This document describes the available deployment methods and user enrollment options when installing the Netskope Client on Android and ChromeOS devices.
Supported versions
Refer to Netskope Client Supported OS and Platform for more details on the supported versions for Android and ChromeOS.
Deploy Client in Android and Chrome OS
Refer to the following sections to understand the various Client deployment methods in Android and ChromeOS devices:
Email Invite
For email invite-specific instructions, see the following:
MDM Deployment Options
Netskope offers support for a wide range of MDM solutions. For MDM-specific instructions, see the following:
Google Admin Console
For Google Admin Console-specific instructions, see the following:
Enrollment Workflow in ChromeOS and Android Devices
The following steps illustrate the Netskope Client deployment and enrollment workflow in ChromeOS and Android devices from Google Play Store:
Important
Netskope recommends that you consider the following before proceeding with deployment:
- End-user devices must support Android AppLink feature for auto enrollment process.
- Firewall must allow access to Applink. If Android OS encounters a network glitch or Android OS applink binding API error while connecting to Applink, then Netskope recommends you to uninstall and reinstall the Netskope Client to fix the issue.
- Netskope recommends the use of Google Admin console or your MDM tool for deploying CA certificates. See Traffic Steering > Explicit Proxy > Traffic Steering from Chromebooks for more information.
Use MDM for managed devices and Manual deployment for unmanaged devices. Email Invite is flexible — it works for both.
Enrollment for Email Invite
For email invite-specific instructions on enrolling the Netskope Client, see Email Invite.
Manual Deployment using IDP Enrollment
The following steps illustrate the Netskope Client Manual deployment and enrollment workflow in ChromeOS and Android devices from Google Playstore:
-
Visit Google Play Store and download Netskope Client.
-
Install Netskope Client. After the installation is complete, a pop-up is displayed to the user to enter the tenant name and select the tenant domain as shared with the user by their respective IT.
-
Click Next to continue with enrollment. User is redirected to their IdP login screen. Authentication status message is displayed in the browser.
-
Once the user enrollment is complete, the Client will initiate configuration download and establish tunnel.
-
After the Client is connected, user can click the mobile menu icon (3 vertical dots in the top right corner of the client) for options to view configuration details.
MDM Deployment using IDP Enrollment
The following steps illustrate the Netskope Client enrollment workflow when deployed through MDM on ChromeOS and Android devices:
-
Open the app once the Netskope Client is installed on the device.
-
Select the browser to open the authentication page.
-
On the authentication page, perform the following steps:
-
In Username, enter the IDP registered email address.
-
In Password, enter the IDP registered password.
-
Click Sign In.
-
-
The system redirects to the screen that says Authentication Successful. Configuration will automatically be downloaded. You are being redirected and downloads the Configuration.
-
Once the download is complete, the screen displays Netskope Client Connected.
The user can click the mobile menu icon (3 vertical dots in the top right corner of the client) for options to view configuration details.
SSL Inspection for Android
SSL/TLS inspection is a foundational capability that enables Netskope to perform efficient threat and data protection services. Netskope performs SSL inspection and serves as a Man-in-the-Middle. In order to establish trust between source applications and Netskope it is required to install CA certificate into appropriate OS store. To learn more, view Certificates for SSL/TLS Inspection.
SSL decryption policies allow you to specify the traffic you want to leave encrypted and not further analyzed by Netskope via the Real-time Protection policies. To learn more, view SSL Decryption.
In Android devices, a CA certificate can only be installed in the user cert store irrespective of device ownership and enrollment method. Starting with Android Nougat (7.0), Netskope certificates stored in the user certificate store are not trusted by Android and 3rd party app services, since Google does not trust the certificates installed in the user store. This leads to errors during SSL inspection due to broken chain of trust – native or 3rd party mobile applications would drop SSL handshake because server certificates presented by Netskope SWG won’t get recognized as trusted. However web-browsers (such as Chrome, Edge etc) will still be able to verify chain of trust against user cert store and therefore SSL inspection won’t cause issues.
There are two options to get around Android limitations:
-
Disable SSL inspection for Android. At the time of Netskope client distribution & enrollment (and irrespective of enrollment method and device ownership) CA certificate distribution can be skipped. Netskope Client won’t find a CA certificate on the device and will signal upstream proxy that SSL inspection should not be performed. The traffic will still be tunneled via NewEdge according to Steering Configuration.
-
Enable selective SSL inspection on Android based on the source App. Once a CA certificate is detected on the device by Netskope client, SSL inspection would be enabled for the entire device (or Work profile, depending on device enrollment method). All apps except browsers would have to be added to Netskope Steering Exceptions.
You can start bypassing traffic from SSL inspection by adding exceptions.
To add a Certificate Pinned Application exception type, view Certificate Pinned Application. In the Definition field, you can select the RegEX option and add the desired app identifier.
Application ID can be found in GooglePlay Store as a part of its URL. An example below illustrates that CNN App is defined in PlayStore as com.cnn.mobile.android.phone.
Instead of adding every single application as an exception (which is not scalable) regular expressions could be used. The goal is to use least amount of configurations and describe applications in bulls. For example com\.google\.android\..*. This regular expression contains the following:
-
com.google.android.tts
-
com.google.android.apps.maps
-
com.google.android.calendar
-
com.google.android.gms
-
com.google.android.gms.persistent
-
com.google.android.webview
-
com.google.android.play.a.h.e
-
com.google.android.googlequicksearchbox
An example on how to bypass all Apps but Microsoft Edge will look like the following: ^(?!.*(com\.microsoft\.emmx)).*$
An example on how to bypass all Apps but Microsoft Edge and Google Chrome will look like the following:
^(?!.*(com\.microsoft\.emmx|com\.android\.chrome|com\.sample\.application)).*$
While bypassing SSL inspection through Certificate Pinned Apps, you can either Block or Bypass traffic.
Traffic Steering Exceptions on Android and ChromeOS
Netskope steers all traffic except for ones configured as Certificate Pinned Application, Domain, and Destination Locations exceptions. Netskope validates the exceptions setup in the steering configured and bypass the traffic from the selected source and sent directly to their respective destination. If you want your Apps to be bypassed in the steering configuration you can configure it in Settings > Security Cloud Platform > Steering Configuration > Your <Steering Configuration> Exception other than those that needs to be inspected by Netskope. To learn more, view Exceptions.
Uninstall Netskope Client In Android
The uninstallation of Netskope Client from your Android device with a personal account is simple:
-
Open the Google Play Store app.
-
Tap your Profile icon.
-
Tap Manage apps & devices > Manage.
-
Tap Netskope Client.
-
Tap Uninstall.
To learn more, view Uninstall Apps in Android.
Limitation
Netskope Private Access periodic re-authentication is not supported on Android and Chromebook.