Netskope is a steering + policy factory. On-ramp, then stamps.

1. Why a green policy is not a session

Every other blog starts with Real-time Protection, DLP profiles and Inline CASB as three marketing boxes. That is why students freeze in interviews. The real object is the steered session. Features are only stamps the factory puts on a ticket after NewEdge has the bytes.

Official steering overview: Steering Configurations control what kind of traffic gets steered to Netskope for real-time deep analysis and what kind of traffic gets bypassed. The Netskope Client, a GRE or IPSec site tunnel, or Cloud Explicit Proxy is how those bytes arrive. Real-time Protection, SSL Decryption and DLP all live in the tenant. None of them fire on traffic the on-ramp never sent.

Hero · the factory floor

2. Mental model — on-ramp plus three stamps

Hold four parts. Interviews fail when people mix them.

Path · four stations

Hard words, before the runbook

3. Factory flow — steer, then stamp

The first packet of a new conversation has no Skope IT row yet. It must survive the on-ramp, land on NewEdge, pass SSL Decryption, then walk Real-time Protection. Later packets of the same TLS session ride that steered path. That is why “I added a rule” sometimes does nothing until the Client checks in, Apply Changes is clicked, or the old GRE/IPSec SA dies.

4. How to choose the on-ramp and stamps

You are not choosing a product SKU in a slide. You are choosing how the factory is allowed to receive the ticket, and what it is allowed to write on it.

Official bias, word for word in spirit: use SSL Bypasses over Steering Bypasses whenever possible. Excessive steering bypasses expose the organisation. Netskope already maintains a certificate-pinned application exception list under the Steering Configuration → Exceptions tab. Source: Add Bypasses in Netskope.

5. Runbook Side A → B → C

Lab values only. Tenant lab.goskope.example, user finance.user@lab.example, group Finance-IN, laptop 192.0.2.25, GRE/IPSec source 203.0.113.10, SaaS saas.example.test, file q3-payroll.xlsx. Nothing here is a live tenant. Confirm syntax on the current docs.netskope.com page before you type on a real box.

Side A — build the on-ramp (the factory floor)

Primary source: Steering Configuration + Creating a Steering Configuration + GRE / IPSec / Cloud Explicit Proxy. Pick one on-ramp for the pilot. Mixing Client with GRE on the same path is how Internet Security goes Backed Off.

1. Trust the Signing CA before you decrypt anything

   Settings → Manage → Certificates → Signing CA. Download the Netskope Root and intermediate CA. Push with MDM/GPO to the OS store. Firefox NSS and some Java keystores are separate. The Client installs the CA automatically on managed devices. GRE/IPSec/explicit do not — you distribute the file. Cert warnings on every site after go-live is a Side A miss, not a POP outage.

2. If the pilot is a managed laptop — Client Configuration + Steering Configuration

   Settings → Security Cloud Platform → Netskope Client → Client Configuration. Assign the pilot OU / group only. Enable On-Premises Detection if you will use Dynamic Steering. Then Settings → Security Cloud Platform → Steering Configuration → New Configuration. Name cannot exceed 40 characters. Match Criteria: User Group = Finance-IN (R124+ also OS Family, R134.0.5 also Device Tags). Traffic Steering tab: Off-Premises = Web Traffic (needs SWG). On-Premises = Cloud Apps Only if the branch NGFW already inspects web. Status: leave Disabled until steered items and exceptions exist. Source: Creating a Steering Configuration.

3. If the pilot is a branch you cannot install on — GRE or IPSec site

   Settings → Security Cloud Platform → GRE → Create New → New GRE Site (or IPSec → New IPSec Site). Site Name LAB-DEL-BR01. Source IP Address = 203.0.113.10 (the exit public IP Netskope will receive). Primary Netskope POP = closest POP; Failover POP = second closest on a different release Day-N. Do not NAT endpoints inside the tunnel. Enable ICMP keepalive (official recommendation: probe every 20 seconds, retry 5 times every 6 seconds). IPSec is IKEv2 only, NAT-T required, PSK authentication. After the site is Up, choose identity: Client on the laptop, or provision the CA and accept user = unknown / IP unless SAML/explicit identity is designed. Source: Creating a GRE Site / IPSec.

4. If the pilot is a browser you cannot tunnel — Cloud Explicit Proxy

   Settings → Security Cloud Platform → Explicit Proxy. Download the sample PAC. Replace <Tenant Name>. Official return is PROXY eproxy-<Tenant Name>:8081 for http/https, else DIRECT. Do not proxy the IdP — leave the official commented dnsDomainIs(host, '.okta.com') pattern in place for your real IdP. Distribute the remote-user Root CA. SAML 2.0 via Settings → Security Cloud Platform → Forward Proxy → SAML. Only send HTTP/HTTPS. Source: Cloud Explicit Proxy.

5. Minimum exceptions, with a reason

   Steering Configuration → Exceptions → New Exception. Official recommended minimum: SSO login page (Steering Bypass — login.microsoftonline.com or *.okta.com / *.oktacdn.com), VPN gateways (domain + destination location), EDR callbacks as SSL Do Not Decrypt not a full steer-off. Certificate-Pinned Applications already has a vendor-maintained list. Source: Add Bypasses in Netskope.

