Monitoring Sources - Netskope Technical Documentation

Stations

The Netskope “Enterprise Station” is a container-based software that allows you to perform synthetic tests:

“Network Probe” tests allow you to discover the underlay network path between your corporate sites and the Netskope POPs or custom targets according to their routing mode configuration
“App Probe” tests allow you to test the availability and performance of any kind of web-based service in both routing mode scenarios (traffic steered through or bypassing Netskope NewEdge Cloud)

Technical requirements

Hardware & software specifications

The Netskope “Enterprise Station” can run on any type of hardware and software platforms that comply with the following minimum specifications:

CPU and operating system must use x86_64 or ARM64 architecture
1GB of RAM (1,5GB of RAM is recommended)
1GB of hard disk space (no need for high-speed SSD disk)
Docker container engine support

Network Flows during Setup Phase

During the setup phase, the machine on which the Enterprise Station is running must be able to connect to the internet on port TCP 443 (HTTPS) to download Netskope’s Docker image from a DockerHub repository. The targets that must be reachable are:

registry-1.docker.io
hub.docker.com
production.cloudfront.docker.com
Docker Hub has added Amazon CloudFront as a CDN for image pushes and pulls. Use “production.cloudfront.docker.com” instead of “production.cloudflare.docker.com”. Go here for more information.
docker-pinata-support.s3.amazonaws.com
cdn.auth0.com
login.docker.com
auth.docker.io

Once the Enterprise Station is deployed, it will authenticate itself to the Netskope platform by sending an authentication request to https://events.goskope.com on TCP port 443.

Network Flows During Normal Operations

Enterprise Stations will perform Network Probe and App Probe tests.

The collected data for both types of tests are sent through HTTPS (TCP port 443) to https://events.goskope.com. Automatically checking for configuration updates from the Enterprise Stations requires the Enterprise Stations to connect to the same https://dem-config.goskope.com endpoint.

Network Probe Specific Flow

When the “Monitor NSClient connectivity” option is enabled, interacting with the GSLB service requires the following flow to bypass Netskope:

TCP port 443 traffic to gateway.gslb.goskope.com/

By default, the NSClient will not steer *.goskope.com traffic on ports 80/443 as per best practice.

As Network Probe tests can use either UDP or ICMP, the following flows must be allowed.

For ICMP method:

Source	Destination	IP Protocol	Type	Comment
Enterprise Station host IP	Netskope POPs IPs	ICMP	8	Echo Request
any	Enterprise Station host IP	ICMP	11	Time To Live Exceeded in Transit
Netskope POPs IPs	Enterprise Station Host IP	ICMP	0	Echo Reply

For UDP method:

Source	Destination	IP Protocol	Ports
Enterprise Station host IP	Netskope POPs IPs	UDP	33.434 – 33.535

Source	Destination	IP Protocol	Type	Code	Comment
Netskope POPs IPs	Enterprise Station host IP	ICMP	3	3	Destination Unreachable – Port Unreachable
any	Enterprise Station host IP	ICMP	11	0	Time To Live Exceeded in Transit

Please refer to the section Network Probes for more details on how Network Probe tests are performed.

App Probe Specific Flow

App Probe tests consist of targeting any kind of HTTPS target through web requests.

The behavior is identical to normal users surfing the internet.

App Probes tests must use the TCP Port 443.

Deployment

The Netskope “Enterprise Station” deployment is a three-step process:

Creation of the Enterprise Station in the Netskope configuration User Interface.
Deployment of the Enterprise Station docker container.
Activation of the Enterprise Station.

Step 1: Enterprise Station creation

From the “Settings” menu, click on the “Stations” link (1) to get the list of already deployed Enterprise Stations.

Click on “Create Station” (2) to start the creation process of a new Enterprise Station.

Creating an Enterprise Station is as simple as providing a name, assign a Site and select the routing mode.

The Provider and Description fields are optional. The Provider field is often used to identify the local ISP the Enterprise Station is connected to.

The Site dropdown list provides the list of all created Sites (please refer to the Sites section for more information). Select the site the Enterprise Station is linked to from this list:

The “Routing” parameter allows you to select between “Steered” and “Bypassed” traffic.

The “Steered” option means that the Enterprise Station synthetic tests will go through the Netskope NewEdge Cloud infrastructure:

The Network Probe tests will be performed to the Netskope POPs (according to the Site settings)
The App Probes tests will be performed to monitored applications, through the Netskope infrastructure so that you will get performance metrics at each stage (between the site and the Netskope POPs, within the Netskope POPs, and between the Netskope POPs and the monitored application servers)

The “Bypassed” option means that the Enterprise Station synthetic tests will bypass the Netskope NewEdge Cloud infrastructure:

The Network Probe tests will be performed to the configured targets, without going through the Netskope POPs
The App Probes tests will be performed to monitored applications, while completely bypassing the Netskope infrastructure. The performance metrics will then be end-to-end, between the Sites and the monitored application servers)

“Gap Limit” corresponds to the maximum number of consecutive hops that cannot be identified (no response to Network Probe tests) before aborting the Network Probe test. It prevents a Network Probe test to indefinitely try to reach a target that will never respond. The default value is 8. In case you are dealing with really complex network architectures, this value may need to be increased. The maximum value is 16.
If the Network Probe does not discover any node and does not reach the target, no data will be reported in the Netskope interface.

Once you are done with the configuration, click on “Create” to confirm your settings.

The Enterprise Station is now created but is not activated yet.

If you go to the list of existing Enterprise Stations, you can see the newly created Enterprise Station and its status (“UNCONFIGURED”).

To come back in the Enterprise Station configuration menu, just click on its name from the list.

