Deploy the DLP Appliance for DSPM - Netskope Technical Documentation

Overview

A DLP appliance is required to perform data classification when using sidecars. This guide walks you through the DSPM-specific steps to prepare, download, and configure the DLP appliance for use with your DSPM environment.

If you want to deploy a Single Appliance that bundles both the sidecar and DLP services into one virtual machine, follow the dedicated deployment instructions instead.

To learn more: Deploy the DSPM Single Appliance.

Prerequisites

Before deploying the DLP appliance, ensure you meet the following requirements.

Network Planning: The DLP appliance must reside within the same network as the sidecars it serves, or in directly connected networks. Both components must be accessible to one another via HTTPS (port 443).

Appliance Sizing: Unless recommended otherwise, deploy a Medium-sized appliance. The Small size is intended only for proof-of-concept testing.

	AWS	GCP	Azure	VM (ESXi/Hyper-V/KVM)	Concurrent Requests	Min Disk
Small	c5ad.4xlarge	n2-standard-16	Standard-F16s_v2	16 cores / 32 GB	480 rps (burst 576)	351 GB
Medium	c5ad.8xlarge	n2-standard-32	Standard-F32s_v2	32 cores / 64 GB	1280 rps (burst 1536)	351 GB
Large	c5ad.16xlarge	n2-standard-64	Standard-F64fs_v2	64 cores / 128 GB	2880 rps (burst 3456)	351 GB

In AWS regions where c5ad is unavailable, use c5a. To ensure optimal performance, use SSDs for all instances. ESXi does not support dynamic resizing after creation.

If you deploy an incorrectly-sized appliance, the DLP Appliance doesn’t support scaling resources up or down. You must redeploy the appliance at the correct size.

Networking Considerations:
- Ensure that Netskope IPs and Amazon S3 (e.g., *.s3-us-west-1.amazonaws.com) are allowlisted. If tenant.goskope.com is your tenant hostname, also allow IPs for config-tenant.goskope.com and callhome-tenant.goskope.com.
- You must also allowlist the following gateway domains:
```
dlpappliancegw.sv5.goskope.com
dlpappliancegw.bom3.goskope.com
dlpappliancegw.am2.goskope.com
dlpappliancegw.sjc1.goskope.com
dlpappliancegw.fr4.goskope.com
dlpappliancegw.ruh1.goskope.com
dlpappliancegw.mel2.goskope.com
dlpappliancegw.sjc2.goskope.com
dlpappliancegw.zur2.goskope.com
dlpappliancegw.lon3.goskope.com
dlpappliancegw.sin2.goskope.com
dlpappliancegw.dfw3.goskope.com
dlpappliancegw.fra2.goskope.com
```
  – If you use DRM with DLP, you must also allowlist Microsoft AIP endpoints.
  – All integrating services must be able to reach the appliance over HTTPS (TCP 443).
  – SSL interception of traffic from the DLP appliance isn’t recommended. If a proxy is in place, ensure you import the respective certificates.
  – Deploying multiple DLP appliances behind a network load balancer isn’t supported for asynchronous request scenarios.
  
  For the complete list of egress and port requirements, see Firewall Settings for DSPM-Hosted Instances.

Deployment Process

The following steps outline the end-to-end process to generate the necessary authentication keys, download the appliance image, and link it to your DSPM sidecar environment.

Step 1: Generate the REST API v1 Key

This key allows the appliance to call home and fetch the latest DLP configurations. It doesn’t need to be shared; it just needs to be present within your Netskope console.

Log in to the Netskope console.
Navigate to Settings > Tools > Rest API v1.
Determine your token status:
- If a token already exists: Ensure that it is set to never expire.
- If no token exists: Click Generate New Token and set the expiration to “never expire.”

Step 2: Retrieve the License Key

The appliance setup uses the License Key to validate your DLP entitlement. The Netskope console generates it automatically.

Log in to the Netskope console.
Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
Copy the License Key value displayed on this screen.

Step 3: Download the DLP Appliance Image

The download method depends on your target deployment platform.

For AWS:

Log in to the Netskope console.
Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
Click Setup DLP On-Demand.
In the modal, within the AWS section, click the Assign link.
Enter the AWS Account ID and Region where you will install the appliance.
Click Submit.

