The FIPS 140-3 Mode feature enables the Netskope Client to operate exclusively with cryptographic modules validated under the Federal Information Processing Standard (FIPS) 140-3. When FIPS Mode is active, the Netskope Client enforces the use of FIPS-approved algorithms for all cryptographic operations — including encryption, hashing, digital signatures, and key management — across NS Agent, NS Service, and all TLS-using client modules.
– This is only applicable for Internet Security Service.
Prerequisites
After the Netskope Client downloads the updated configuration from the tenant, the endpoint machine must be rebooted before using FIPS Mode.
Supported Environments
-
Supported OS: Windows (only on 64-bit), macOS
-
Supported minimum Client version: 139.0.0
Netskope Client Installation Using FIPS Mode
You can install the Netskope Client using FIPS mode on Windows and macOS using one of the following methods:
-
Method 1: Install and Configure FIPS in a Single Command
-
Method 2: Install First, Configure FIPS Separately
Windows
Method 1: Install and Configure FIPS in a Single Command
Administrators can enable FIPS Mode at installation time or upgrade by appending the fipsmode parameter directly to the MSI installer command. This writes the FipsMode value to the Windows Registry automatically during installation.
Run the following command using your software deployment tool (such as Microsoft Intune, SCCM, or a command-line script):
-
Strict FIPS Mode (Fips Mode=1)
The Netskope Client uses only FIPS 140-3 validated cryptographic algorithms for all operations. Non-FIPS algorithms are blocked entirely.
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=1 /qn
-
Permissive FIPS Mode (Fips Mode=2)
The Netskope Client attempts to use FIPS 140-3 validated algorithms but falls back to non-FIPS algorithms if needed. This mode allows the Client to continue functioning in environments where full FIPS compliance is not yet achievable.
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=2 /qn
-
FIPS Disabled (Fips Mode=0)
The Netskope Client operates without any FIPS enforcement. Standard (non-FIPS) cryptographic algorithms are used
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=0 /qn
Method 2: Install First, Configure FIPS Separately
Administrators can deploy the Netskope Client without a FIPS parameter and apply the FIPS configuration afterward using Active Directory Group Policy (GPO) or an MDM tool.
-
Step 1 – Install: Deploy the standard STAgent.msi to all target machines without the fipsmode parameter.
-
Step 2 — Configure: Push a registry update to the target machines using GPO or MDM to set the FipsMode key:
This method is mainly useful for scenarios where the Netskope Client is already installed.
| Setting | Registry Path |
|---|---|
| Key | HKEY_LOCAL_MACHINE\SOFTWARE\Netskope\PersistentSettings\FipsMode |
| Type | DWORD |
| Value | 0 = FIPS Disabled, 1 = Strict FIPS Mode, 2 = Permissive FIPS Mode |
MacOS
Method 1: Install and Configure FIPS in a Single Command
Administrators can set FIPS Mode during installation by passing the FipsMode argument to the nsclientconfig.sh script.
-
Strict FIPS Mode (FipsMode=1)
sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=1 preferephemeral="true" httpmethod=get
-
Permissive FIPS Mode (FipsMode=2):
sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=2 preferephemeral="true" httpmethod=get
-
FIPS Disabled (FipsMode=0)
sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=0 preferephemeral="true" httpmethod=get
Method 2: Install First, Configure FIPS Separately
This method is mainly useful for scenarios where the Netskope Client is already installed.
-
Step 1 — Install: Deploy the Netskope Client to macOS endpoints using your MDM tool (such as Jamf ) without the Fips Mode argument.
-
Step 2 — Configure: Modify the PLIST file to add the Fips Mode key to the macOS preferences file on target devices. For example,
sudo plutil -insert FipsMode -integer 1 Library/Preferences/com.netskope.provisioning.plist
Setting Path Key /Library/Preferences/com.netskope.provisioning.plist Key Name FipsMode Value 0 = FIPS Disabled, 1 = Strict FIPS Mode, 2 = Permissive FIPS Mode
Validate FIPS Mode in Netskope Client
Upon the addition of FIPS, you can verify if FIPS Mode is enabled or not in the Netskope Client UI:
-
When Strict Mode is enabled: This means that the the Client is adhering to the FIPS requirements.
-
When Strict Mode is disabled due to error: This means there is a FIPS failure and the Client cannot connect to the gateway.
-
When FIPS Mode is N/A: This means the FIPS mode is disabled.
-
When Permissive FIPS Mode is enabled: This means that the the Client is adhering to the FIPS requirements.
-
When Permissive FIPS Mode is disabled: This means that the Client will fall back to Non-FIPS Mode.
