Quick Start Guide: From Deployment to Your First Request

Get the image

1. Log in to the Netskope tenant UI and go to Settings > Security Cloud Platform > VM Onboarding.
2. Click Deploy VM > Get VM Image.
3. Get the image for your platform:
   • ESXi: Choose the ESXi image and click Download to get ai-gateway-ova.zip. Full steps: Downloading the VMware ESXi Image.
   • AWS: In the AWS AMI section, click the AWS Marketplace link. Full steps: Launching the AWS Amazon Machine Image (AMI).
   • GCP: Click the GCP Marketplace link. Full steps: Launching the Google Cloud Platform (GCP) Image.
   • Azure: Next to Azure, click View instruction. The image appears in your Azure subscription only after Netskope provisions it. Full steps: Launching the Azure Image.

Launch the VM

Follow the steps for your platform. All four topics are indexed under Installation in Your Infrastructure.

VMware ESXi (full steps: Deploying OVA on ESXi)

1. Unzip ai-gateway-ova.zip to get the OVA file.
2. Log in to the ESXi host and go to Inventory > Hosts and Clusters.
3. Right-click the host and click Deploy OVF Template.
4. Under Select an OVF template, click Local file, then Upload files, and choose the OVA. You can also enter a URL.
5. Enter a unique VM name and choose a target location.
6. Select the compute resource, and enable Automatically power on deployed VM.
7. Review the details, then choose thin or thick provisioning under Select storage.
8. Select VM Network as the destination network and click Finish.

AWS (full steps: Deploying AWS AMI image)

1. In the EC2 Management Console, click Launch Instance.
2. Search for Netskope One AI Gateway and select the AMI from AWS Marketplace AMIs.
3. Choose an instance type from the sizing table and launch the instance with the SSH key pair you’ll use to sign in.
4. Allocate an Elastic IP. Then select the instance’s network interface and choose Actions > Associate Address to assign it.

To automate AWS bootstrap, see Automated Bootstrap Using AWS Secrets Manager.

GCP (full steps: Deploying GCP Image)

1. In Compute Engine, go to VM Instances and click Create Instance > Create VM from Marketplace. You can also search for Netskope One AI Gateway in GCP Marketplace.
2. Specify the instance name, service account, machine type, boot disk, and networking.

To add or change SSH keys after you create the VM, see the same topic.

Azure (full steps: Deploying Azure Image)

1. In the Azure portal, go to Virtual machines, open the Images dropdown, and select All images.
2. Go to Marketplace and search for Netskope One AI Gateway.
3. Choose a size from the sizing table. The image supports Generation 2 VMs with Trusted Launch.
4. Set up the administrator account. The username is fixed as nsadmin. Allow inbound SSH (port 22). If you use a password, make it 12–72 characters with at least three of: lowercase, uppercase, number, special character.

Full steps for registration and enrollment: Deploy AI Gateway on Netskope Portal.

Register the gateway in your tenant

1. In the Netskope tenant UI, go to Settings > Security Cloud Platform > VM Onboarding.
2. Click Deploy VM > Register VM.
3. Under Step 1 (Configure), enter a VM Name (AI Gateway) and a Hostname. The hostname must be a valid domain name that resolves to the gateway.
4. Under Protocol and Port, choose the HTTPS and HTTP ports the gateway uses.
5. Click Continue. In Step 2 (Register), the tenant generates a registration token.
6. Click Copy or Download to save the token, then click Finish.

The token expires 24 hours after generation. Enroll the gateway within that window.

Sign in to the appliance

Full steps: Signing In to Your Appliance.

Connect to the AI Gateway CLI as nsadmin:

ssh nsadmin@<appliance-ip>

• ESXi: The default password is nsadmin. The configuration wizard prompts you to change it. New passwords need at least 14 characters, including a digit, an uppercase letter, a lowercase letter, and a special character.
• AWS: Use your key pair: ssh -i /path/to/key.pem nsadmin@<appliance-ip>
• GCP: The instance uses the SSH keys you added to the nsadmin metadata.
• Azure: Use the SSH key or password you set when you created the VM.

Five failed sign-in attempts in a row lock the nsadmin account for 15 minutes.

Configure the network

• ESXi: In the configuration wizard, open Network Configuration and set DNS servers, DHCP, or a static IP.
• AWS: Configure networking in the AWS console or use DHCP. Don’t set a static IP in the AI Gateway CLI. It can conflict with the VPC and cut off connectivity.

