Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Data Security Posture Management (DSPM)
    Deploying DSPM Scanners (Sidecars)
    Advanced Deployment (Distributed Scanners)
    Deploy the DLP Appliance for DSPM

    Deploy the DLP Appliance for DSPM

    Overview

    A DLP appliance is required to perform data classification when using sidecars. This guide walks you through the DSPM-specific steps to prepare, download, and configure the DLP appliance for use with your DSPM environment.

    If you want to deploy a Single Appliance that bundles both the sidecar and DLP services into one virtual machine, follow the dedicated deployment instructions instead.

    To learn more: Deploy the DSPM Single Appliance.

    Prerequisites

    Before deploying the DLP appliance, ensure you meet the following requirements.

    • Network Planning: The DLP appliance must reside within the same network as the sidecars it serves, or in directly connected networks. Both components must be accessible to one another via HTTPS (port 443).

    • Appliance Sizing: Unless recommended otherwise, deploy a Medium-sized appliance. The Small size is intended only for proof-of-concept testing.

       AWSGCPAzureVM (ESXi/Hyper-V/KVM)Concurrent RequestsMin Disk
      Smallc5ad.4xlargen2-standard-16Standard-F16s_v216 cores / 32 GB480 rps (burst 576)351 GB
      Mediumc5ad.8xlargen2-standard-32Standard-F32s_v232 cores / 64 GB1280 rps (burst 1536)351 GB
      Largec5ad.16xlargen2-standard-64Standard-F64fs_v264 cores / 128 GB2880 rps (burst 3456)351 GB

      In AWS regions where c5ad is unavailable, use c5a. To ensure optimal performance, use SSDs for all instances. ESXi does not support dynamic resizing after creation.

      If you deploy an incorrectly-sized appliance, the DLP Appliance doesn’t support scaling resources up or down. You must redeploy the appliance at the correct size.

    • Networking Considerations:

      • Ensure that Netskope IPs and Amazon S3 (e.g., *.s3-us-west-1.amazonaws.com) are allowlisted. If tenant.goskope.com is your tenant hostname, also allow IPs for config-tenant.goskope.com and callhome-tenant.goskope.com.

      • You must also allowlist the following gateway domains:

        dlpappliancegw.sv5.goskope.com
dlpappliancegw.bom3.goskope.com
dlpappliancegw.am2.goskope.com
dlpappliancegw.sjc1.goskope.com
dlpappliancegw.fr4.goskope.com
dlpappliancegw.ruh1.goskope.com
dlpappliancegw.mel2.goskope.com
dlpappliancegw.sjc2.goskope.com
dlpappliancegw.zur2.goskope.com
dlpappliancegw.lon3.goskope.com
dlpappliancegw.sin2.goskope.com
dlpappliancegw.dfw3.goskope.com
dlpappliancegw.fra2.goskope.com
        – If you use DRM with DLP, you must also allowlist Microsoft AIP endpoints.
        – All integrating services must be able to reach the appliance over HTTPS (TCP 443).
        – SSL interception of traffic from the DLP appliance isn’t recommended. If a proxy is in place, ensure you import the respective certificates.
        – Deploying multiple DLP appliances behind a network load balancer isn’t supported for asynchronous request scenarios.

        For the complete list of egress and port requirements, see Firewall Settings for DSPM-Hosted Instances.

    Deployment Process

    The following steps outline the end-to-end process to generate the necessary authentication keys, download the appliance image, and link it to your DSPM sidecar environment.

    Step 1: Generate the REST API v1 Key

    This key allows the appliance to call home and fetch the latest DLP configurations. It doesn’t need to be shared; it just needs to be present within your Netskope console.

    1. Log in to the Netskope console.
    2. Navigate to Settings > Tools > Rest API v1.
    3. Determine your token status:
      • If a token already exists: Ensure that it is set to never expire.
      • If no token exists: Click Generate New Token and set the expiration to “never expire.”

    Step 2: Retrieve the License Key

    The appliance setup uses the License Key to validate your DLP entitlement. The Netskope console generates it automatically.

    1. Log in to the Netskope console.
    2. Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
    3. Copy the License Key value displayed on this screen.

    Step 3: Download the DLP Appliance Image

    The download method depends on your target deployment platform.

    For AWS:

    1. Log in to the Netskope console.
    2. Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
    3. Click Setup DLP On-Demand.
    4. In the modal, within the AWS section, click the Assign link.
    5. Enter the AWS Account ID and Region where you will install the appliance.
    6. Click Submit.
    The AMI should be available within the “Shared with me” section of your AMI Catalog within a few minutes. If your target region is not available in the dropdown, open a support ticket.

