Deploy DSPM Sidecars via OVA/OVF on VMware vSphere

Overview

This guide provides instructions for deploying the Netskope DSPM Sidecar as a pre-packaged virtual appliance using an OVA/OVF template on a VMware vSphere environment. This method provides a streamlined, minimal-touch deployment for on-premises data stores.

Prerequisites

Ensure you have the following components and configurations ready:

• vSphere Environment: VMware vSphere version 6.7 or newer.

• OVA File: Download the latest DSPM Sidecar .ova file provided by Netskope by clicking here.

• Netskope DSPM Tenant: Your DSPM Tenant URL (e.g., mytenant.goskope.com).

• Sidecar Pool Token: Generated from the Netskope DSPM console. To create one, go to Administration > Sidecar > Add sidecar pool.

• Network Access: The virtual appliance requires outbound internet access to connect to the Netskope DSPM platform.

• SSH Client: An SSH client (like PuTTY or the terminal) to connect to the appliance for initial configuration.

• Virtual Appliance Hardware Requirements: A 1:4 CPU-to-Memory ratio is recommended for optimal performance.

  Specification	Recommended Requirements	Minimum Requirements
  CPU	8 vCPUs	6 vCPUs
  Memory	32 GB RAM	24 GB RAM
  Storage	100 GB available disk space	100 GB available disk space

  DLP Appliance Connectivity: Sidecars require connectivity to a local DLP appliance to perform classification activities using your DLP Profiles and Rules. Before deploying the sidecar, ensure the following:

  • A DLP appliance has been deployed and is accessible within the same network where the sidecar will be installed (or in directly connected networks, to avoid additional peering or complex routing).
  • The sidecar and DLP appliance must be able to communicate via HTTPS (port 443).
  • You have generated or obtained the required REST API v1 Key and License Key.

Architecture

Netskope DSPM uses a flexible architecture where you deploy one or more sidecars alongside your main application. These sidecars connect directly to your data stores to collect samples, which a local DLP appliance then scans. Afterward, the sidecars upload the classification results back to the Netskope DSPM application.

A single sidecar can efficiently scan multiple data stores within its installed environment. Although you typically deploy one sidecar per isolated network (such as a VPC or VNet), you can install multiple sidecars to achieve higher scalability and redundancy. In these highly available setups, the Netskope DSPM application automatically load-balances scan operations across all healthy sidecars within a given pool.

The following diagram illustrates the relationship between Netskope DSPM resources and your environment:

Configure Outbound Egress

Since Netskope hosts and manages the Netskope DSPM application, you must update your firewall or security group settings to allow outbound egress. Configure your allowlist on port 443 using the following group.

• Required for Core Connectivity: Add these addresses to ensure the sidecar can communicate with the DSPM platform. Substitute [TENANT] with your actual tenant name:

  Address
  [TENANT].goskope.com
  sidecar-[tenant].goskope.com
  netskope-dspm-release.s3.us-west-2.amazonaws.com
  995750983908.dkr.ecr.us-west-2.amazonaws.com

• Required for Installation Packages (Temporary) Add these addresses to download the necessary packages during the installation process.

  These domains are required only for the initial setup. You may remove them from your allowlist once the sidecar is fully deployed.

  Address
  api.snapcraft.io
  dashboard.snapcraft.io
  .snapcraftcontent.com

Configure Sidecar Pool

To set up the relationship between your sidecars and Netskope DSPM-hosted tenant, you will provide the sidecars with unique authentication tokens generated within our Sidecar Administration UI.

1. Log in to the Netskope DSPM application.

2. Go to the Administration > Sidecar menu.

3. Click Add Sidecar Pool.

4. On the Details tab, complete the following field:

   Field	Value
   Name	Any friendly value to describe the sidecar pool.

5. Click Save.

6. Click Copy at the bottom of the Sidecar Authentication Token modal to save the generated token to your clipboard.

   

7. Click the X button to exit the modal.

Since you haven’t yet associated this token with a sidecar, the sidecar pool will appear only when you click the Show Inactive Sidecars icon in the upper right, with empty Version, Status, and DLP Status columns for now.

Deploy and Configure the Sidecar Appliance

The deployment process involves deploying the OVA template in vSphere, running an initial configuration script, and then launching an automated bootstrap script to complete the installation.

