Cloud Exchange System Requirements

• 8 CPUs. From Cloud Exchange v5.1.0 onwards, only x86 architecture with Advanced Vector Extensions (AVX) is supported.
• 16 GB of Memory.
• 80 GB of Free Storage (recommend you provision at least 80 GB of host storage). Cloud Exchange checks the /var directory for free storage.
• Ubuntu 22.04 LTS or Red Hat Enterprise Linux 9.5 (the only ones Netskope continuously qualifies for).
• The machine running the browser accessing the Cloud Exchange UI must be able to load fonts from fonts.google.com and fonts.gstatic.com.
• Refer to Sizing the System based on Anticipated Usage for sizing requirements for different deployments.

• Cloud Exchange is outside the scope of the Netskope NewEdge Government Authorization. It is deployed in a customer owned/managed environment.

• If you need to deploy Cloud Exchange on a Federal Cloud that require components in the cloud to meet Netskope NewEdge Government requirements, you need to apply the compliant components as needed, like implementing FIPS on the system hosting Cloud Exchange in addition to the Cloud Exchange config.

The Cloud Exchange platform needs access to GitHub, Docker Hub, a Netskope tenant, partner’s platforms, and the other 3rd-party platforms that you wish to integrate with. Do evaluate network configurations, like HTTP Proxy setup, Firewall rules, etc., to ensure the connectivity is available.

Here is the list of Public URLs that Cloud Exchange needs. While the setup script will check for all of these, it will not successfully complete installing Cloud Exchange unless these requirements are met. Firewalls, web proxies, gateways, and routers must be configured to allow Cloud Exchange to communicate with multiple services as described below.

For fetching third party plugins, confirm the system has access to:

https://github.com

For fetching alerts and events from Netskope tenant, confirm the system has access to:

https://*.<tenant-domain>

If conditional access is enabled with vendors or SaaS apps for Netskope solutions or need to SSL Allowlist by IP instead of domains, your systems will need to ensure reachability to this list of Netskope consolidated IP addresses (for tenant access from Cloud Exchange in case firewall does not support FQDN based rules). Subscribe to this link by clicking Follow icon on this page: https://support.netskope.com/s/article/NewEdge-Point-of-Presence-Data-Plane-and-Management-Plane-Global-Edge-Expansion-Status-and-IP-Range

For pulling docker images from Docker Hub (connectivity to additional hosts may be required since the docker images will be behind a CDN), confirm the system has access to:

• https://hub.docker.com
• https://auth.docker.io
• https://registry-1.docker.io
• https://index.docker.io/
• https://dseasb33srnrn.cloudfront.net/
• https://production.cloudflare.docker.com/
• https://*.cloudflarestorage.com/

For fetching Python dependencies using pip, confirm the system has access to:

• https://pypi.org
• https://files.pythonhosted.org

Required domains to be accessible during HA installation for version 6.0.0 and above.

Python Packages

For Python packages, Refer Connectivity Requirements from Cloud Exchange Outbound

Required domains for installation of GlusterFS package
Ubuntu

• keyserver.ubuntu.com
• ppa.launchpad.net

RHEL

• buildlogs.centos.org

Additional OS Package Requirements

Apart from the GlusterFS package there are some other pre-requisite packages which should already be installed within the OS, if it is not installed the package will be fetched from official mirrors for the OS.

Ubuntu
Domains required to install additional packages if they are not already installed

• *.archive.ubuntu.com
• *.security.ubuntu.com
• compass.mongodb.com
• esm.ubuntu.com
• download.docker.com

RHEL
Domains required to install additional packages if they are not already installed

• cdn.redhat.com [Requires active subscription manager]
• *.cdn.centos.org
• download.docker.com
• compass.mongodb.com
• downloads.mongodb.com

If your environment uses an HTTP or HTTPS proxy server (commonly used in corporate networks), you must configure the proxy settings before installing or running Cloud Exchange.