    For Azure, ESXi, Hyper-V, or KVM:

    1. Log in to the Netskope console.
    2. Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
    3. Click Setup DLP On-Demand.
    4. In the modal, within the section for your desired platform, click the Download link.
    5. In the dialog, the SHA-1 hash will display. Click Copy to save its value for verification, then click Download.

    For GCP:

    1. Log in to the Netskope console.
    2. Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
    3. Click Setup DLP On-Demand.
    4. In the modal, within the GCP section, click the Assign link.
    5. Select the Identity Type: either User or ServiceAccount.
    6. Enter the Account Email Address associated with the selected identity type.
    7. Click Submit.

    Step 4: Deploy the DLP Appliance

    Follow the installation instructions for your chosen platform (AWS, Azure, ESXi, GCP, Hyper-V, or KVM).

    AWS

    1. Launch an EC2 instance using the DLP On Demand AMI (found in Private Images).
    2. Set the Instance Type per the sizing table in Prerequisites.
    3. Define your desired Storage and use gp3.
    4. No SSH key-pair is required. Set up networking and firewall security groups as appropriate. The appliance should not be publicly accessible.
    5. Select proceed with no key-pair and launch the instance. The instance will be ready after approximately 30 minutes.

    Azure

    During deployment, Azure may display an “OS Provisioning Timed Out” notification. This is expected and can be safely ignored. Confirm readiness by verifying the instance state shows “Running.”

    1. Download the VHD from the presigned URL.

    2. Extract the VHD: tar -xvf {downloaded_vhd_tar_file} -C {path}

    3. Create a Storage Account under your Resource Group.

    4. Create a Container under the Storage Account.

    5. On the Storage Account page, go to Security + Networking > Shared access signature.

    6. Enable all permissions, set Start Time 24h before now and End Time 24h after now.

    7. Click Generate SAS and connection string and copy the SAS token.

    8. Install AzCopy if not already installed.

      • Note: Use AzCopy to upload. Uploading large files via the Azure Portal is unreliable and may result in file corruption.

    9. Upload the VHD:

      azcopy copy "{local_path}.vhd" "https://{account_name}.blob.core.windows.net/{container_name}/{vhd_name}.vhd?{SAS_TOKEN}" --blob-type PageBlob

    10. Navigate to Images in Azure.

    11. Choose your subscription. Set OS Type: Linux, select your VHD from storage, Account Type: Premium SSD, Encryption: Platform managed.

    12. Click Review + create.

    13. Create an instance from the image. Select a minimum of 351 GB Premium SSD disk.

    14. Configure networking and create the VM.

    vSphere (ESXi)

    Download the .ova image to your local system before uploading to vSphere (vSphere does not support direct URL imports when the URL exceeds its maximum supported length).

    Sizing requirements:

    • 16 CPU / 32 GB Memory
    • 32 CPU / 64 GB Memory
    • 64 CPU / 128 GB Memory

    To deploy the DLP Appliance:

    1. Right-click a host, cluster, or datacenter and select Deploy OVF Template.
    2. Select Local file > Upload files, choose your .ova file, click Next.
    3. Enter a VM name, select deployment location, click Next.
    4. Select compute resource, click Next.
    5. Review details and accept license agreements, click Next.
    6. Select datastore and virtual disk format (e.g., Thin Provision), click Next.
    7. Map source networks to destination network ports, click Next.
    8. Customize template settings if applicable, click Next.
    9. Review summary, optionally check Power on after deployment, click Finish. The instance will be ready after approximately 30 minutes.

    GCP

    1. Go to Compute Engine > VM Instances and click Create Instance.
    2. In Machine Configuration, provide a name and select N2 under General Purpose.
    3. In Machine Type, select per the sizing table in Prerequisites.
    4. In OS and Storage, click Change, select the DLP On Demand appliance image, and set size to 300 GB minimum.
    5. Set up networking and firewall security groups as appropriate, then click Create. The instance will be ready after approximately 30 minutes.

    Hyper-V

    1. Download the appliance image from the Setup DLP on Demand window.
    2. Open Hyper-V Manager.
    3. In the Actions pane, click Import Virtual Machine.
    4. Click Next, then Browse to the top-level folder of the exported VM files. Click Select Folder > Next.
    5. Select the VM from the list, click Next.
    6. Choose Register the virtual machine in-place (use the existing unique ID).
    7. Review and click Finish.
    8. Before starting the instance, right-click the VM > Settings > Network Adapter and select the appropriate network switch.
    9. Start the VM from the Actions pane or by right-clicking > Start.