Step 1: Deploy the OVA Template in vSphere

1. Log in to the VMware vSphere Client.

2. Right-click an inventory object (such as a cluster, host, or VM folder) and select Deploy OVF Template.

3. On the Select an OVF template screen:

   Choose Local file > Click Upload Files > Select the .ova file you downloaded from the Prerequisites section > Click Next.

   

   During this step, you may see a “Source Verification” warning stating that the “SSL certificate cannot be trusted”. This is expected. Click YES to proceed.

   

4. Provide a unique and descriptive name for the Virtual Machine (e.g., netskope-dspm-sidecar) > Select a datacenter or folder location > Click Next.

   

5. Select a target host or cluster where the Virtual Machine (VM) will run > Click Next.

6. Select a datastore with at least 50 GB of available space > Click Next.

7. Select the appropriate network segment (VM Network) from the dropdown list. Ensure this network has internet access > Click Next.

8. On the final Ready to complete screen, review your settings > Click Finish.

Step 2: Customize Deployment Properties

During the deployment process, vSphere will prompt you to customize the properties for the appliance.

On the Customize template screen, enter the following required parameters:

• Tenant Host Configuration: Your tenant URL, without the https:// prefix (e.g., mytenant.goskope.com).
• Authentication Configuration: The token you generated from the DSPM tenant.
• Sidecar Configuration: A custom name for this specific sidecar instance (e.g., netskope-dspm-sidecar-latest).
• HTTPS Proxy Configuration (Optional): if your organization routes outbound traffic through an SSL proxy, populate with a HTTPS address to force sidecar traffic thru your designated proxy.
  • Note: If you need to configure an SSL proxy after the virtual machine is already running, see Manage DSPM Virtual Appliance Sidecars (OVA) for post-deployment instructions.

Step 3: Power On and Connect to the Appliance

1. After the OVA deployment task is complete, locate the new Virtual Machine (VM) in your vSphere inventory > Click the Play button to power it on.

   

2. Once the VM has booted, obtain its IP address from the VM Summary screen in vSphere.

   

3. Use an SSH client to connect to the appliance’s IP address:
   ssh netskope@<VM_IP_ADDRESS>

4. Log in with the default credentials:

   • Login: netskope
   • Password: netskope

   

   A successful login confirms that the base system is operational, network connectivity is established, and SSH access is working correctly.

   For security purposes, it is highly recommended to change the default password immediately after your first login. Run the passwd command and follow the prompts.

5. Execute the setup script with sudo privileges:
   sudo /opt/netskope/setup-sidecar.sh

   • The script will first validate that the VM meets the minimum CPU and memory requirements.

   

6. Follow the on-screen prompts to confirm your configuration parameters (Sidecar Configuration, Tenant Host Configuration, Authentication Configuration). The values you entered during the OVA deployment will be shown as defaults.

   

   When prompted Are you sure to use these variables for Sidecar deployment? (Y/N):, type y and press Enter to save the configuration.

   • The configuration will be stored in the /opt/netskope/sidecar-config.env file.

   

Step 4: Run the Automated Bootstrap Script

After saving the configuration, execute the bootstrap script:
sudo /opt/netskope/bootstrap.sh

This script automates the installation of all necessary components. The process can take 10–15 minutes. Upon completion, you will see a confirmation message: Appliance is fully configured and ready!.

You will see a significant amount of text output in the console as the script downloads and installs software. This is normal and expected behavior.

Deployment Verification

Run the following commands for a local Verification (via SSH), to ensure all components are active:

Validate Sidecar Connection

When deploying sidecar, you’ll need to ensure that the sidecar has the ability to reach your tenant. Take the following steps to verify the connectivity from the sidecar.

1. Log in to the Netskope DSPM application.
2. Go to Administration > Sidecar.
3. For the sidecar(s) in question, validate that:
   • The Version column is populated.
   • The Status indicator is green. 
   • The DLP Status column shows a healthy connection to your DLP appliance.

It may take a few minutes for newly-running sidecars to communicate with the Netskope DSPM application.

Next Steps

Once your sidecar is fully deployed and linked to your DLP appliance, it will automatically process data store scans. To link your sidecar to a DLP appliance and enable data classification, see Link a DLP Appliance to a Sidecar Pool, and for ongoing maintenance tasks—such as upgrading the sidecar version, rotating security tokens, or configuring a proxy post-deployment—see Manage DSPM Virtual Appliance Sidecars (OVA).