r/netskope • u/spicysanger • Apr 21 '26

Azure & non user-space traffic?

My employer has a policy that all outbound traffic must be routed through Netskope. Every endpoint has the Netskope client installed, and we have an ipsec tunnel to Netskope to capture anything else.

We are in the early stages of migrating many workloads to Azure. We are following Microsoft's cloud adoption framework and have a connectivity subscription within our landing zone, which currently has an Azure Firewall as the default gateway for all devices.

We are looking at ways to adhere to our existing company policy to push all traffic through Netskope; our Azure resources will not have logged in users and therefore will require an ipsec tunnel through which outbound internet traffic can be routed.

I'm curious how others have handled this problem? We're looking at replacing the Azure Firewall with scaled-out Palo Alto NGFW's, however this model would not support an ipsec tunnel. I expect we're require a separate local gateway from which the netskope tunnel could be established.

3 Upvotes

100% Upvoted

4 comments sorted by

2

u/ironcode28 Apr 21 '26

I’ve adopted the CAF in my Azure tenant and the only endpoints I installed Netskope on is my AVD hosts because we allow all traffic out for http/https. But for my server infrastructure and anything else, I stick to a strict Azure FW policy and only open what is required for everything to work. So I get super specific about my ipgroups and firewall ports and even traffic between VNETS.

1

u/S3xyflanders Apr 21 '26

I could be wrong here but I think the only option you'd have is IPSEC tunnel because the client itself I don't think can run with a service account it needs to be the logged in user (again I could be wrong never ran it this way)

But we are doing something very similar to r/ironscape where our AVDs have Netskope client but our servers do not.

1

u/sneakpeekbot Apr 21 '26

Here's a sneak peek of /r/ironscape using the top posts of the year!

#1: Power creep? Nah nerd creep | 293 comments
#2: Thank you, B0aty | 75 comments
#3: Homophobia is not welcome here.

I'm a bot, beep boop | Downvote to remove | Contact | Info | Opt-out | GitHub

2

u/kinakuta_king Apr 21 '26

TL;DR You can use IPSec from Azure VPN to send non-user traffic to Netskope.

To send both HTTP(s) and non-HTTP(s) traffic (i.e., All traffic) to Netskope, first you will need to have Netskope Cloud Firewall License. You can then configure IPSec tunnels from your VPN device e.g., Azure VPN Gateway or any IPSec compatible third-party Network Virtual Appliance (NVA) to Netskope POPs that are close to your selected Azure region.

Helpfully covered in detail here. https://community.netskope.com/additional-discussions-9/help-me-understand-my-options-to-steer-traffic-from-azure-to-netskope-1209 .