Side B — SSL then Real-time Protection (printing the ticket, choosing stamps)

Primary source: SSL Decryption + Add a Policy for SSL Decryption + Configuring Real-time Protection Policies + Best Practices. Remember: SSL runs immediately after steering. Default is decrypt. RTP is top-down first match. DLP Alert + Continue is the official non-terminal exception. Netskope allows the activity by default if nothing matches.

1. Write SSL Decryption exceptions first

   Policies → SSL Decryption → Add Policy. Add Criteria: Category (Finance / Health), Domains (api.example.test — SNI, not CN/SAN; wildcards like *.example.com only), App, Access Method, OS Family (Client only). Action Do Not Decrypt for pinned APIs and banking. Action Decrypt is the default path for everything else you steer. New SSL policies are created disabled — enable them. Click Apply Changes. Source: Add a Policy for SSL Decryption. Do Not Decrypt still matches RTP with limited context; a Block RTP can still drop the flow without a user block page.

2. Create the DLP profile, then attach it — do not invent a bare rule

   Policies → DLP (profiles). Lab profile Finance-DLP-PCI. Then on the RTP policy, Add Profile → DLP Profile. Action Block. Optional: Set action for each profile if you attach more than one. Continue policy evaluation after match is only for Alert. Add Traffic Action is how you keep a Cloud App Allow when the DLP profile does not match. Source: Configuring Real-time Protection Policies · Profile & Action.

3. Place the policy in the official stack

   Threat → Utility → RBI → CASB → Web → NPA. Finance-SaaS-Upload sits in the CASB band, above any “allow Salesforce browse” web rule. Drag, then Apply Changes. If you forget Apply Changes, the Client and the POP are still running yesterday.

4. Apply Changes, then do not celebrate

   A green Apply Changes means the recipe printed. It does not mean Salesforce answered, and it does not mean the Client pulled Config Updated. Side C is the proof. Steering exceptions apply on the next Client check-in (official: about every 15 minutes).

NSKP-LAB> show client-config finance.user@lab.example
org=lab.goskope.example
gateway=gateway.lab.example pop=DEL1
user=finance.user@lab.example
client-configuration=LAB-Finance-Laptops
steering-configuration=LAB-Finance-Laptops
traffic-steering=web-traffic
on-premise=no
config-updated=10:40Z
internet-security=enabled last-event="Tunnel Up"

Say the word recipe. This tray/Configuration panel is what the laptop actually loaded. Compare it to the tenant. If Config Updated is still 08:12Z, “we changed it” is false. Source: Using Netskope Client · Configuration (Organization, Gateway, POP, Client Configuration, Steering Configuration, Traffic Steering Type, Config Updated).

Side C — prove the ticket in Skope IT

Primary source: Application Events + Page Events + Devices + Transaction Events. This is not the policy list. This is the printed ticket. Field-by-field night-shift version: Netskope evidence desk.

1. Baseline the on-ramp

   Client: Settings → Security Cloud Platform → Netskope Client → Devices. Internet Security Status, Last Event, Steering Configuration on View Details. GRE/IPSec: site Status Up, keepalive Seen. Explicit: a Page Event with Access Method = Explicit Proxy. Half of “it doesn’t match the doc” is a different Client train. Half of empty Skope IT is Backed Off because GRE is on the path.

2. Click Salesforce, upload the dummy file, then open Application Events

   Skope IT → Events & Alerts → Application Events. Filter user finance.user@lab.example and app Salesforce. You need Access Method = Client (or GRE / IPSec / Explicit Proxy — the on-ramp you built), Action, Policy Name = Finance-SaaS-Upload, and if the file was the point, DLP Profile Name = Finance-DLP-PCI.

3. Read the stamps on the row

   Allow + empty DLP Profile Name on an Upload means you never attached the profile. Block + Finance-DLP-PCI means the factory succeeded. Browse activity with Action Alert may not generate an alert — official caveat. Page Events is a different table (heuristic browse, Total Bytes, Bypass Traffic); it is not a second Application Event.

4. If Skope IT is empty, do not add a rule

   Check Devices / GRE / PAC / Steering Bypass / traffic mode None. That is the evidence desk, not a missing Cloud App Access policy.

Proof · Skope IT cockpit

NSKP-LAB> show app-event user=finance.user@lab.example
time=10:42:18Z app=Salesforce activity=Upload
access_method=Client user=finance.user@lab.example
url=https://saas.example.test file=q3-payroll.xlsx
action=block policy=Finance-SaaS-Upload
dlp_profile=Finance-DLP-PCI ssl=decrypt
pop=DEL1

NSKP-LAB> show page-event user=finance.user@lab.example
time=10:42:02Z site=saas.example.test
access_method=Client total_bytes=18440
bypass_traffic=no

6. Runtime — decrypt, first-match, backoff

After the on-ramp is up, later packets of the same TLS session stay on NewEdge. Official SSL Decryption: policies are applied right after traffic is steered. By default all steered traffic is decrypted, then further analysed via Real-time Protection. Do Not Decrypt still matches RTP with limited context. A Block RTP on a Do Not Decrypt flow generates a Skope IT alert; a user block page is not sent.

