Configuration > Cloud Services > Netskope
Netskope is a cloud security service. EdgeConnect traffic can be chained to Netskope for additional security inspection. Orchestrator supports IPSec tunnel mode for Netskope.
IMPORTANT: If you have Netskope running through Service Orchestration, you must take down the manual tunnels before enabling the API through the Configuration > Cloud Services > Netskope feature.
The following table describes the fields on the Netskope tab.
|Appliance||Name of the appliance to connect to Netskope.|
|Interface Label||Interface label for the interfaces you want to connect to Netskope.|
|Mode||Tunnel mode (IPSec) for Netskope.|
|Netskope Deployment Status||Status of the Netskope deployment (Creating, Pending, or Deployed). Deployed indicates successful deployment.|
|Netskope Service Edges||These are the Netskope endpoints to which the tunnels connect. This field is populated with discovered Public Service Edges based on the appliance’s geographical location.|
|Connection Status||Status of the Netskope connection based on tunnel and IP SLA statuses.|
Before you configure Netskope, you must create a Netskope account and ensure that you have an established connection with Netskope.
Go to https://docs.netskope.com/en/rest-api-v2-overview-312207.html and follow the steps to configure your Netskope account.
After configuring your Netskope account, navigate to Configuration > Cloud Services > Netskope.
The Subscription dialog box opens.
Enter the appropriate information to reflect your Netskope account.
The following table describes the fields.
Field Description Netskope Indicates whether you are connected to your Netskope account. API Token Name The API Token name you created when configuring Netskope. API Token Key The API Token key you created when configuring your Netskope account. Domain Domain provisioned in Netskope for your enterprise. Configuration Polling Interval Indicates how often Orchestrator should check for configuration changes in Netskope. The default polling interval is ten minutes.
Click Save. The Netskope field should indicate Connected.
Select the WAN interfaces you want to use for Netskope internet traffic. You can specify primary and backup interfaces as described below. If a primary interface is unavailable, Orchestrator will use a backup interface if specified. Optionally, you can specify secondary interfaces as well. In this case, the fallback order is primary, secondary, and then backup.
NOTE: When two ore more labels are configured and active at the same level (primary, secondary, or backup) new flows will be load balanced across the Netskope tunnels based on current available bandwidth for the label. Labels with more available bandwidth will receive more flows than labels with less available bandwidth.
Click the Interface Labels button on the Netskope tab.
The Build Tunnels Using These Interfaces dialog box opens.
Drag the interfaces you want to use from the right side of the dialog box to the Primary and Backup areas. The interfaces are grayed out until you move them into the areas.
If you want to specify secondary interfaces, click Show Secondary to display the Secondary area, and then drag the appropriate interfaces to this area.
WARNING: This is service affecting. Any changes to the interface selection can cause previously built tunnels to be deleted and rebuilt.
The Tunnel Settings button opens the Netskope Tunnel Setting dialog box, enabling you to define the tunnels associated with Netskope and EdgeConnect. Use Netskope defaults for tunnel settings defined by the system.
NOTE: You can configure General, IKE, and IPSec tunnel settings. Settings are automatically generated, but you can change them if you want to.
Configure IP SLA for Netskope tunnels. This configuration ensures tunnel connectivity and internet availability between Netskope and Orchestrator. If the tunnel cannot reach Netskope, the tunnel is considered DOWN.
Click the IP SLA button on the Netskope tab.
The Netskope IP SLA Configuration dialog box opens.
If all fields are dimmed, click Enable IP SLA rule orchestration.
Select an orchestrated loopback label from the Source Interface field.
Note: When IP SLA is enabled for Netskope, Orchestrator automatically sets the Monitor field to Ping and uses the IP SLA targets specified by Netkope in the RESTv2 API response. Each Netskope POP uses a unique IP SLA target. The auto-IP SLA target typically ends in
.216. For example,
Accept the default values for the remaining fields and click Save.
Orchestrator builds the tunnels.
The final step to configure the integration in Orchestrator is to associate EdgeConnect appliances to Netskope.
In the Orchestrator appliance tree, select one or more appliances to associate with Netskope.
Click the Netskope Association button on the Netskope tab.
The Netskope Appliance Association dialog box opens.
In the table, select one or more appliances you want to associate with Netskope, and then select the Add check box.
Select the Remove check box to remove Netskope association from selected appliances in the table.
Verify the changes, and then click Save.
When troubleshooting, you can click Pause Orchestration and then click Save to pause orchestration. To restart, click Resume Orchestration.
Finally, you need to select the Netskope service in at least one Business Intent Overlay Breakout Traffic Policy to steer traffic to it.
Navigate to the Business Intent Overlays tab in Orchestrator (Configuration > Overlays & Security > Business Intent Overlays).
Click the overlay that breaks out traffic to Netskope.
The Overlay Configuration dialog box opens.
Click the Breakout Traffic to Internet & Cloud Services tab.
Drag Netskope from the Available Policies column to the Preferred Policy Order column.
After Netskope is configured, deployment will begin automatically. Navigate to the Netskope tab to verify successful deployment. The Netskope Deployment Status column should have a green status of Deployed, and the Connection status column should have a green status of Up. The Connection Status column indicates the status of the Netskope connection based on tunnel and IP SLA statuses.
NOTE: Netskope is deployed and orchestrated for an appliance based on the Netskope Appliance Association dialog box. Business Intent Overlays (BIOs) are used to configure breakout internet policies to Netskope. This is used for automatic load distribution and failover.
You can also verify that your Netskope tunnels have been successfully deployed on the Tunnels tab. The Passthrough Tunnel column should list your Netskope tunnels, and the Status column should have a green status of up – active.
You can view the Audit Log to check for orchestration errors. Navigate to Orchestrator > Audit Logs and enter
Netskope in the search field above the table.