Using Netskope Client

The end-user client provides the following options:

Netskope Client UI Options

• For macOS

  

• For Windows

  

• For Linux

  

Services

Displays the Netskope services enabled at your endpoint. Services displays the following options:

Windows and macOS

• Internet Security

• Private Access

• Endpoint DLP

• Endpoint SD-WAN

  Linux

  • Internet Security

  • Endpoint SD-WAN

  In Windows and macOS, you can find the services displayed in the tooltip when you hover your mouse over the Netskope Client icon in the toolbar.

  Windows

  

  macOS

  

Enabling or Disabling Client Services

By default, for all AD users or devices the client is enabled. However, users can choose to disable the client by selecting the Disable Netskope Client option from the Netskope Client system tray icon. For Windows and macOS, it displays the option Disable All Client Services.

In Windows and macOS devices, if the administrator configures the Master Password for a tenant, the end-user needs to provide a password shared by the IT administrator to disable the Netskope Client services that includes Internet Security and Netskope Private Access(NPA).

To disable Netskope Client services using Master Password:

1. Click Disable All Client Services.

   

2. This prompts another dialog box with the option to enter the master password shared by the IT administrator.

3. Enter the password.

   

4. Click Disable.

5. The webUI displays All Netskope Client Services are Disabled pop-up.

   

   The webUI displays a warning “Error Message” if the end-user enters a wrong master password in the text box.

   The steps to disable Client using Disable All Client Services in macOS remains the same.

   Netskope also provides two nsdiag options to disable Netskope Client in Windows and macOS devices:

   • nsdiag -t disable

   • nsdiag -t disable --password <master password in plain-text>

   After you run the command:  nsdiag -t disable, it asks you to provide the master password shared by your IT administrator. Once the password is entered, it displays the following successful message: Enable/disable client successful

   

   The CLI displays Incorrect Password, Client cannot be disabled message if you enter an incorrect password.

Disable Internet Security

Use this option to disable Internet Security services on Windows and macOS platforms. With this feature:

• The end-users can now easily disable Client while doing any specific tasks that require them to disable Netskope Client for Internet Security services.

• Avoids uninstallation of Client and the end-user can disable Netskope Client using a one-time password(OTP); if enabled in the Client Configuration.

Once the duration for the OTP expires, the Client re-enables automatically, eliminating the need for manual intervention by the admin.

To disable internet security services in Windows and macOS:

1. Click Disable Internet Security.

   

2. This prompts a dialog box with the option to enter the one-time password.

3. Enter the password.

   

4. Click Disable.

5. The webUI displays a pop-up Netskope Internet Security disabled for the configured time. For example, if it is configured to disable Internet Security for 10 hours, the pop-up displays a message as given in the following screenshot.

   

Post Disabling Internet Security: After disabling Internet Security from the Netskope Client icon, the Services section displays the following:

The Netskope Client tooltip displays the following:

Enable/Disable Endpoint SD-WAN

Use this option to disable Endpoint SD-WAN on Windows, macOS, and Linux platforms. With this feature end-users can optimize VPN traffic to hub gateways.

Windows

To disable Endpoint SD-WAN in Windows, click Disable Endpoint SD-WAN.

Post Disabling Endpoint SD-WAN: After disabling Endpoint SD-WAN from the Netskope Client icon, the Services section and tooltip displays the following:

Linux

To disable Endpoint SD-WAN in Windows, click Disable Endpoint SD-WAN.

Post Disabling Endpoint SD-WAN: After disabling Endpoint SD-WAN from the Netskope Client icon, the Services section and tooltip displays the following:

Enable/Disable Private Access

You can allow users to enable or disable the Client for Private Apps Access. Select the option Allow disabling of Private Apps Access from Client Configuration to view this option in the Netskope Client system tray icon.

Re-authenticate Private Access

Re-authentication for Private Apps option to force Netskope client to re-authenticate the user. This will reset the time for the next  periodic re-authentication. Contact Support to enable this functionality in your tenant.

In Windows and macOS:

If Re-authentication is enabled with Grace Period configured under Tunnel Settings on the Client Configuration UI, the Client UI displays a message with the time remaining before the private access disconnects.The message displays the total time in Hours: Minutes: Seconds left to re-authenticate to Netskope Client.

For example, in Windows, you have configured 24 hours in the Re-Authentication Interval on the Client Configuration webUI and 30 minutes as Grace Period, then the Private Access section under Services on the Client UI displays a warning message for 24:0:0.

Once the 24 hour is completed, the webUI then displays another 30 minutes as the grace period.You can also notice the Warning icon beside the text displayed that indicates that the time left for re-authentication is going to expire soon.

