Enabling Cloud TAP in the Netskope UI

Once you have deployed the Cloud TAP stitcher, you can enable Cloud TAP in your Netskope tenant.

Enabling Cloud TAP

To enable Cloud TAP:

1. Go to Settings > Security Cloud Platform > Cloud TAP.
2. On the Cloud TAP page, go to the Traffic Filters section. Click Add Traffic Filters to create filter rules that define the traffic Cloud TAP copies. If you select the I do not want to apply any filter checkbox, then Cloud TAP will copy all traffic.

   Important

   In order to enable Cloud TAP, you must configure at least one traffic filter or select the checkbox. Netskope highly recommends configuring traffic filters for Cloud TAP.

   Thoroughly configuring all relevant traffic filters ensures that desired traffic is copied through Cloud TAP. If the filters are not specific enough, too much data can be copied to your object store (i.e., the cloud storage you configured) and increase the total storage size needed. Depending on the scale, this might also affect overall performance.

   

   You can configure the following filters:

   • Source Subnet: Select the source IP addresses for the endpoints to which the rule applies. Go to Policies > Network Locations to specify these IPs.
   • Destination IP: Specify the destination IP for the endpoints to which the rule applies. Go to Policies > Network Locations to specify these IPs.
   • Protocols and Destination Ports: Specify the TCP connections to which the rule applies. You can add a single port, multiple ports, or a port range. If no TCP ports are specified, then all traffic from all TCP ports is copied to Cloud TAP.
   • Access Method: Select the access method configurations to which the rule applies. You can choose GRE, IPSec, or Client as your access method, including IPSec/GRE sites. When you select IPsec or GRE in the access method filter, only traffic from the specified tunnels is steered to Cloud TAP. If no access method is selected, then traffic on all tunnels and from all users will be copied to the object store.
   • User: This filter is only applicable if the access method is Client. Specify the users to which the rule applies. When a user is specified, only traffic from that user is steered to Cloud TAP.
   • Netskope POP: Select the Netskope NewEdge Data Center or POP to which the rule applies.

   

3. Under Cloud TAP Status, click to Enable the feature.

   

4. For Traffic Storage Setup, provide your cloud provider’s storage account information and the buckets for storing the traffic copied by Cloud TAP:
   • Cloud Provider: Select the cloud provider.

     

   • Default Bucket Configuration: Specify the bucket that applies to traffic from all POPs. Click the Use different buckets for data and key storage to specify separate buckets for the data and key.

     

   • (Optional) Custom Bucket Configurations: Specify region-specific buckets to store traffic copied from specific Netskope POPs:

     

     • Click the switch to enable or disable this feature.
     • Click the Use different buckets for data and key storage to specify separate buckets for the data and key.
     • Enter a Config Name.
     • In the POP field, select the geographically closest Netskope POPs for the bucket. You can select multiple POPs per custom bucket configuration.

5. You must enter the following information for each bucket:
   • For AWS, provide the bucket name and region. For authentication, you can either provide the access key ID and secret access key or use AWS IAM Roles Anywhere.

     Note

     Using AWS IAM Roles Anywhere as an authentication method is currently in Controlled GA. Contact Netskope Support or your sales representative to enable this feature.

     Configuring AWS IAM Roles Anywhere for Authentication

     With AWS IAM Roles Anywhere, you can use a signed certificate for authentication. Supported certificate formats are PEM and CRT. Before you begin, you must set up AWS IAM Roles Anywhere in your AWS account. To learn more, refer to the AWS IAM Roles Anywhere documentation.

     To generate the signed certificate:

     1. Click Manage Certificates for AWS.
     2. Click New Certificate.
     3. In the New Certificate page:
        1. Enter a name for the certificate.
        2. (Optional) Enter a description for the certificate.
        3. Under Certificate ARN, provide the ARN values for the trust anchor, role, and profile from your AWS account.
        4. Under Manage CSR, provide the information for the CSR according to your organization’s requirements.
        5. Click Generate CSR and then Download CSR.
     4. Sign the CSR with your certificate authority.
     5. Upload the signed certificate.
     6. Click Save.

     

     Once you save the certificate, select the Use IAM Roles Anywhere as the auth method to complete the traffic storage setup.

     

   • For GCP, provide the bucket name and upload the account credentials in JSON format. The maximum size allowed is 256 KB.
   • For Azure, provide the storage account name and the access key.

6. Click Save.

Usage Dashboard

You can view the Usage Dashboard by clicking View Dashboard.

The Usage Dashboard shows the amount of data copied from Netskope to storage.