability to control specific activities

  Hello community, I would like to know if Netskope can control some of the following activities across social networks or collaboration tools: - Login, logout, block, approve, join, mark, request, unfollow, create and delete… Thank you in advance.

00
A

Badge winners

  • Solutions - 10
    mkoyfmanhas earned the badge Solutions - 10
  • Solutions - 10
    sshifletthas earned the badge Solutions - 10
  • Solutions - 10
    VarunKhas earned the badge Solutions - 10
  • Solutions - 2
    mkoyfmanhas earned the badge Solutions - 2
  • Solutions - 2
    rosshas earned the badge Solutions - 2
View All

Not finding what you're looking for?

Don't be shy and let us know about your challenge.

Ask your question here!
Terms & ConditionsCookie settings