Local Brokers extend Netskope Private Access (NPA) into customer-controlled environments, enabling secure, policy-based access to private applications alongside Cloud Brokers in a unified ZTNA architecture. This document explains how to enable, deploy, and administer Local Brokers.

Definitions

Client Gateway: Netskope Client builds a TLS tunnel with the closest Client Gateway located in one of the several Netskope Data Centers. This is where policy is enforced.

Publisher Gateway (Stitcher): Publisher builds a TLS tunnel with the closest Publisher Gateway (Stitcher) located in one of the Netskope Data Centers. This is a gateway for the Publisher to connect to the Netskope Cloud. Publisher Gateway (Stitcher), as the name suggests, stitches connectivity between the Client Gateway and the Publisher.

Cloud Broker: The combination of NPA components: Client Gateway and Publisher Gateway (Stitcher) enable end-to-end connectivity over NPA in the cloud.

Local Broker (LBR): The combination of NPA components: Client Gateway and Publisher Gateway (Stitcher) enable end-to-end connectivity over NPA, but is deployed in customer-owned environments. Local Brokers are Netskope software components that enable ZTNA capability (similar to the Netskope Cloud) within your environment. They can be deployed in your virtual network at your public cloud provider (like AWS VPC), or an internal network in your private datacenter supported on VMware ESXi, or any Ubuntu-based Linux system (including VM in the cloud). The Local Broker instance is hosted in a customer-controlled environment, with both Client Gateway and Publisher Gateway (Stitcher) running as containers on this instance, offering similar capabilities to a Cloud Broker.

Local Broker’s Client Gateway: Similar to Client Gateway, except that it is installed as a container on the Local Broker instance deployed in a customer owned/controlled environment. When Local Broker is enabled, Netskope Client will connect to the Client Gateway container with an IP that is assigned during the installation of Local Broker.

Local Broker’s Publisher Gateway (Stitcher): Similar to Publisher Gateway (Stitcher), except that it is installed as a container on the Local Broker instance deployed in a customer owned/controlled environment. When Local Broker is enabled, Publisher will connect to the Publisher Gateway (Stitcher) container with an IP that is assigned during the installation of Local Broker.

Common Use Cases and Deployment Scenarios

Local Broker enables NPA traffic to be directed through customer-controlled gateways based on specific criteria, where access policies are enforced when users connect to private applications.

The solution supports multiple deployment models, including a Consolidated model with a single Local Broker instance serving multiple locations, a Distributed model with multiple Local Broker instances across different geographic locations, and a Load Balanced model with multiple instances behind a load balancer for high availability.

Universal ZTNA encompassing Cloud and Local Broker

Local Brokers address these scenarios and use cases, enabling universal connectivity supporting:

Campus ZTNA: Securely connect headquarters employees to highly sensitive, on-premises servers. Local Brokers keep internal traffic local, eliminating the need to “hair-pin” data out to an external cloud broker and back.
Branch ZTNA: Enable workers in branch or regional offices to connect directly to corporate private applications. Deploying a local broker on-site or in a nearby hub maintains optimal performance and low latency for regional teams.
Remote User Access:
- Connect remote employees to a local broker hosted in a nearby regional data center rather than a distant cloud broker, significantly reducing latency.
- Provide secure access and optimal performance for users in regions without cloud brokers by connecting to a locally deployed broker, avoiding long-distance network paths.
Disaster Recovery: Ensures continuous employee access to critical internal systems via local brokers if external internet connections or primary cloud brokers experience an outage.
Direct access to Cloud: Provide on-premises users with direct, secure, and highly performant access to private applications hosted within your customer-managed IaaS environments, such as AWS or Microsoft Azure.

Important
Local Broker is not officially supported for use in deployments within China.