The proxy configuration needs to be applied to the following components:

• pip
• apt
• yum
• docker
• podman

For detailed set-up instructions, refer to Proxy Configuration.

keyserver.ubuntu.com [Ubuntu]

• http://keyserver.ubuntu.com/pks/lookup?op=get&search=0xF7C73FCC930AC9F83B387A5613E01B7B3FE869A9

ppa.launchpad.net [Ubuntu]

• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/dists/jammy/InRelease
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/dists/jammy/main/binary-amd64/by-hash/SHA256/66160fca4d452fe08d06823a0d349864c437a870708388a4e76314944d1a5c91
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/dists/jammy/main/i18n/by-hash/SHA256/0709be5d722ee493b641e4590c3f96cfc647af34afbeddaeeef1f41fde8c238d
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/libgfxdr0_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/libglusterfs0_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/libgfrpc0_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/libgfapi0_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/libgfchangelog0_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/glusterfs-common_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/glusterfs-client_11.1-ubuntu1%7ejammy1_amd64.deb
• http://ppa.launchpad.net/gluster/glusterfs-11/ubuntu/pool/main/g/glusterfs/glusterfs-server_11.1-ubuntu1%7ejammy1_amd64.deb

buildlogs.centos.org [RHEL 9]

• https://buildlogs.centos.org

*.archive.ubuntu.com [Ubuntu]

• http://in.archive.ubuntu.com/ubuntu/dists/jammy/InRelease
• http://in.archive.ubuntu.com/ubuntu/dists/jammy-updates/InRelease
• http://in.archive.ubuntu.com/ubuntu/dists/jammy-backports/InRelease
• http://in.archive.ubuntu.com/ubuntu/dists/jammy-security/InRelease
• http://in.archive.ubuntu.com/ubuntu/dists/jammy-security/main/cnf/by-hash/SHA256/8b1108c5fceebf8ebde13dd3e9ac27dc0efa93dbf812735cc14e00340c425e34
• http://in.archive.ubuntu.com/ubuntu/dists/jammy-security/universe/cnf/by-hash/SHA256/20328b4e3a81e91203639b1a015d95133bc3b1f06833144e4c504a9d0f49f3c4
• http://in.archive.ubuntu.com/ubuntu/pool/main/n/nfs-utils/libnfsidmap1_2.6.1-1ubuntu1.2_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/r/rpcbind/rpcbind_1.2.6-2build1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/k/keyutils/keyutils_1.6.1-2ubuntu3_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/n/nfs-utils/nfs-common_2.6.1-1ubuntu1.2_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/a/attr/attr_2.5.1-1build1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/g/google-perftools/libtcmalloc-minimal4_2.9.1-0ubuntu3_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/libu/liburing/liburing2_2.1-2build1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/w/wcwidth/python3-wcwidth_0.2.5%2bdfsg1-1_all.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/p/prettytable/python3-prettytable_2.5.0-2_all.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/x/xfsprogs/xfsprogs_5.13.0-1ubuntu2.1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/g/google-perftools/libgoogle-perftools4_2.9.1-0ubuntu3_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/x/xz-utils/liblzma-dev_5.2.5-2ubuntu1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/libu/libunwind/libunwind-dev_1.3.2-2build2.1_amd64.deb
• http://in.archive.ubuntu.com/ubuntu/pool/main/g/google-perftools/libgoogle-perftools-dev_2.9.1-0ubuntu3_amd64.deb

esm.ubuntu.com [Ubuntu]

• https://esm.ubuntu.com

compass.mongodb.com [Ubuntu/RHEL 9]

• https://compass.mongodb.com

download.docker.com [Ubuntu/RHEL 9]

• https://download.docker.com

downloads.mongodb.com [RHEL 9]

• https://downloads.mongodb.com

cdn.redhat.com [RHEL 9]

• https://cdn.redhat.com

*.cdn.centos.org [RHEL 9]

• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/l/libgfrpc0-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/gperftools-libs-2.9.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/l/libgfxdr0-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/l/libglusterfs0-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-client-xlators-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-fuse-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-cli-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-cli-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-selinux-2.0.1-1.el9s.noarch.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/l/libgfapi0-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/l/libgfchangelog0-11.1-1.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/p/python3-pyxattr-0.7.2-4.el9s.x86_64.rpm
• http://buildlogs.cdn.centos.org/centos/9-stream/storage/x86_64/gluster-11/Packages/g/glusterfs-server-11.1-1.el9s.x86_64.rpm

For connectivity to Cloud Exchange, ensure that the administrator can access the command line interface for Cloud Exchange via SSH (port 22).

For browser and API-based connectivity to Cloud Exchange, ensure users have access to Cloud Exchange via port 80 or 443 (by default) or via any alternative, non-standard port (recommended) configured during the setup.

The user running the setup script should have at least the following permissions:

• You need to have sudo permissions.
• Either the user should be part of the docker group or should have permissions to run docker commands. (Ignore for installations on RHEL OS).