Once the re-authentication window expires, the Private Access status gets disabled with a proper error message.

Private Access Tenants

You can now access Private Applications across multiple Netskope tenants such as from a managed service provider, partner or third-party organizations, without needing to un-enroll or uninstall Netskope Client. You can easily switch between primary and partner tenants in a single click.

Supported OS: Windows, macOS

• Multi-tenant access: Seamlessly switch between partner organizations to access authorized private resources.

• Client UI enhancements: View current tenant details and a sub-menu listing all available partner tenants.

• No re-installation required: Eliminates the need to unenroll/ reinstall the Netskope Client when switching tenants.

 Refer to the following user interface (UI) terms displayed under the Private Access Tenants option:

• Primary tenant – Your main Netskope tenant with the Internet Security policies.

• Partner tenant – Netskope tenant used by your partner. This tenant also contains policies for all users that need access to private applications.

The number of partner accounts displayed in this section depends on the number of partners added by the administrator in Client Configuration, with a maximum up to 20.

Here are some key points to be noted while using this functionality:

• When you switch to a partner account, the Client UI displays Private Access details of the selected partner tenant. For example, Reauthentication, Private Access status, and so on. However, the Internet Security services displays details of the primary tenant.

• The Private Access section UI varies with the partner tenant.

• You can save only one partner configuration in your endpoint. When you switch to a new partner account, it un-enrolls from the previous partner account and then enrolls to the new partner.

• Once you select a new partner tenant, you need to enroll using the IDP enrollment method.

• If the end-user disables Netskope Private Access while being in the Partner account, Netskope Client switches to the Primary tenant’s prelogon connectivity (if Prelogon is enabled at the Primary Tenant).

• Separate NPA logs are created for each partner tenant in %ProgramData%/Netskope/stagent/Logs.

Here’s an example to describe the workflow of Partner Access Tenants:

Org A is an automobile supplier to large car manufacturers and with the presence of  Netskope Client in their environment. Org A works with more than 10 vendors who need access to applications used by Org A. Some of these vendors have already used services offered by Netskope and have Netskope Client installed in their environment. Now Org A can specify the group of users and the partner tenant information in the Client Configuration.

If Org B and Org C are partner users added to the Client Configuration, refer to the following to understand the different scenarios where the primary account user (for example User A) from Org A can switch between the partner users Org B and Org C.

User A Switch to Org C (Primary to Partner Switch)

User A Switch to Org B From Org C (Partner to Partner Switch)

User A switch to Primary Tenant Org A from Partner Tenant Org B ( Partner to Primary Switch)

Limitation

• Dynamic Steering configuration in partner tenants is not supported, ensure to match partner tenant users to a steering configuration without Dynamic Steering in the partner tenant.

• If the encryption token is enabled and enforced in Secure Enrollment Services, the end-user must provide the encryption token during partner switch. Upon entering the encryption token, branding file is downloaded again and decrypted successfully.

  • In Windows

    

  • In macOS

    

  The tokens are stored in the registry key (Windows) and keychain (macOS).

  • Windows: HLM\\Software\\Netskope\NPAPartnerTenants

  • macOS: com.netskope.client.branding.encryptToken

  Once these tokens are stored, the end-user is not prompted again to enter the token in the subsequent partner switches. However, once the token expires, the end-user must enter the new encryption token. When the partner tenant is deleted from the webUI, the registry entry is removed along with the partner configuration (if any) from the user machine.  Registry/keychain entries will be removed if:

  • Partner tenant is removed from WEBUI

  • Partner Tenant Access feature is disabled

  • Client unenrollment

  • Client uninstallation

Configuration

Configuration: During a troubleshooting scenario, user can click the Configuration option to view and share the following configuration details about the installed client.

• Organization

• Gateway (in FQDN format)

• Gateway IP (IP address and POP name)

• User Email (of the device user)

• Client Configuration (name of the Client Configuration)

• Steering Configuration (name of the steering configuration)

• Custom Device Classification (if the device is managed)

• Tunnel Protocol

• Private Access (status of private access)

• Private Access Gateway

• Tenant (Name of the Primary or Partner tenant if Partner Tenant Access is enabled)

• User Email (This email address in the Private Access refers to the user email address of the Primary or Partner user)

• On-Premise check (displayed when dynamic steering is used)

• Traffic Steering Type (all traffic, web traffic or cloud-app traffic)

• Config Updated (date when the client configuration was last updated)

• Configuration status.

Users can update Client configuration if an update is available.

See also: Netskope Client Command Reference for more options.

Windows

macOS

Linux

Save Logs

Use this option to save client logs that can be shared with support team for troubleshooting.

