Manage DSPM Virtual Appliance Sidecars (OVA)

Overview

This article provides instructions for ongoing maintenance and lifecycle management of your OVA-deployed Netskope DSPM sidecars, including configuring SSL proxies post-deployment, rotating security tokens, and performing version upgrades.

Configure for an SSL Proxy Environment (Post-Deployment)

If your organization routes outbound traffic through an SSL proxy, you must perform the following steps to allow your sidecar to communicate with the Netskope DSPM platform.

1. Use an SSH client to connect to the appliance’s IP address.
2. Log in with the default credentials:
   • Login: netskope
   • Password: netskope
3. Execute the setup script with sudo privileges:
   sudo /opt/netskope/setup-sidecar.sh
4. Follow the on-screen prompts to confirm your configuration parameters ((Sidecar Configuration, Tenant Host Configuration, Authentication Configuration). The values you entered during the OVA deployment will be shown as defaults.
5. For HTTPS Proxy Configuration (Optional), populate with a HTTPS address to force sidecar traffic thru your designated proxy.
6. When prompted Are you sure to use these variables for Sidecar deployment? (Y/N):, type y and press Enter to save the configuration.
   • The configuration will be stored in the /opt/netskope/sidecar-config.env file.
7. Next, execute the following command with sudo privileges to delete specific safety markers:
   sudo rm CLOUD_INIT_SUCCESS SIDECAR_DEPLOYED
8. After saving the configuration and deleting the safety markers, execute the bootstrap script:
   sudo /opt/netskope/bootstrap.sh

When deployment is complete, your sidecar should immediately begin communicating via the designated proxy.

Rotating Sidecar Tokens

If you need to rotate your security credentials, you must generate a new token in the console and apply it to the appliance.

Step 1: Generate a New Sidecar Pool Token

1. Log in to your Netskope DSPM instance.
2. Go to Administration > Sidecar.
   • For more details on managing sidecar pools, see DSPM Sidecar Administration Overview.
3. For the sidecar pool whose token you wish to rotate, click the Generate New Token icon.
4. Read the warning on the modal and click Confirm.
5. Click Copy to save the generated token to your clipboard.
6. Close the modal.

Step 2: Apply the New Token

1. SSH into the sidecar virtual appliance.
2. Re-run the configuration script:Bashsudo /opt/netskope/setup-sidecar.sh
3. Enter the new Sidecar Pool Token when prompted and confirm the changes.

The script will automatically update the configuration and restart the necessary services.

Sidecar Upgrade

The recommended method for upgrading the sidecar appliance is to redeploy it using the latest available OVA file.

1. Download the new version of the OVA from Netskope.
2. Deploy it as a completely new virtual machine, following the deployment steps in Deploy DSPM Sidecars via OVA/OVF on VMware vSphere.
3. Once the new sidecar is online and connected, you can safely decommission and delete the old virtual machine.