Configuring Virtual Private Edge

After you have deployed the VPE Node, you can configure Virtual Private Edge (VPE) and apply the Netskope service to your environment.

Configuring a Platform Template

To configure a platform template:

1. In the Netskope UI, go to Settings > Security Cloud Platform > On-Premises Infrastructure.

2. Click the Next-Gen tab.

3. On the Next-Gen page, click Manage Template and then click Platform Template.

   

4. In the Manage Template window, click New Template.

   

5. In the New Platform Template window, enter the required information such as the template name or NTP servers.

   The upgrade timing options in the platform template are grayed out at this time. To learn how to configure upgrade frequency, see Managing Auto-Upgrades.

   

6. Click Save.

7. To attach the created platform template to the VPE Node, on the Next-Gen page, click Appliance Setup in the Services column for the VPE Node.

   

8. From the VPE Platform Template dropdown list, select the platform template.

   

9. Click Save.

   

The name of the platform template appears in the VPE Platform Template column for the VPE-Node.

Configuring a Service Template

To create a service template:

1. In the Netskope UI, go to Settings > Security Cloud Platform > On-Premises Infrastructure.

2. Click the Next-Gen tab.

3. On the Next-Gen page, click Manage Template and then click Service Template.

   

4. In the Manage Template window, click New Template.

   

5. In the New Service Template window, enter the required information, such as the Service template name.

   • The upgrade timing options in the service template are grayed out at this time. To learn how to configure upgrade frequency, see Managing Auto-Upgrades.
   • Only Secure Web Gateway (SWG) and AI Guardrails are available as a supported service templates for VPE.

   

   SWG

   AI Guardrails

   In the General tab and under Proxy Mode – Explicit, enter the Listener Ports. The default port is 8080.

   

   This is a Beta feature. Contact Netskope Support or your sales representative to enable this feature for your tenant.

   For the AI Guardrails service, enter the following information:

   • HTTP (Port 8080): The port that the AI Guardrails On Demand API is available on.

   • GPU based AI Guardrails VM: Enable and connect to a GPU-based VM to leverage LLM based detection in AI Guardrails.

     • Association of the GPU based Container: Enter the container URL or IP address. Click GPU based AI Guardrails Image to download the GPU image.

     • JWT URL: (Optional) Enter the OAuth2 token endpoint, such as https://<auth-provider>/oauth2/token.

     • Client ID: (Optional) Enter the OAuth2 client ID issued by your identity provider (IdP).

     • Client Secret: (Optional) Enter the OAuth2 client secret issued by your identity provider (IdP). This field is obfuscated.

     • Scope: (Optional) Enter the OAuth2 scope.

     • AI Guardrails Certificate: Upload the certificate you want to use to securely connect to the AI Guardrails GPU-based VM.

   • Store Matched Content in Netskope: Enable to store the matched prompt/response content in Netskope to show in Skope IT Alerts and Incidents.

     

     Field	Remote Mode (OAuth 2.0)	No-Token Mode
     jwt_url	OAuth token endpoint URL	Not present
     client_id	OAuth client ID	Not present
     client_secret	OAuth client secret	Not present
     scope	OAuth scopes (optional)	Not present

6. Click Save.

7. To attach the service template to the VPE Node, on the Next-Gen page, click Appliance Setup in the Services column for the VPE Node.

   For SWG, this process can take up to 30 minutes to complete. As part of this process, the service image and its dependent images are automatically downloaded and deployed.

   

8. From the VPE Service Template dropdown list, select the service template.

   

9. Click Save. The name of the service template appears in the VPE Service Template column for the VPE Node.

   

Generating the Dataplane Certificate

After you successfully attach the platform and service templates to the VPE-Node, you must generate a certificate (or key) for the dataplane.

To generate the certificate in the VPE CLI, use the following command:

request certificate generate forward-proxy self-signed common-name <mycert> email-address <admin-email>

Managing Auto-Upgrades

For the Beta release of VPE, you can configure auto-upgrades at the VPE Node level, like manage platform and service auto-upgrades with the VPE CLI. The urldb packages and threatfeed packages automatically upgrade by default. Note that software upgrades will result in service downtime and must be completed during a maintenance window. To minimize downtime, Netskope recommends using clustered VPE-Node deployments.

To configure the auto-upgrade frequency, use the command set auto-upgrade software enable true, followed by the command set auto-upgrade software period <frequency> at <time>. For example, to set a daily software upgrade at 2:00, use the following command: set auto-upgrade software period daily at 2:00.