Advanced Debugging

Use this option to allow the Client to collect detailed log files like kernel driver logs, Inner packet capture, external packet capture without the need of a third-party software.

• Packet Capture: Allows you to capture the packets traversing through Netskope data center and later use the logs for debugging purposes.

  • Inner packet capture: This refers to the packets going through the Netskope data center. All packets captured are stored in the filename nspktdump.pcap in your local device.

  • Outer packet capture: Refers to the packets going through the physical network.

  The following table refers to the files available in the Netskope Client log bundle:

  Operating System	Filename
  Windows	nspktdump.pcap – Only after starting the  inner packet capture. nsouterpktdump.etl – Only after starting the outer packet capture.
  macOS	nspktdump.pcap – Only after starting the inner packet capture. nsouterpktdump.pcap – Only after starting the outer packet capture.
  Linux	nspktdump.pcap – Only after starting the  inner packet capture. nsouterpktdump.pcap – Only after starting the outer packet capture.

  Steps to perform inner and outer packet captures:

  1. Click the Netskope Client icon in the system tray and choose Advanced Debugging. This displays the Advanced Debugging window.

  2. Click the Packet Capture tab.

  3. Click the Start buttons for Inner Packet Capture and Outer Packet Capture.

     

     The buttons change to Stop with In Progress status displayed below.

  4. After recreating the issue, it is necessary to click the Stop buttons for Inner Packet Capture and Outer Packet Capture.

     

  The packet capture is mainly used to get the network packets for troubleshooting by replicating the issue. However, if you run the packet capture for a longer period, it can flood your machine disk space. As a workaround, ​​limit the size of the outer packet capture to a maximum of 99MB in the Size text box. However, the inner packet capture keeps on accumulating indefinitely. Stopping and restarting the packet captures causes the previously captured files to be overwritten( and not appended ).

  As soon as the issue is replicated, the inner and outer packet capture stops and collects the Client log bundle.

  With version 128.0.0, Outer Packet Capture feature is now available in iOS devices.

  Packet Capture in iOS

  

  Packet Capture includes the following:

  • Inner Packet Capture: This refers to the packets going through the Netskope data center. All packets captured are stored in the filename nspktdump.pcap in your local device.

  • Outer Packet Capture: This refers to the packets going through the Netskope app.

  Outer Packet Capture in iOS differs from the Outer Packet Capture available on the desktop platform. The latter captures the entire system network traffic.

  With the introduction of Outer Packet Capture feature in iOS, users can now capture both tunneled and LWIP bypassed traffic. Netskope Client excludes those network traffic not included in the Outer Packet Capture, through the excludeRoute or VPN Profile Settings. To capture the whole iOS system traffic, it still requires connecting to a Mac. To learn more, view Set up iOS Packet Tracing.

• Log management: Using Log Management, it helps end-users to gather better insights for troubleshooting, and monitoring. 

  • Set Log Level: You can set proper log levels to filter logs according to their severity. The default log level is Info. The Netskope Client uses log level received from the webUI.

    Select any one of the following options in Set Log Level:

    • Dump

    • Debug

    • Info

    • Warning

    • Error

    • Critical

    Setting to Dump level generates more logs to files. The Netskope Client keeps two log files (fixed file size 10M) for rotation. The Dump level can expedite the rotation that may incur useful logs being overwritten. The log files are stored by default in the following location:

    • Windows Devices: %ProgramData%/Netskope/stagent/Logs/nsdebuglog.log

    • macOS Devices: /Library/Logs/Netskope/nsdebuglog.log

    • Linux Devices: /opt/netskope/stagent/logs/nsdebuglog.log

    • Android: Perform the following instructions:

      1. Go to the Netskope Client app.

      2. Click the three dots.

      3. Select Send Logs. 

      4. You can download it to the desired location.

    • iOS Devices: Users cannot read Netskope logs on iOS devices, but you can download Netskope logs zip files and share them through AirDrop and email.

  • Save Driver Logs: After you set the log level, click Start and Stop to collect the logs.

  • Reveal Logs: ClickReveal Logs to view the downloaded logs in your local device.

    In Windows, the Reveal Logs option in the Advanced Debugging window displays:

    • %appdata%/netskope/stagent/logs folder if  Protect Client configuration and resources is enabled in Client Configuration > Tamperproof.

    • %programData%/netskope/stagent/logs folder if Protect Client configuration and resources is disabled in Client Configuration > Tamperproof.

    The behavior is due to the access restriction on %ProgramData% folder when Protect Client configuration and resources is enabled.  This update is available only for Client versions from 113.0.0. Prior to 113.0.0, it displayed the %PUBLIC%/netskope/log folder.

