Netskope Client Troubleshooting Guide

This guide is designed to help troubleshoot issues with end-users and administrators using Netskope Client.

Netskope Client steers traffic from the end-user device to the Netskope Cloud. The Client creates an SSL tunnel from the end device and terminates it at the Netskope forward proxy in the Cloud. The tunnel carries traffic that is selected by the administrators as part of the steering configuration. All intermediate and root CA Certificates are installed in the system cert store during the Netskope Client installation to facilitate the SSL termination.

General Troubleshooting Methods

Is my Netskope Client installed and active?

The easiest way is to check the taskbar or menu bar for an active Netskope icon on your screen.

Windows

macOS

Linux

To learn more, view Using Netskope Client.

Where can I view more details about the Netskope Client?

 To view details, do the following:

1. Click the Netskope Client icon.

2. Select Configuration to display the window. The following details are constant including Organization, Gateway, Steering Configuration, and so on.

   • Organization

   • Gateway: The Gateway IP however will be intelligently identified based on your location. In this case, A user based out of Austin, TX is redirected to the closest Netskope datacenter of Dallas for gateway-tenant.goskope.com.

   • Gateway IP

   • User Email: The User Email will typically be the UPN derived from the iDP and unique to each user.

To learn more, view Netskope Client.

Is my Netskope Client disabled?

An administrator or end-user can enable a disabled Client. If disabled, click the Netskope Client icon and select Enable Netskope Client option to activate the Client again.

How can I know if I am connected to the nearest datacenter?

The Netskope Client always routes traffic to the nearest datacenter (with Client assisted GTM). The Gateway IP in the Netskope Client Configuration must display the location of the nearest datacenter.

How do I know if a specific website is steered through Netskope?

The Netskope Client steers traffic from the user machine to the Netskope Cloud.

• Cloud Apps – Only defined SaaS app traffic over ports 80, 443 is steered.

• All Web Traffic – All traffic going to ports 80,443 is steered. Non-standard ports configured on the webUI are also steered. 

• All Traffic – Steer all HTTP(S) and non-HTTP(S) to the Netskope cloud for deep analysis.

  In CASB/Cloud Apps mode, Netskope does not steer All Web traffic today and is limited to specific applications defined in the steering configuration. The easiest way is to view the application browser certificate and check if the Issuer is signed by Netskope.

  The following example shows the browser certificate details when the traffic from box.com is steered through Netskope.

  Steered through Netskope

  

  Not steered through Netskope

  

  For non-web traffic, you can check SkopeIT in your tenant and view whether your traffic was bypassed or blocked by Netskope.

  How does the Netskope Client determine what to steer?

  The Netskope Client inspects the end device packets using OS packet filtering capabilities (Traffic mode and exceptions). This process varies according to the OS and the presence of Explicit Proxy in the network.

  Will my applications/web sites see my IP address or Netskope address?

  All sites that are steered through Netskope will see the source (egress) IP as coming from Netskope IP address space.

  If applications require source IP allowlisting, they will need to allowlist the Netskope IP ranges found here: Consolidated List of IP Ranges for Allowlisting.

  Private Access

  How can I know if my Client is connected to NPA?

  1. Right-click on the Netskope Client icon in the system tray and select Configuration. Private Access should show as Connected.

     

     For Windows, you can also check one of the following options:

     • The tooltip of Netskope Client icon in the tray icon shows the NPA status. Or,

     • Click the Netskope Client icon and check the Services section. It displays Private Access if the NPA status is enabled.

  2. If the Configuration shows Private Access as Disabled, make sure the Steer all Private Apps option is enabled in the Steering Configuration settings for your tenant. Go to Settings > Security Cloud Platform > Steering Configuration.

     If you are using only the Default tenant configuration, click Edit in the upper right corner. If you have multiple Steering Configurations, click on the name of the Steering Configuration you are using for NPA to open the details page.

What can I do when the NPA Tunnel is getting disabled?

If you cloned a VM snapshot and installed it on multiple machines, this will cause the NPA tunnel to become disable. The NPA backend requires the netskope-device-id to be unique, which is derived from the machine-id.

You need to regenerate unique machine-ids following these steps:

1. Stop the client service.

   sudo systemctl stop stagentd.service

2. Remove NPA certificates from /opt/netskope/stagent/data. The following certificates needs to be removed:
   • npaccesscert.pem
   • npaccesskey.pem
   • npatenantcert.pem
3. Remove the machine-id.

   rm /etc/machine-id 
   rm /var/lib/dbus/machine-id

4. Regenerate the machine-id.

   dbus-uuidgen --ensure
   systemd-machine-id-setup

5. Verify the new machine-id.

   cat /etc/machine-id
   host namectl

6. Reboot the machine.

   sudo reboot

Endpoint DLP

Where can I enable Endpoint DLP to my client configuration?

Endpoint DLP is an add-on feature for the Netskope Client. To enable Endpoint DLP for the Netskope Client, contact your sales representative.

Select Enable Endpoint DLP to enable Endpoint Data Loss Prevention for the client configuration and apply Content and Device Control policies to the devices. You can enable Endpoint DLP for the Default Tenant Config to apply policies to all client users or for custom client configurations to apply policies to specific users.