Real-time Protection is sequential. When traffic matches rule conditions, the action applies without further processing — all policies are terminal except DLP policies set as Alert and Continue. If you enable Continue policy evaluation after match and several DLP profiles fire, the DLP incident lists every matched profile; the alert uses the last matched policy as Alert Name and lists all Policy Names; Action is the last non-Alert action, or None if every match was Alert. Source: Configuring Real-time Protection Policies.

Inline CASB is not a second engine. It is Real-time Protection with Destination = Cloud App or App Instance plus Activities. Upload / Download / Post are the stamps students skip. A Cloud App Allow with no Activity constraint is “any activity.” A Web Access category allow below a CASB Block still never sees the upload — first match already left the list.

The Client is not a mute pipe. Official Using Netskope Client: Internet Security Status is the tunnel that forwards Cloud Apps, Proxy and Firewall. Last Event Tunnel Up = Enabled. Tunnel down due to GRE / IPSec / Secure Forwarder / Data Plane on-premises = Backed Off. Admin selecting steering mode None also sends Admin Disabled / Backed Off for Dynamic Steering tenants. Creating a Steering Configuration: you can tell the Client to Steer or Not Steer private apps when GRE, IPSec or Explicit Proxy is already present. Mixing on-ramps without that decision is how a laptop “has the Client installed” and Skope IT stays empty.

GRE and IPSec are stateful. Official: during planned POP maintenance the tunnel goes down and comes up briefly. You must configure a failover tunnel on a different Day-N POP; failover happens on your gateway, outside Netskope’s control. Traffic from the same user must stay on the same tunnel — do not load-balance one endpoint across two GRE/IPSec sites. High-capacity GRE (3/5 Gbps) and IPSec (1/2 Gbps) are licensed, primary+failover only, and a source-IP change needs a maintenance window.

Cloud Explicit Proxy identifies users with cookies after SAML. Official: do not send the IdP request/response to Netskope. Firefox Enhanced Tracking Protection can break the cookie surrogate. Unauthenticated traffic from unknown locations must authenticate unless you Allow listed source egress IPs. Access Method on the Page Event is Explicit Proxy — that is the stamp that proves this on-ramp, not Client.

7. Traps + Skope IT proof

Related: Blog 2 · Evidence desk — first tool + proof field · Architecture & steering · Next Gen SWG / Real-time Protection · Inline + API CASB · DLP deep-dive · Netskope hub

Sources

• Steering Configuration — Settings → Security Cloud Platform → Steering Configuration; Cloud Apps Only / All Traffic behaviour; OU vs user-group conflict order; log bypassed traffic
• Creating a Steering Configuration — New Configuration, Match Criteria, Dynamic Steering, Cloud Apps Only / Web Traffic / All Traffic / None, Private App Segments, Fail Close, exceptions before Enable
• Choose a Traffic Steering Method — Client, IPSec, GRE, Explicit Proxy, Proxy Chaining; CASB vs SWG steering modes
• GRE and Creating a GRE Site — Settings → Security Cloud Platform → GRE; Source IP Address; Primary / Failover POP; no inner NAT; keepalive 20 / 5 / 6; MSS
• IPSec — Settings → Security Cloud Platform → IPSec; IKEv2 only; NAT-T; DPD 20 5 6; Source Identity; recommended AES-256-GCM
• Cloud Explicit Proxy — Settings → Security Cloud Platform → Explicit Proxy; PAC PROXY eproxy-<Tenant Name>:8081; do not proxy the IdP; Access Method = Explicit Proxy
• SSL Decryption and Add a Policy for SSL Decryption — applied right after steering; default decrypt; Do Not Decrypt; Apply Changes; new policies start disabled
• Add Bypasses in Netskope — Steering Bypass vs SSL Bypass; prefer SSL; SSO / VPN / EDR recommended set; Exceptions → New Exception
• Real-time Protection and Configuring Real-time Protection Policies — New Policy templates; Source / Destination / Profile & Action; DLP Alert + Continue
• Best Practices for Real-time Protection Policies — top-down first match; Apply Changes; default allow; Threat → Utility → RBI → CASB → Web → NPA
• Using Netskope Client — Internet Security Status; Last Event Tunnel Up / Backed Off (GRE, IPSec, Secure Forwarder); Configuration panel (Gateway, POP, Steering Configuration, Config Updated)
• Devices — Settings → Security Cloud Platform → Netskope Client → Devices; Internet Security Status, Last Event
• Application Events — Skope IT → Events & Alerts → Application Events; Policy Name, Action, DLP Profile Name

Related: Blog 2 · Netskope evidence desk · Architecture & steering · Next Gen SWG · Inline + API CASB · DLP deep-dive · Private Access (NPA) · Netskope hub

Dummy lab data only. Confirm live syntax, permissions and privacy rules on the production release before you type on a real tenant.