Configure a Steering Profile

A Steering Profile tells the Netskope Client what traffic it needs to capture and send towards Netskope, and what traffic it needs to bypass and let through directly.

Steering Profiles can be global (applied for all users) or targeted to specific user groups. The latter can be useful for testing, or for use with specific groups of users that may require more granular configuration ( like developers).

Every Netskope tenant has a default steering configuration that is used as a fallback should no other Steering Profiles be present or matched on. You can simply continue to use the default steering profile if you wish (with a few small tweaks), or create your own from scratch.

To start, go to Settings > Security Cloud Platform > Steering Configuration

The Steering Configuration page is where you manage what traffic should be sent to Netskope for inspection.

Using the Existing Default Configuration

If you wish to leverage the existing default steering profile, click the Default tenant config profile to edit its configuration, and then click Edit.

To edit the settings of the default steering configuration, select the profile and click Edit at the top-right.

Create a New Steering Configuration

You may want to create a separate profile and target your IT team (or the team will be managing the Netskope platform) as a way of testing traffic steering changes in isolation before pushing them to the rest of your organization.

To create a new profile, click New Configuration, and if prompted, select User Group. Configure the new steering profile by giving it a name (like Testing), and assigning a user group.

The User Group field is a list of Active Directory/Security Groups that have been synchronized from the identity provider.

Select the type of traffic that you would like the Netskope Client to capture and and send to the Netskope Cloud.

Depending on your subscription, some options may not be visible to you:

If you subscribed to Netskope Private Access (NPA), then ensure that the Steer Private Apps checkbox is selected.

Click Save when you are done.

If you selected the Cloud-Apps Only option above, then you now need to specify the cloud applications (like Dropbox, Teams, Sharepoint, etc) that the Netskope Client should intercept and send to Netskope.

Click Add Steered Item, and specify the applications required.

Bypassing Traffic

Traffic can also be explicitly bypassed from being sent to Netskope entirely under the Exceptions tab of the steering profile. RFC1918 traffic (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) is always bypassed from Netskope by default, and Netskope also maintains a list of applications that usually need to be bypassed (typically due to certificate-pinning) like CrowdStrike.

If you created a new steering profile, you will need to enable it before it can be used. On the Steering Configuration page (Settings > Security Cloud Platform > Steering Configuration), click the “…” menu next to the steering profile you wish to enable, and select Enable.