  • Speed Test: Use this option to test the Upload and Download speed of log files. Click Start to initiate the testing.

    Wait until both packet capture stops before collecting Netskope Client Logs.

Blocked Events

To view the list of blocked events, right click on the client icon and select View Blocked Events. The resulting pop-up window displays the list of access attempts that are made to any certs pinned and which are configured as blocked by the admin. Use this option to view the list of blocked events relating to certificate pined apps. These are apps that are set to be blocked in the tenant.

Netskope Client Icon Status And Notifications For Platforms Except Windows and macOS

Icon	Status	Description
	Enabled	The client is successfully connected to the Netskope Gateway and the client icon is in full color.
	Disabled	The Netskope client has failed to download the required configuration. The client will continue to be in this state until the configuration is downloaded. Possible causes are: The client was disabled by the end user. The client was disabled by the admin in the Netskope admin console. The client automatically disables itself due to the presence of a secure Forwarder, a GRE Tunnel, or a Dataplane On-Premises configuration. The client is disabled in a multi-user scenario for the local admin or users who are not provisioned in the tenant.
	Disabled due to error	The Client is disabled and the icon is grayed out with an orange circle and an exclamation point. Possible causes are: The client has connectivity issues to the Netskope Gateway. The health check has failed. The client service is stopped manually.
	Disabled due to fail close.	The Client is disabled and the icon is in red color. Possible causes:Tunnel connection could not be established.

Netskope Client Icon Status And Notifications For Windows and macOS

Icon	Status	Description
	Enabled	The Client icon is in full color when either one of the following services or both are enabled: Internet security Private Access
	Disabled	The Netskope client has failed to download the required configuration. The color here denotes that if all services are disabled and there is no Client Configuration download failure. The client will continue to be in this state until the configuration is downloaded. Possible causes are: The Internet security and Private Access was disabled by the end user. Internet Security and Netskope Private Access was disabled by the admin in the Netskope admin console. Internet Security and Netskope Private Access automatically disables itself due to the presence of a secure Forwarder, a GRE Tunnel, or a Dataplane On-Premises configuration. Internet security and Netskope Private Access is disabled in a multi-user scenario for the local admin or users who are not provisioned in the tenant.
	Enabled with warning	The icon is orange in color which states at least one of the services is enabled but has a warning in at least one of the services. Possible causes: NPA re-auth is in grace period and other services are enabled.
	Enabled with error	The icon is red in color which states at least one of the services is enabled but has an error with at least one of the services. Possible causes: NPA re-auth is in grace period and other services are enabled. Tunnel is down.
	Disabled with warning	All services are disabled and one of the services has a warning.
	Disabled with error	All services are disabled and one of the services has an error. The icon is grayed out with a red circle. The tooltip displays the following when both services are disabled and one of the services are disabled due to an error: Internet Security disabled due to error. Private Access disabled due to error. Possible causes are: Internet Security and Netskope Private Access have connectivity issues to the Netskope Gateway. The health check has failed. The client service is stopped manually.
	Disabled due to fail close.	The icon is in red color when: Internet security is disabled due to fail close, but Private Access is exempted from fail close. Internet Security and Private Access is disabled due to fail close. Possible cause: Tunnel connection could not be established.

The following table lists various client service statuses and their meaning. You can also query client status via the  Get Client Data REST API.

Internet Security Service Status And Notifications

This represents the status of the tunnel that forwards traffic to Cloud Apps, Proxy, and Firewall.