    KVM

    1. Download the appliance image from the Setup DLP on Demand window.

    2. Create a template directory and extract:

      mkdir dlp-vm-template tar -xvf dlp-appliance.tar

    3. Extract the QCOW2 disk image:

      tar -xzvf netskope-dlp-on-demand-kvm-qcow2-*.qcow2.tar.gz -C /home/ubuntu/dlp-vm-template/

    4. Deploy using virt-install:

      sudo virt-install --name dlp-appliance --ram 65536 --vcpus 32 \ --os-variant ubuntu24.04 \ --disk path=/home/ubuntu/dlp-vm-template/<image_file>.qcow2,size=452 \ --import --network default --check path_in_use=off

    5. When virt-install connects the console, press CTRL+C to exit. The boot process continues in the background.

    6. Verify VM status: sudo virsh list --all

    7. Check network: sudo virsh net-list

    8. Find IP address: sudo virsh net-dhcp-leases default

    9. Connect via SSH: sudo ssh {username}@{IP}

    Step 5: Connect and Tether the Appliance

    Once the instance is created, you must connect it to Netskope so it can download the required configuration and profiles.

    1. SSH into the instance as nsadmin with the default password nsappliance:

      ssh nsadmin@<instance_ip>

    2. Change the default password immediately:

      nsappliance> auth change-password

    3. Configure DNS (if DNS is not provided via DHCP):

      nsappliance> configure
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

      • If you need to configure the network interface manually instead of using DHCP:

        nsappliance> configure
nsappliance(config)> set interface v4 dhcp enable false
nsappliance(config)> set interface v4 static enable true
nsappliance(config)> set interface v4 static ip x.x.x.x
nsappliance(config)> set interface v4 static gw x.x.x.x
nsappliance(config)> set interface v4 static netmask x.x.x.x
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

      • To revert to automatic DHCP configuration:

        nsappliance> configure
nsappliance(config)> set interface v4 dhcp enable true
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

      Ensure that DNS resolution works on the appliance before proceeding.

    4. Apply the License Key (retrieved in Step 2):

      nsappliance> configure
nsappliance(config)# set system licensekey <license-key>
nsappliance(config)# save
nsappliance(config)# exit

    5. Verify tethering status. The value callhome_reachable must be true, and tenant-url and serial should be populated:

      nsappliance> status tethering
    After successful tethering, the appliance needs approximately 30 minutes to initialize before it is ready to process requests. You will also see the appliance reflected on the On-Premises Infrastructure page in the Netskope console.

    Step 6: Configure a Proxy (Optional)

    If your organization routes outbound traffic through a proxy, configure it using the appliance CLI.

    Explicit proxy
    Implicit proxy (SSL-intercepting proxy with custom CA)

    1. Configure the proxy details:

      nsappliance> configure
nsappliance(config)# set management-plane upstream-proxy-server hostname 10.10.10.10
nsappliance(config)# set management-plane upstream-proxy-server port 8000
nsappliance(config)# set management-plane upstream-proxy-server username <USERNAME>
nsappliance(config)# set management-plane upstream-proxy-server password <PASSWORD>
nsappliance(config)# set management-plane upstream-proxy-server trusted-ca

    2. Copy and paste your single PEM-formatted server CA certificate (no keys).

    3. Press Ctrl-D when done.

    4. Save and restart:

      nsappliance(config)# save
nsappliance(config)# exit
nsappliance> restart dlpaas all

    1. Configure the trusted CA:

      nsappliance> configure
nsappliance(config)# set management-plane upstream-proxy-server trusted-ca

    2. Copy and paste your single PEM-formatted server CA certificate (no keys).

      <PASTE PEM Formatted CA CHAIN>

    3. Press Ctrl-D when done.

      <Press Ctrl-D>

    4. Save and restart:

      nsappliance(config)# save
nsappliance(config)# exit
nsappliance> restart dlpaas all

    Step 7: Link the Appliance to Your Sidecar Pool

    After the appliance is deployed and running, you must link it to your DSPM sidecar pool so that sidecars can send data samples for classification.

    For detailed instructions, see the “Link a DLP Appliance to a Sidecar Pool” section in DSPM Sidecar Administration Overview.

    If you encounter issues during or after deployment, see Troubleshooting DSPM with DLP.
    In this Topic
    • Deploy the DLP Appliance for DSPM