Enroll the gateway

1. In the configuration wizard, select Enroll this AI Gateway.
2. Wait a few minutes while pre-enrollment sets up the AI Gateway services.
3. When the AI Gateway Enrollment page appears, paste the registration token.
4. Wait for the CLI to confirm enrollment and show the Gateway ID.

Verify enrollment

In the tenant UI, go to Settings > Security Cloud Platform > VM Onboarding. A green icon next to your VM in the VM-Name column confirms the gateway is registered.

Install a certificate (optional)

Full steps: Install Certificate on AI Gateway.

AI Gateway uses a self-signed certificate by default. If you keep it, configure your AI agents to trust it or skip validation. To use a CA-signed certificate instead:

1. In the configuration wizard, open Certificate Management and select Generate CSR. Set Common Name to match the gateway host name, and complete the other fields.
2. Have your root CA or certificate provider sign the CSR.
3. Select Install Certificate and paste the signed certificate under Paste your signed certificate.

Full topic list: Configuration.

Add an AI provider

Full steps: AI Provider List, Add or Register a Custom AI Provider, and Associate the Custom AI Provider to the AIG.

1. Go to Settings > Security Cloud Platform > AI Gateway > AI Provider.
2. Confirm the provider you need appears in the list. AI Gateway supports OpenAI, Google Gemini, and Anthropic Claude schemas.
3. To add a provider that isn’t listed, click New AI Provider and enter:
   • Name: AI Gateway adds the prefix cust automatically.
   • AI Schema: OpenAI, Google Gemini, Claude, or Others.
   • Host: The domain name of the AI provider.
   • Protocol & Port: The HTTPS and HTTP ports the provider listens on.
4. Click Save.
5. For a custom provider, go to Settings > Security Cloud Platform > AI Gateway > Gateway Setup, select your gateway, click Link Custom AI Providers, choose the provider, and click Save.

If you choose the Others schema, AI Gateway provides access control, rate limiting, and authentication. DLP inspection and AI Security Guardrails aren’t available for these providers.

Using AWS Bedrock? See Configure AWS Bedrock as a Custom AI Provider.

Create a token group

Full steps: Create New Token Group. Overview: Authentication Token and Group.

1. Go to Settings > Security Cloud Platform > AI Gateway > Authentication Token & Group.
2. Click New Token Group.
3. Enter a Token Group Name. Add a description if you like.
4. Click Save.

Token groups let you apply policies and rate limits to many tokens at once.

Create a token

Full steps: Create New Token.

1. On the Authentication Token & Group page, click New Token.
2. Enter a Token name.
3. Optionally set Expire In and choose a unit (hours, days, weeks, or months).
4. Choose a Token Group.
5. Click Save.
6. Copy the token from the Copy Token window and store it securely. You can’t view it again.

Store the provider key in AI Gateway (recommended)

Full steps: AI Provider API Keys (Virtual Keys).

Virtual keys keep your real provider API keys out of application code. You add the key once, and AI Gateway swaps it into outbound requests.

1. Go to Settings > Security Cloud Platform > AI Gateway > Provider and select the provider.
2. Click Add Key, enter a unique Name of API key, paste the provider’s API key, and click save. AI Gateway validates the key with the provider before it stores it.
3. Go to Settings > Security Cloud Platform > AI Gateway > Token Group and open your token group.
4. Under AI provider keys, select the provider and the stored key, then save.

Applications that use a token from this group now reach the provider without ever handling its API key.

Full steps: Route Traffic to a Single AI Gateway Endpoint.

1. Go to Settings > Security Cloud Platform > AI Gateway > Gateway Setup. Note the gateway’s address and the provider slug, which matches the name in the AI Provider column.
2. Send a request to the gateway instead of the provider:

curl https://<your-ai-gateway-fqdn>/v1/chat/completions \ -H "Content-Type: application/json" \ -H "x-ns-aig-apikey: <your-aig-token>" \ -H "x-ns-aig-slug: openai" \ -d '{"model": "gpt-4o", "messages": [{"role": "user", "content": "Hello"}]}'

• x-ns-aig-apikey carries the token you created in Phase 4.
• x-ns-aig-slug tells the gateway which provider to route to. To switch providers, change the slug and nothing else.
• If you didn’t set up virtual keys, also send the provider’s own credentials in the Authorization header.

The Gateway Setup page also shows the HTTPS and HTTP base URL for each provider, if you prefer to keep a separate base URL per provider.

For agents and SDKs, store the token in an environment variable and pass it in the x-ns-aig-apikey header on every call.