The AMI should be available within the “Shared with me” section of your AMI Catalog within a few minutes. If your target region is not available in the dropdown, open a support ticket.

For Azure, ESXi, Hyper-V, or KVM:

Log in to the Netskope console.
Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
Click Setup DLP On-Demand.
In the modal, within the section for your desired platform, click the Download link.
In the dialog, the SHA-1 hash will display. Click Copy to save its value for verification, then click Download.

For GCP:

Log in to the Netskope console.
Navigate to Settings > Security Cloud Platform > On-Premises Infrastructure.
Click Setup DLP On-Demand.
In the modal, within the GCP section, click the Assign link.
Select the Identity Type: either User or ServiceAccount.
Enter the Account Email Address associated with the selected identity type.
Click Submit.

Step 4: Deploy the DLP Appliance

Follow the installation instructions for your chosen platform (AWS, Azure, ESXi, GCP, Hyper-V, or KVM).

AWS

Launch an EC2 instance using the DLP On Demand AMI (found in Private Images).
Set the Instance Type per the sizing table in Prerequisites.
Define your desired Storage and use gp3.
No SSH key-pair is required. Set up networking and firewall security groups as appropriate. The appliance should not be publicly accessible.
Select proceed with no key-pair and launch the instance. The instance will be ready after approximately 30 minutes.

Azure

During deployment, Azure may display an “OS Provisioning Timed Out” notification. This is expected and can be safely ignored. Confirm readiness by verifying the instance state shows “Running.”

Download the VHD from the presigned URL.
Extract the VHD: tar -xvf {downloaded_vhd_tar_file} -C {path}
Create a Storage Account under your Resource Group.
Create a Container under the Storage Account.
On the Storage Account page, go to Security + Networking > Shared access signature.
Enable all permissions, set Start Time 24h before now and End Time 24h after now.
Click Generate SAS and connection string and copy the SAS token.
Install AzCopy if not already installed.
- Note: Use AzCopy to upload. Uploading large files via the Azure Portal is unreliable and may result in file corruption.

Upload the VHD:

azcopy copy "{local_path}.vhd" "https://{account_name}.blob.core.windows.net/{container_name}/{vhd_name}.vhd?{SAS_TOKEN}" --blob-type PageBlob

Navigate to Images in Azure.
Choose your subscription. Set OS Type: Linux, select your VHD from storage, Account Type: Premium SSD, Encryption: Platform managed.
Click Review + create.
Create an instance from the image. Select a minimum of 351 GB Premium SSD disk.
Configure networking and create the VM.

vSphere (ESXi)

Download the .ova image to your local system before uploading to vSphere (vSphere does not support direct URL imports when the URL exceeds its maximum supported length).

Sizing requirements:

16 CPU / 32 GB Memory
32 CPU / 64 GB Memory
64 CPU / 128 GB Memory

To deploy the DLP Appliance:

Right-click a host, cluster, or datacenter and select Deploy OVF Template.
Select Local file > Upload files, choose your .ova file, click Next.
Enter a VM name, select deployment location, click Next.
Select compute resource, click Next.
Review details and accept license agreements, click Next.
Select datastore and virtual disk format (e.g., Thin Provision), click Next.
Map source networks to destination network ports, click Next.
Customize template settings if applicable, click Next.
Review summary, optionally check Power on after deployment, click Finish. The instance will be ready after approximately 30 minutes.

GCP

Go to Compute Engine > VM Instances and click Create Instance.
In Machine Configuration, provide a name and select N2 under General Purpose.
In Machine Type, select per the sizing table in Prerequisites.
In OS and Storage, click Change, select the DLP On Demand appliance image, and set size to 300 GB minimum.
Set up networking and firewall security groups as appropriate, then click Create. The instance will be ready after approximately 30 minutes.

Hyper-V

Download the appliance image from the Setup DLP on Demand window.
Open Hyper-V Manager.
In the Actions pane, click Import Virtual Machine.
Click Next, then Browse to the top-level folder of the exported VM files. Click Select Folder > Next.
Select the VM from the list, click Next.
Choose Register the virtual machine in-place (use the existing unique ID).
Review and click Finish.
Before starting the instance, right-click the VM > Settings > Network Adapter and select the appropriate network switch.
Start the VM from the Actions pane or by right-clicking > Start.