Step 2: Enterprise Station installation

Automated installation

The easiest way to deploy a Netskope Enterprise Station is by using an installation script.

In this case, you only have to provision a machine running a Linux operating system complying with the minimum requirements mentioned in the Technical Requirements section.

The following operating systems are supported:

Operating System	Supported Releases
Debian / Raspbian	Release 12 and higher
Ubuntu	Release 20.04, 22.04, 24.04 (LTS only)
RHEL / Rocky / AlmaLinux	Release 8 and higher
CentOS	Linux 7, Stream 8 and higher
openSUSE Leap	Release 15 and higher

To get the script on your local machine, go to the Enterprise Station configuration view and click on “Download installer”:

The script file name is station_<station_name>.sh.

Once the installer script is downloaded, move it to the host on which you want to deploy the Enterprise Station (typically through SFTP or SSH).

Launch the installer by issuing a bash command (as root account):

bash ./station_<station_name>.sh

The Enterprise Station must authenticate to the Netskope platform.This is done through the use of an API key, which is embedded in the installer.

Manual installation

Before manually deploying the Enterprise Station container, make sure the host on which you’ll deploy it contains a Docker engine. Then install docker compose software in version 1.21.0 or higher.

Once this is done, create the following docker-compose.yml file.

version: '3'

services:
  ns-station:
    image: "netskopedem/ns-station:latest"
    labels:
      com.centurylinklabs.watchtower.enable: true
    restart: unless-stopped
    volumes:
      - /srv/netskope/ns-station/runner_xxxxx/storage:/run/kdstation/storage
    network_mode: "bridge"
    environment:
      KD_STORAGE_PATH: "/run/kdstation/storage/storage.db"
      KD_LOG_LEVEL: "INFO"
      KD_BOOTSTRAP_API_KEY: "<ADD STATION KEY HERE>"
      KD_NSPROXY_CACERT: "<ADD NETSKOPE CA HERE>"

  watchtower:
    image: "containrrr/watchtower"
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      WATCHTOWER_LABEL_ENABLE: 1
      WATCHTOWER_POLL_INTERVAL: 172800
      WATCHTOWER_CLEANUP: 1
      WATCHTOWER_INCLUDE_RESTARTING: 1
      WATCHTOWER_INCLUDE_STOPPED: 1
      WATCHTOWER_REVIVE_STOPPED: 1

As mentioned previously, when started, the Enterprise Station must authenticate to the Netskope platform, which is done through an API key.

To retrieve this key, navigate to the Enterprise Station configuration view and click on “generate a key”:

Replace the KD_STATION_API_KEY variable provided in the template above by this key and launch the docker-compose.yml by issuing the command docker compose up -d (from the folder containing the docker-compose.yml file).

Step 3: Enterprise Station activation

If the Enterprise Station deployment is successfully completed, you should see the following screen:

The shown IP address should correspond to the public IP address of the Enterprise Station you have just deployed.

You still have to confirm the Enterprise Station enrollment by clicking on the “Yes, this is the correct IP address” button.

DEM Enterprise Station: Operational & Support Guidelines

1. Software Updates and Release Cycle

Netskope DEM enterprise station utilizes a containerized deployment approach to deliver frequent improvements and security updates to the Enterprise Station.

Release Cadence: Netskope publishes a new release of the Enterprise Station on a monthly basis. This ensures that the station remains up-to-date with the latest features, security patches, and stability improvements.
Update Mechanism: Updates are delivered as full Docker images. When a new image is pushed by Netskope to the repository, the Enterprise Station is designed to detect the change.
Automatic Application: Once a new version is available, installed stations will automatically update within 1–2 days. The update occurs by downloading the new Docker image and restarting the container to apply the changes.

Currently, the update process is fully automated to ensure the security and stability of the deployment. Customers cannot opt out of these upgrades at this time; however, the process is designed to be seamless and does not require customer intervention.

2. Shared Responsibility Model

To ensure the optimal performance of the Enterprise Station, it is important to understand the division of responsibility between the customer and Netskope.

Netskope Responsibility:

Container Management: Maintenance, security, and updating of the container images running inside the host.
Application Logic: Netskope ensures the internal components of the Enterprise Station are functioning and compatible with the Netskope backend.

Customer Responsibility:

Host OS Management: The customer is responsible for the provisioning, maintenance, security patching, and health of the underlying Host Operating System (OS) that runs the Docker containers. Netskope does not manage or access the host machine.
Network Configuration: The customer must ensure that Allow Lists and Firewall rules are correctly configured to allow the Enterprise Station to communicate with the Netskope Cloud.

3. Third-Party Applications and Monitoring

Customers often require Endpoint Detection and Response (EDR) agents or other monitoring software on the server hosting the Enterprise Station. Netskope’s policy regarding these applications is as follows:

Compatibility: Netskope is agnostic regarding third-party applications installed on the Host OS, provided they do not interfere with the operation of the Enterprise Station container.
Exclusions Required: To prevent performance degradation or service interruption, security scanning software (AV/EDR) must be configured to exclude specific Enterprise Station directories and processes.
Log Export: For monitoring purposes, the Enterprise Station exports logs directly to stdout. Customers utilizing third-party monitoring solutions should configure their agents to fetch logs from this output stream.

4. Support and Backward Compatibility

Bug Fixes: Netskope does not back-port bug fixes to older versions of the Enterprise Station. To resolve an identified issue, the station must be upgraded to the latest version containing the fix.
Backend Compatibility: The Netskope cloud backend maintains compatibility with previous versions of the Enterprise Station to ensure service continuity during upgrade cycles.