Troubleshooting Configuration Issues

How can I perform a speed test on the connected Netskope POP?

1. Click the Netskope Client icon.

2. Select Advanced Debugging.

   

3. Click Speed Test.

   

4. Select the desired File Size option.

5. Click Start.

   For example, view the following screenshots for macOS:

   How can I restart the Netskope Service on my Windows, macOS, or Linux devices?

   Use the following commands:

   Windows

   Ensure that Protect Client configuration and resources field is disabled in Client Configuration.

   • Start Service: stagentsvc -start

   • Stop Service: stagentsvc -stop

macOS

• Pre Big Sur

  • Start Service: sudo launchctl load

    /Library/LaunchDaemons/com.netskope.stagentsvc.plist 

  • Stop Service: sudo launchctl unload

    /Library/LaunchDaemons/com.netskope.stagentsvc.plist 

• BigSur/Monterey or later

  There is no command to stop network extension. You need to disable the client from the UI.

Linux

• Start service: sudo systemctl start stagentd.service

• Stop service: sudo systemctl stop stagentd.service

How can I gather information about the Netskope Client using API?

https://<tenant-URL>/api/v1/clients – This endpoint returns information related to the Netskope Client. To learn more, view Get Client Data.

How do I save my Netskope Client logs?

• To save Client logs, go to Netskope Client icon > Save Logs. You can save the .zip log file to a specific folder.

• If the Client is hidden by your administrator, use command-line options to save the .zip log files.

  • Windows = Nsdiag.exe –o mylogs.zip

  • Mac = ./nsdiag –o mylogs.zip

  • Linux = /opt/netskope/stagent/nsdiag -o mylogs.zip

  • Android = NetskopeLogs.zip

How can I collect the log details from my Netskope account?

1. Go to Settings > Security Cloud Platform > Devices page, search for the username and click the device name.

2. Click Collect Log on the top right-hand corner.

3. Once the log file is generated, the admin (requestor) receives an email with the link to download the log to their local computer in zip format.

   The link redirects to your Netskope tenant Devices webUI.

4. Click Download Log.

   

Where can I find the Netskope certificates and branding files?

• Windows: C:\ProgramData\netskope\stagent

• macOS: /Library/Application\ Support/Netskope/STAgent

• Linux: /opt/netskope/stagent/

• Android:Settings > Biometrics and Security >  Other Security Settings > View Security Certificates. Tap on the User tab. You can see the Security certificates for Netskope.

• iOS: Settings > VPN > VPN Profile > More Details. The branding file is protected and not viewable.

Where can I find the Netskope Log files?

Windows

Processes	Log Location
Netskope Client services and other processes running as admin	%ProgramData%/Netskope/stagent/Logs
User process	%APPDATA%/Netskope/STAgent/Logs
Service crash dump	%ProgramData%/Netskope/stagent/Logs
UI Crash dump	%APPDATA%/Netskope/stagent/Logs

macOS

Processes	Log Location
System extensions and other processes with root privilege	/Library/Logs/Netskope
User process	~/Library/Logs/Netskope

Linux

Processes	Log Location
Service and installation logs	/opt/netskope/stagent/logs
UI and stAgentApp	~/.netskope/stagent/logs

Android

1. Go to the Netskope Client app.

2. Click the three dots.

3. Select Send Logs. 

4. You can download it to the desired location.

iOS

Users cannot read Netskope logs on iOS devices, but you can download Netskope logs zip files and share them through AirDrop and email.

Where can I find the Netskope executables and diagnostic tools?

• Windows:

  • 32-bit: C:\ProgramFiles (x86)\Netskope\STAgent\

  • 64-bit: C:\ProgramFiles\Netskope\STAgent\

• macOS: /Library/Application\ Support/Netskope/STAgent

• Linux: /opt/netskope/stagent/

• Diagnostic command in Windows:

  • 32-bit: C:\Program Files (x86)\Netskope\STAgent\nsdiag.exe

  • 64-bit: C:\Program Files\Netskope\STAgent\nsdiag.exe

• Diagnostic command in Mac: /Library/Application Support/Netskope/STAgent/nsdiag

• Diagnostic command in Linux: /opt/netskope/stagent/nsdiag

 Netskope Client’s stAgent process failed to initialize and the stAgentUI failed to launch when resuming  an active session from a locked or disconnected state after installing/upgrading/reconfiguring  Netskope Client from single to multi-user mode on Windows environment with IDP enrollment. How should I fix this?

When the Netskope Client is deployed/upgraded/reconfigured from single user mode to multi-user mode using IdP enrollment on a Windows device, the stAgent process fails to initialize for users who transition from an inactive or locked state back to an active session.

For example, Two users User A, and User B use a Windows system.

1. User B is active on the system and User A who is logged in but inactive.

2. Netskope Client gets installed/upgraded/reconfigured from single user mode to multi user mode and the session for User B is created successfully.

3. User B locks the screen, which moves the session into an inactive state.

4. User A unlocks the screen but the Netskope Client doesn’t initialize for User A and there is no stAgentUI process for User A. This disrupts the traffic steering for User A and keeps the Client inactive.

   To restore stAgentUI process and ensure proper traffic steering for User A, Netskope recommends performing log off and login for user A to eliminate any inactive Netskope Client issue.