Netskope Integration[old]

Netskope Integration

Configuring your Netskope to work with Lumia is easy!
To connect your Netskope tenant to Lumia, we first need your Netskope Tenant ID (a unique 5-digit number). Once we have it, Lumia will share your unique certificate file (.pem) and proxy URL with you.

Prerequisites:

HTTP/2 should not be enabled for your Netskope tenant. By default, Netskope supports HTTP/2 only if it has been explicitly enabled by their support team. We have previously experienced issues when using HTTP/2 in combination with proxy chaining. If HTTP/2 is enabled in your tenant, please contact us.

Step 1: Extracting Your Netskope Tenant ID

  • You can easily extract this from your nsconfig.json file, where it appears in the npa section near the end of the file:
...
"npa": {
"host": "gateway.US-SV5.npa.goskope.com",
"tenant": "ns-25396.US-SV5.npa.goskope.com",
"proxy": "ns-25396.us-sv5.proxy.npa.goskope.com",
"port": "443",
...
  • To access your nsconfig.json file, select Save Logs… from the Netskope client menu. This will generate a ZIP file containing your logs:
notion image

Step 2: Trusting Lumia’s CA Certificate

  • Login to your Netskope admin account (<yourcompany>.goskope.com)
  • Click on Settings to open the Settings screen
notion image
  • Click on Manage
notion image
  • Click On Certificates
notion image
  • Click on New Trusted CA
notion image
  • In FILE NAME enter “Lumia CA”
notion image
  • Click on SELECT FILE
notion image
  • Select the Lumia provided certificate file (.pem)
  • Click on VALIDATE
notion image
  • Click on SAVE
notion image

Step 3: Configuring a “Forward to Proxy Integration”

  • Click on Forward to Proxy Integration
notion image
  • Click on SETUP PROXY
notion image
  • In the PROXY NAME field, enter “Lumia Proxy”;
    • In the HOST field, enter the URL provided by Lumia;
    • In the PORT field, enter the port provided by Lumia (or 8080 if not provided);
    • Check the “X-Authenticated-User” option;
    • Check the “Tenant-Info” option;
    • In the X-AU-ENCODE-FORMAT, select None
notion image
  • Click on SAVE
notion image

Step 4: Creating a “URL List” and “Custom Category”

  • Make sure you are in the main Netskope dashboard; if continuing from the previous page, click on the Netskope icon at the left side of the screen
notion image
  • Click on Policies
notion image
  • Click on URL Lists
notion image
  • Click on NEW URL LISTS
notion image
  • In the URL LIST NAME field, enter “Lumia URLs”;
    • In the URL & IP ADDRESS field, enter:
    chatgpt.com
claude.ai
    (We will add the full list after the technical sanity check is complete.)
notion image
  • Click on SAVE
notion image
  • Click on Custom Categories
notion image
  • Click on New Category
notion image
  • In the Custom Category Name field, enter “Forward to Lumia”;
    • In the URL Lists, select the Lumia URLs category created in the previous step
notion image
  • Click on Save
notion image

Step 5: Configuring “Real-Time Protection” Policy

  • Click on Real-time Protection
notion image
  • Click on NEW POLICY
notion image
  • Select Web Access
notion image
  • In the Source field, specify users you want to forward their AI traffic to Lumia;
    • In the Destination field, select Category;
    • In the Category field, select Forward to Lumia created in the previous stage;
    • In the Action field, select Forward to Proxy;
    • In the Proxy field, select the proxy you create in the previous stage;
    • In the Policy Name field, enter “Forward to Lumia”
notion image
  • Click on SAVE
notion image
 
That’s it. Congratulations, you can now enjoy using Lumia!

Step 6: Commit and test

Once everything is configured, commit and push the changes you’ve made.
You can use https://check.lumiasecurity.com to make sure everything is working.
Â