Cloud Explicit Proxy for Chromebooks

This guide illustrates using explicit proxy to steer SWG / CASB traffic from managed Chromebooks using the Netskope Chrome extension.

When steering private app traffic, the Chrome extension can work alongside the Netskope Cloud Director for Android that is used for Netskope Private Access (NPA) steering on Chromebooks. Ensure that you add private domains to the bypass_list or the PAC file so they are not steered to the explicit proxy.

Prerequisites

To steer SWG/CASB traffic in Chromebooks, configure your tenant with SAML forward proxy authentication.

You can push the Netskope Chrome extension through Google Workspace Admin console and pre-provision the necessary configuration.

Install the TLS CA certificates to allow TLS decryption of traffic from managed Chromebooks. Before you proceed, download the certificates from the Netskope tenant admin console.

1. Login to Netskope tenant as administrator.

2. Go to Settings > Manage > Certificates > Signing CA.

3. Download the following certificates:

   • Root CA (Remote Users)

   • Root CA

   • Intermediate CA

1. Login to Google Workspace Admin console.

2. Go to Devices > Networks > Certificates.

3. Click Add Certificate to add the certificates you downloaded from your Netskope account.

1. In the Google Workspace Admin console, go to Devices > Chrome > Settings > Users & browsers.

2. Click the Users & browser settings tab.

   

3. Select the organizational units that should use the extension, and ensure Proxy mode is set to Allow user to configure (this is the default setting):

   

1. In Google Workspace Admin console, go to Devices > Chrome > Apps & extensions.

2. Click the Users & browsers tab.

   

3. Select the organizational units that must be provisioned with the extension.

4. On the bottom right of the screen, click the + icon to add an extension from Chrome Web Store.

   

5. In the pop-up window, search Netskope in the Chrome store to get the Netskope Chrome Extension.

   

6. Set the Installation Policy to Force Install + pin to browser toolbar option.

   

7. Click the Netskope Chrome Extension to specify JSON objects as Policy for extensions.

   Policy for extensions
   {
     "tenant": {
       "Value": "mytenant.goskope.com"
     },
     "block_disable": {
       "Value": false
     },
     "user_notification_enabled": {
       "Value": false
     },
     "enforce_os": {
       "Value": [
         "cros"
       ]
     },
     "bypass_list": {
       "Value": [
        "www.google.com"
       ]
     }
   }

   The following keys are available in managed policies:

   • tenant (string): Defines the tenant name and removes the user’s ability to change it. You must include .goskope.com suffix. This setting is mandatory for managed operation.

   • block_disable (boolean): If you set this to true, it removes Steering disabled checkbox.

   • enforce_os (array of strings): If you set this to non-empty array, the extension only works on matching operating systems. Valid entries are cros, win, mac, android, linux, openbsd. This is useful if the extension and managed settings are pushed through a managed chrome profile to multiple operating systems, but the administrator wants the extension only on a subset of them.

     Google Chrome on Android does not support extensions, so this parameter is valid only for third-party Chromium based browsers.

   • bypass_list (array of strings): A list of bypasses for the proxy. See chrome.proxy | API | Chrome for Developers for options and syntax. This setting applies only when pac_url and pac_data aren’t set.

   • pac_data (string): The contents of the PAC file you want to apply. If you set this, the contents of this string is used instead of eproxy-<tenant name>:8081. Also, enabling this setting disables bypass_list.

     If both pac_data and bypass_list are provided, only the pac_data is used.

   • pac_url (string): A URL for PAC file to be applied. If you set this, it takes precedence over static configuration based on tenant name or pac_data. This setting disables bypass_list.

   • user_notification_enabled (boolean): A policy to turn user notifications on or off. If the value is set to true, user notifications pop up when user activity is blocked/coached. If set to false, user activity is allowed without a user notification message. The default value is false if you don’t see the policy displayed in the admin console.

8. After providing the policy for the extension, click Save on the top right corner to save the settings.

To verify if policy is correctly propagated, on a managed Chromebook go to chrome://policy. At the bottom of the page you can see a formatted table for Netskope Chrome Extension policies.

To ensure that users are not able to bypass the steering to Netskope, we recommend that you configure the following settings in Google Workspace Admin console:

1. Go to Devices > Chrome > Settings > Users & browsers.

2. Click Disallow incognito mode.

   

3. Go to Devices > Chrome > Apps & extensions > Users & browsers.

4. For Allow/block mode, click Edit in legacy view.

   

5. In Additional Settings, block unauthorized extensions with Set proxy or VPN provider permissions and disable any user-installed extensions (such as, Ad Blockers and NoScript) to mess with goskope.com domains by adding *://*.goskope.com to the Runtime blocked hosts list.

   

6. Block all apps not in the allow list for Play Store and Chrome Web Store.

   

7. Go to Devices > Chrome > Settings > Users & Browsers, and prevent users from managing certificates so they won’t tamper with the Netskope CA pushed by Google Workspace Admin.