KVM

Download the appliance image from the Setup DLP on Demand window.

Create a template directory and extract:

mkdir dlp-vm-template tar -xvf dlp-appliance.tar

Extract the QCOW2 disk image:

tar -xzvf netskope-dlp-on-demand-kvm-qcow2-*.qcow2.tar.gz -C /home/ubuntu/dlp-vm-template/

Deploy using virt-install:

sudo virt-install --name dlp-appliance --ram 65536 --vcpus 32 \ --os-variant ubuntu24.04 \ --disk path=/home/ubuntu/dlp-vm-template/<image_file>.qcow2,size=452 \ --import --network default --check path_in_use=off

When virt-install connects the console, press CTRL+C to exit. The boot process continues in the background.
Verify VM status: sudo virsh list --all
Check network: sudo virsh net-list
Find IP address: sudo virsh net-dhcp-leases default
Connect via SSH: sudo ssh {username}@{IP}

Step 5: Connect and Tether the Appliance

Once the instance is created, you must connect it to Netskope so it can download the required configuration and profiles.

SSH into the instance as nsadmin with the default password nsappliance:
```
ssh nsadmin@<instance_ip>
```
Change the default password immediately:
```
nsappliance> auth change-password
```

Configure DNS (if DNS is not provided via DHCP):

nsappliance> configure
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

If you need to configure the network interface manually instead of using DHCP:

nsappliance> configure
nsappliance(config)> set interface v4 dhcp enable false
nsappliance(config)> set interface v4 static enable true
nsappliance(config)> set interface v4 static ip x.x.x.x
nsappliance(config)> set interface v4 static gw x.x.x.x
nsappliance(config)> set interface v4 static netmask x.x.x.x
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

To revert to automatic DHCP configuration:

nsappliance> configure
nsappliance(config)> set interface v4 dhcp enable true
nsappliance(config)> set dns primary x.x.x.x
nsappliance(config)> set dns secondary x.x.x.x
nsappliance(config)> save
nsappliance(config)> exit

Ensure that DNS resolution works on the appliance before proceeding.

Apply the License Key (retrieved in Step 2):

nsappliance> configure
nsappliance(config)# set system licensekey <license-key>
nsappliance(config)# save
nsappliance(config)# exit

Verify tethering status. The value callhome_reachable must be true, and tenant-url and serial should be populated:
```
nsappliance> status tethering
```

After successful tethering, the appliance needs approximately 30 minutes to initialize before it is ready to process requests. You will also see the appliance reflected on the On-Premises Infrastructure page in the Netskope console.

Step 6: Configure a Proxy (Optional)

If your organization routes outbound traffic through a proxy, configure it using the appliance CLI.

Explicit proxy

Implicit proxy (SSL-intercepting proxy with custom CA)

Configure the proxy details:

nsappliance> configure
nsappliance(config)# set management-plane upstream-proxy-server hostname 10.10.10.10
nsappliance(config)# set management-plane upstream-proxy-server port 8000
nsappliance(config)# set management-plane upstream-proxy-server username <USERNAME>
nsappliance(config)# set management-plane upstream-proxy-server password <PASSWORD>
nsappliance(config)# set management-plane upstream-proxy-server trusted-ca

Copy and paste your single PEM-formatted server CA certificate (no keys).
Press Ctrl-D when done.

Save and restart:

nsappliance(config)# save
nsappliance(config)# exit
nsappliance> restart dlpaas all

Configure the trusted CA:

nsappliance> configure
nsappliance(config)# set management-plane upstream-proxy-server trusted-ca

Copy and paste your single PEM-formatted server CA certificate (no keys).
```
<PASTE PEM Formatted CA CHAIN>
```
Press Ctrl-D when done.
```
<Press Ctrl-D>
```

Save and restart:

nsappliance(config)# save
nsappliance(config)# exit
nsappliance> restart dlpaas all

Step 7: Link the Appliance to Your Sidecar Pool

After the appliance is deployed and running, you must link it to your DSPM sidecar pool so that sidecars can send data samples for classification.

For detailed instructions, see the “Link a DLP Appliance to a Sidecar Pool” section in DSPM Sidecar Administration Overview.

If you encounter issues during or after deployment, see Troubleshooting DSPM with DLP.