Event	Actor	Status	Meaning
Installed	System	Disabled	Via email invitation, distribution tool (i.e. SCCM, Altiris, JAMF etc)
Tunnel Up	System	Enabled	‘Auto’ enabled just after install, upgrade or later
Tunnel Down	System	Disabled	disabled – default startup state of client i.e. after installation/upgrade/restart
Tunnel down due to secure forwarder	System	Backed Off	‘Auto’ disabled due to Netskope Secure Forwarder found
Tunnel down due to GRE	System	Backed Off	‘Auto’ Disabled due to GRE
Tunnel down due to IPSec	System	Backed Off	‘Auto’ Disabled due to IPSec
Tunnel down due to Data Plane on-premises	System	Backed Off	‘Auto’ Disabled due to on-premises DP
Tunnel down due to config error	System	Errored	‘Auto’ disabled due to config errors/missing config
Tunnel down due to error in Modern Standby mode	System	Disabled	Auto’ disabled due to device in modern standby mode (AOAC)
Tunnel down due to error	System	Disabled	‘Auto’ disabled due to (any other) error
Change in network	System	Disabled	‘Auto’ disabled due to change in network
System shutdown	System	Disabled	‘Auto’ disabled due to system restart/ power down
System powerup	System	Disabled/Enabled	‘Auto’ Tunnel status will be as per actual status
Enrollment Token Error	System	Errored	Displayed when an invalid enrollment authentication token is used
Enrolled	User	Disabled	Once the user enroll using IdP mode through the Netskope Client webUI.
User Disabled	User	Disabled	User disabled the client from the system tray
User Enabled	User	Enabled	User enabled the client from the system tray
Admin Disabled	Admin	Disabled	Tenant admin disabled the client from the system tray
Admin Disabled (This event is available only for tenants with Dynamic Steering)	Admin	Backed Off	Tenant admin disabled the Client from the webUI. Whenever the admin selects None steering option, the Netskope Client disables only traffic steering and sends “Admin Disabled” event to the Device info.
Admin Enabled	Admin	Enabled	Tenant admin enabled the client from the webUI
Installed	System	Disabled	Via email invitation, distribution tool (i.e. SCCM, Altiris, JAMF etc)
Uninstalled	System	Uninstalled	Uninstalled by end user, admin, SCCM admin etc
Installation Failure	System	Disabled	Installation failed
Uninstallation Failure	System	Disabled	Disabled  Failed to uninstall the Client
Upgrade Success	System	Disabled	Client upgraded successfully
Upgrade Failure	System	Disabled	Client failed to upgrade
Rollback Success	System	Enabled	Rolled back to client version ‘x’
Rollback Failure	System	Enabled	Failed to rollback to client version ‘x’
Device Posture Change	System	Managed	Whenever the Client is in compliance with the device classification rules configured for an OS platform, the Managed status is displayed in the Device Posture Change event.
Device Posture Change	System	Unmanaged	Whenever the Client is not in compliance with the device classification rules configured for an OS platform, the Unmanaged status is displayed in the Device Posture Change event.
Device Posture Change	System	Unknown	The Client sends Unknown status before the Client downloads the device classification rules.
CA Installation Change	System	Disabled/Enabled	CA rotation is detected and new CAs are installed to the system store. When the CA rotation is detected (the new downloaded CA is different from the existing CA and the subject name is the same), Netskope Client  posts the “CA Installation Change” event for cert rotation monitoring.
CA Installation Failure	System	Enabled	CA installation failed. This event is posted when the first attempt fails. Consecutive installation failures are not posted onto the webUI until the CA installation succeeds. Once the CA installation succeeds, it resets the status.
CA Installation Success	System	Enabled	Successful CA installation after the failed CA installation attempts. No CA Installation Success event is posted on the webUI when there are no failed attempts.

Network Private Access Status And Notifications

This represents the status of the tunnel that forwards private application traffic to Netskope.

Event	Actor	Status	Meaning
Disabled	System	Disabled	NPA is not available for the customer. NPA status code is 0.
Disabled	System	Disabled	NPA is available for the tenant but tunnel is not yet established. It should be transient state. NPA status code is 0.
Disabled	System	Disabled	NPA is available, but not enabled from the tenant UI. NPA status code is 0.
Enabled	System	Enabled	NPA tunnel is connected. NPA status code is 2.
Disabled	System	Disabled	User disables the NPA Client. NPA status code is 0.
Disabled	System	Disabled	Admin disables the NPA Client from the tenant UI. NPA status code is 0.
Errored	System	Disabled	NPA tunnel is disconnected due to error. NPA status code is 11.

Endpoint DLP Status And Notifications

If Endpoint DLP is enabled, you can click View Details to see Endpoint DLP Service Details.

There are two Endpoint DLP statuses:

• Config Status: The configuration state for the endpoint, which comes from the Client configurations applying to the endpoint. It displays Enabled or Disabled indicating if the endpoint should have Endpoint DLP enabled or not based on the Client configurations.

• Service Status: The reported status of the Endpoint DLP software on the endpoint. This is the same status displayed in the Services table above, which is reported by epdlp.exe (Windows) on the endpoint. You can see one of the following states:

  • Enabled: The service is running, communicating correctly, and working properly.

  • Disabled: The service is not running.

  • Paused: The service is paused by clicking Pause Service. This action lasts for 30 minutes.

  • Device Control Error/Device Control Disabled: The driver for USB Device Control is unable to load correctly. This status might appear for machines that are turned off.

  • System Reboot Required: The endpoint needs a reboot so the USB device control functions properly. This occurs when the system has a non-resettable USB controller and an Endpoint DLP upgrade occurs. The new driver can’t be loaded until the reboot occurs.