FIPS 140-3 Mode Support for Netskope Client - Netskope Technical Documentation

The FIPS 140-3 Mode feature enables the Netskope Client to operate exclusively with cryptographic modules validated under the Federal Information Processing Standard (FIPS) 140-3. When FIPS Mode is active, the Netskope Client enforces the use of FIPS-approved algorithms for all cryptographic operations — including encryption, hashing, digital signatures, and key management — across NS Agent, NS Service, and all TLS-using client modules.

– This feature is currently in Beta. Contact Netskope Support for enabling this for your tenant.
– This is only applicable for Internet Security Service.

Prerequisites

After the Netskope Client downloads the updated configuration from the tenant, the endpoint machine must be rebooted before using FIPS Mode.

Supported Environments

Supported OS: Windows (only on 64-bit), macOS
Supported minimum Client version: 139.0.0

FIPS is supported for 32 and 64-bit Netskope Client versions. However, it is not supported on a Windows 32-bit device.

Netskope Client Installation Using FIPS Mode

You can install the Netskope Client using FIPS mode on Windows and macOS using one of the following methods:

Method 1: Install and Configure FIPS in a Single Command
Method 2: Install First, Configure FIPS Separately

A system restart is necessary any time the FIPS mode setup is modified, which also applies to a new installation.

Windows

Method 1: Install and Configure FIPS in a Single Command

Administrators can enable FIPS Mode at installation time or upgrade by appending the fipsmode parameter directly to the MSI installer command. This writes the FipsMode value to the Windows Registry automatically during installation.

Run the following command using your software deployment tool (such as Microsoft Intune, SCCM, or a command-line script):

Strict FIPS Mode (Fips Mode=1)

The Netskope Client uses only FIPS 140-3 validated cryptographic algorithms for all operations. Non-FIPS algorithms are blocked entirely.
```
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=1 /qn
```
Permissive FIPS Mode (Fips Mode=2)

The Netskope Client attempts to use FIPS 140-3 validated algorithms but falls back to non-FIPS algorithms if needed. This mode allows the Client to continue functioning in environments where full FIPS compliance is not yet achievable.
```
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=2 /qn
```
FIPS Disabled (Fips Mode=0)

The Netskope Client operates without any FIPS enforcement. Standard (non-FIPS) cryptographic algorithms are used
```
msiexec /I NSClient.msi tenant=corp domain=goskope.com installmode=IDP enrollencryptiontoken=XXX fipsmode=0 /qn
```

Method 2: Install First, Configure FIPS Separately

Administrators can deploy the Netskope Client without a FIPS parameter and apply the FIPS configuration afterward using Active Directory Group Policy (GPO) or an MDM tool.

Step 1 – Install: Deploy the standard STAgent.msi to all target machines without the fipsmode parameter.
Step 2 — Configure: Push a registry update to the target machines using GPO or MDM to set the FipsMode key:

This method is mainly useful for scenarios where the Netskope Client is already installed.

Setting	Registry Path
Key	HKEY_LOCAL_MACHINE\SOFTWARE\Netskope\PersistentSettings\FipsMode
Type	DWORD
Value	0 = FIPS Disabled, 1 = Strict FIPS Mode, 2 = Permissive FIPS Mode

MacOS

Method 1: Install and Configure FIPS in a Single Command

Administrators can set FIPS Mode during installation by passing the FipsMode argument to the nsclientconfig.sh script.

Strict FIPS Mode (FipsMode=1)

sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=1 preferephemeral="true" httpmethod=get

Permissive FIPS Mode (FipsMode=2):

sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=2 preferephemeral="true" httpmethod=get

FIPS Disabled (FipsMode=0)

sudo -S ./nsclientconfig.sh 0 0 0 idp <domain> <tenant> 1 mode="scheme" FipsMode=0 preferephemeral="true" httpmethod=get

Method 2: Install First, Configure FIPS Separately

This method is mainly useful for scenarios where the Netskope Client is already installed.

Step 1 — Install: Deploy the Netskope Client to macOS endpoints using your MDM tool (such as Jamf ) without the Fips Mode argument.
Step 2 — Configure: Modify the PLIST file to add the Fips Mode key to the macOS preferences file on target devices. For example,
```
sudo plutil -insert FipsMode -integer 1 Library/Preferences/com.netskope.provisioning.plist
```
Setting Path
Key /Library/Preferences/com.netskope.provisioning.plist
Key Name FipsMode
Value 0 = FIPS Disabled, 1 = Strict FIPS Mode, 2 = Permissive FIPS Mode

Setting	Path
Key	/Library/Preferences/com.netskope.provisioning.plist
Key Name	FipsMode
Value	0 = FIPS Disabled, 1 = Strict FIPS Mode, 2 = Permissive FIPS Mode

Validate FIPS Mode in Netskope Client

Upon the addition of FIPS, you can verify if FIPS Mode is enabled or not in the Netskope Client UI:

When Strict Mode is enabled: This means that the the Client is adhering to the FIPS requirements.
When Strict Mode is disabled due to error: This means there is a FIPS failure and the Client cannot connect to the gateway.
When FIPS Mode is N/A: This means the FIPS mode is disabled.
When Permissive FIPS Mode is enabled: This means that the the Client is adhering to the FIPS requirements.
When Permissive FIPS Mode is disabled: This means that the Client will fall back to Non-FIPS Mode.