Here are the prerequisites required for setting up Cloud Exchange on Linux distributions other than Red Hat.

• Linux System capable of supporting http://docker.io release of docker and docker-compose.
• docker (v28.4.0): Refer to https://docs.docker.com/engine/install/#server for installation instructions. Verify the versions with this command. Setup script will confirm.
  docker version
• docker compose (v2.39.4): Refer to https://docs.docker.com/compose/install/linux/ for installation instructions. Verify the version with this command. Setup script will confirm.
  docker compose version
• Python 3 (for the setup script): Refer to https://wiki.python.org/moin/BeginnersGuide/Download for installation instructions. Execute this command to ensure you have the 3.11.x version of python installed. Setup script will confirm.
  python3 --version
• python3-venv (for the setup script):  Refer to https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/ for installation instructions. The setup script requires this package. Verify it’s installed with this command. Setup script will confirm.
  python3 -c "import venv; print('venv module is available')"
• Zip (For the diagnose script): Execute this command to verify if the command is available. If available, the command execution will output the path where zip commands are available.
  which zip
• Git: Refer to https://git-scm.com/download/linux for installation instructions. Execute this command to verify it is available.
  which git

Podman is a prerequisite to installing the Cloud Exchange platform on Red Hat Enterprise Linux (RHEL). Ensure these commands are available:

• podman (v5.4.0): Refer to https://podman.io/getting-started/installation for installation instructions. Verify the version with this command:
  sudo podman version
• podman-compose (v1.5.0): Refer to https://github.com/containers/podman-compose#installation for installation instructions. Verify the version with this command:
  sudo podman-compose version
• podman-plugins: Install the podman-plugins package using this command:
  sudo yum install podman-plugins
• Python 3 (for the setup script): Refer to https://wiki.python.org/moin/BeginnersGuide/Download for installation instructions. Execute this command to make sure that you have the 3.11.x version of python installed.
  python3 --version
• python3-venv (for the setup script):  Refer to https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/ for installation instructions. The setup script requires this package. Verify it’s installed with this command. Setup script will confirm.
  python3 -c "import venv; print('venv module is available')"
• Zip (For the diagnose script): Execute this command to verify that the command is available. If available, the command execution will output the path where zip commands are available.
  which zip
• Git: Refer to https://git-scm.com/download/linux for installation instructions. Execute the command mentioned below to verify that the command is available.
  which git

This section provides recommendations and guidance for selecting the memory/storage/CPU based on the expected volume. Factors include:

• Total number of indicators, alerts, tickets, applications, users and hosts stored in the database are the factors that defines the storage requirements.
• Netskope Cloud Exchange has a worker-based scheduling mechanism to cater to the data pull/push for multiple data sources. The number of workers determines how many data sources will be actively fetching data/sharing data concurrently. The total number of worker processes should be equal to the number of cores multiply by 1.25. If the expectation is to fetch data frequently with multiple data sources, consider changing the instance type.

This table shows recommendations for standard deployments:

This table shows the maximum number of indicators supported by the Threat Exchange module.

This table shows the number of alerts and events pulled and ingested at one destination by Log shipper module.

This table shows the number of WebTx logs pulled and ingested on one destination by Log shipper module using AWS LogStreaming Plugin and Azure LogStreaming Plugin.

This section provides recommendations and guidance for selecting the memory/storage/CPU based on the expected volume. Factors include:

• EDM Module: Total number of rows, columns and unique value per column stored in the provided source (CSV file/Database) are the factors that define the storage requirements.
• CFC Module: Total number of files and total size of the files in the provided source are the factors that define the storage requirement.

Free Storage Requirement Example for EDM Source Data

For a dataset with [1 million rows, 50-character strings per cell, 0.3 million unique values per column, and 2–3 columns with the dictionary option enabled], the source data size is approximately 1.18 GB.

Memory Requirements Example for EDM Source Data

For a dataset with [1 million rows, 50-character strings per cell, 0.3 million unique values per column, and 2–3 columns with the dictionary option enabled], processing stays within the CE Large instance specifications. Datasets that exceed these parameters can hit system-memory limits during hash generation.

Free Storage Requirement Example for CFC

To share the 50 GB of the Files data to Netskope Tenant, required the 100+ GB free storage to generate the hash file.

This table shows the number of credits used by the Cloud Exchange modules (CLS, CTE, CTO, CRE) and the WebTx plugins.

The number of credits used by Cloud Exchange EDM and CFC modules are:

Your numbers may differ.