Platform Configuration

To create a service template:

1. In the Netskope UI, go to Settings > Security Cloud Platform > On-Premises Infrastructure.

2. Click the Next-Gen tab.

3. On the Next-Gen page, click Manage Template and then click Service Template.

   

4. In the Manage Template window, click New Template.

   

5. In the New Service Template window, enter the following information:

   1. Enter the Service template name.

   2. Under Upgrade timing, pick a frequency to schedule for upgrades. You can select one of the following: Daily, Weekly, or Monthly. Configure other values depending on the chosen frequency.

   3. Select the Auto upgrade checkbox only to allow emergency upgrades outside the scheduled frequency.

   4. Only Secure Web Gateway (SWG) and AI Guardrails are available as a supported service templates for VPE.

6. Under Services, select one of the following:

   

   SWG

   AI Guardrails

   In the General tab and under Proxy Mode – Explicit, enter the Listener Ports. The default port is 8080.

   1. Click the General tab.

   2. Enter the following:

      1. Under Proxy Mode – Explicit, set the Listener Ports. The default is 8080. You can also add multiple ports, for example, 8080, 8081, and so on.

      2. Click to select the Enforce SAML Auth checkbox only if users must authenticate to the proxy.

   3. Click the Advanced tab.

   4. Toggle the following options to enable:

      • Under Advanced Forward Proxy: The following settings control two HTTP headers that get added to customer traffic when configured.

        • Use Client IP: Enable this option to use the header name X-Forwarded-For.

        • Client Identity: Enable this option to use the header name X-Authenticated-User.

      • Explicit Proxy Chaining:Forwards traffic from the VPE proxy to another proxy in your environment. Enable this option and provide the hostname and port of the upstream proxy. Once enabled, traffic reaches the VPE proxy first, then gets forwarded to the proxy you specified.

      • PAC Server: enable this option to direct cloud app traffic to the VPE node while other traffic continues through your existing proxy server. Enter the following:

        • Listener Port: Enter the TCP port to host the merged PAC file server.

        • Proxy Hostname (FQDN): Optionally, specify the fully-qualified domain name that resolves to the IP configured for the appliance. This host name will be used in the merged PAC file. If this setting is not provided, the appliance IP will be present in the merged PAC file.

        • Custom PAC Script: Enter the PAC script.

        • Custom PAC URL:  Enter the URL of the existing PAC file server.

   5. Click to select the System Features options: 

      • Large File Support: Without this enabled, threat detection and file profiling applies only to files up to 16 MB, even though the proxy itself allows files up to 400 MB. Enable this option to extend threat detection up to the full 400 MB.

      • TSS Fast Scan: Enable this option to run threat detection on traffic passing through the proxy.

      • Health Check: Applies only when VPE nodes are deployed in a cluster of two or more nodes. It has no effect on a single, standalone VPE node.

   6. TCP Optimization: Configure buffer size and throttle settings for TCP connections, as a Client and as a server:

      • Receive buffer size (Client only): default 1024 KB

      • Send buffer size (Client only): default 1024 KB

      • Throttle max threshold: default 1024 KB

      • Throttle min threshold: default 192 KB

   7. Click Save.

   For the AI Guardrails service, enter the following information:

   • HTTP (Port 8080): The port that the AI Guardrails On Demand API is available on.

   • GPU based AI Guardrails VM: Enable and connect to a GPU-based VM to leverage LLM based detection in AI Guardrails.

     • Association of the GPU based Container: Enter the container URL or IP address. Click GPU based AI Guardrails Image to download the GPU image.

     • JWT URL: (Optional) Enter the OAuth2 token endpoint, such as https://<auth-provider>/oauth2/token.

     • Client ID: (Optional) Enter the OAuth2 client ID issued by your identity provider (IdP).

     • Client Secret: (Optional) Enter the OAuth2 client secret issued by your identity provider (IdP). This field is obfuscated.

     • Scope: (Optional) Enter the OAuth2 scope.

     • AI Guardrails Certificate: Upload the certificate you want to use to securely connect to the AI Guardrails GPU-based VM.

   • Store Matched Content in Netskope: Enable to store the matched prompt/response content in Netskope to show in Skope IT Alerts and Incidents.

     

     Field	Remote Mode (OAuth 2.0)	No-Token Mode
     jwt_url	OAuth token endpoint URL	Not present
     client_id	OAuth client ID	Not present
     client_secret	OAuth client secret	Not present
     scope	OAuth scopes (optional)	Not present

7. Click Save.

To attach the created service template to the VPE Node, on the Next-Gen page:

1. Click VPE Setup in the Services column for the VPE Node.

2. Click the VPE SetUp tab.

   For SWG, this process can take up to 30 minutes to complete. As part of this process, the service image and its dependent images are automatically downloaded and deployed.

3. From the VPE Service Template dropdown list, select the required service template.

   

4. Click Save.

The name of the service template appears in the VPE Service Template column for the selected VPE-Node.

VPE Nodes Post Configuration 

You can run show version-info to get the values for all attributes populated in the CLI.