Netskope Integration

Netskope Integration

This guide will walk you through integrating your Netskope tenant with Lumia using Proxy Chaining. This configuration allows Netskope to route traffic from AI applications through Lumia’s engine for real-time inspection and governance.

Before You Begin

To complete this integration, you will need the following:
A. Your Netskope Tenant ID: A unique 5-digit identifier that Lumia requires to generate your unique certificate. Follow these steps to extract your Tenant ID:
  1. Open your Netskope client menu and select Save Logs…. This will save a ZIP file to your computer containing your configuration data.
    2. notion image
  2. Open the ZIP file and locate the file named nsconfig.json.
  3. Identify the 5-digit ID: Open the JSON file and scroll to the "npa" section. Your Tenant ID is the 5-digit number within the "tenant" or "proxy" strings.
...
"npa": {
"host": "gateway.US-SV5.npa.goskope.com",
"tenant": "ns-25396.US-SV5.npa.goskope.com",
"proxy": "ns-25396.us-sv5.proxy.npa.goskope.com",
"port": "443",
...
B. Your unique Lumia CA Certificate (.pem) and Proxy URL: These will be provided once Lumia has received and verified your Tenant ID.

Prerequisite: Disabled HTTP/2

To ensure a successful integration, HTTP/2 should not be enabled for your Netskope tenant, as Lumia’s proxy chaining does not currently support it.
By default, Netskope only supports HTTP/2 if it has been explicitly enabled by their support team. If you know that HTTP/2 is enabled in your environment, please reach out to your Lumia representative before proceeding so we can assist with the configuration.

Installation Steps

Step 1: Trust Lumia’s CA Certificate

  1. Login to your Netskope admin account (<yourcompany>.goskope.com)
  2. Click Settings to open the Settings screen
notion image
  1. Click Manage
notion image
  1. Click Certificates
notion image
  1. Click NEW TRUSTED CA
notion image
  1. In FILE NAME: enter “Lumia CA”
notion image
  1. Click SELECT FILE
notion image
  1. Select the Lumia provided certificate file (.pem)
  2. Click VALIDATE
notion image
  1. Click SAVE
notion image

Step 2: Configure a Forward to Proxy Integration

  1. Click Forward to Proxy Integration
notion image
  1. Click SETUP PROXY
notion image
  1. Configure the following:
    • PROXY NAME: Enter Lumia Proxy.
    • HOST: Enter the URL provided by Lumia.
    • PORT: Enter the port provided by Lumia (or 8080 if not provided).
    • Select the X-Authenticated-User checkbox.
    • Select the Tenant-Info checkbox.
    • X-AU-ENCODE-FORMAT: Select None
notion image
  1. Click SAVE
notion image

Step 3: Create a URL List and Custom Category

  1. Make sure you are in the main Netskope dashboard; if needed, click the logo in the top-left corner to return.
notion image
  1. Click Policies
notion image
  1. Click URL Lists
notion image
  1. Click NEW URL LISTS
notion image
  1. URL LIST NAME: Enter Lumia URLs.
  2. URL & IP ADDRESS: Enter the following domains:
    • chatgpt.com
    • claude.ai
💡
Note: To ensure a smooth integration, start with these two domains only. Once the technical setup is verified, Lumia will provide you with the complete list of AI domains to be added.
notion image
  1. Click SAVE
notion image
  1. Click Custom Categories
notion image
  1. Click New Category
notion image
  1. Custom Category Name: Enter Forward to Lumia.
  2. URL LISTS: Select the Lumia URLs list you created in the previous step.
notion image
  1. Click Save
notion image

Step 4: Configure Real-Time Protection Policy

  1. Click Real-time Protection
notion image
  1. Click NEW POLICY
notion image
  1. Select Web Access
notion image
  1. Configure the policy with the following settings:
    • Sourse: Specify the users or groups whose AI traffic you want to route to Lumia.
    • Destination: Select Category.
    • Category: Select Forward to Lumia (the category created in the previous step).
    • Action: Select Forward to Proxy.
    • Proxy: Select Lumia Proxy.
    • Policy Name: Enter Forward to Lumia.
notion image
  1. Click SAVE
notion image

Step 5: Activate and Verify

  1. To apply all configurations, click the Apply Changes button in the top navigation menu of the Netskope Admin Console.
    2. (Note: It may take a few minutes for the changes to propagate throughout the Netskope network).
  2. Once applied, use the Integration Validator at https://check.lumiasecurity.com to confirm that your traffic is correctly routed and SSL inspection is active.

Next Step

If the validator confirms a successful connection, return to our Getting Started guide and proceed to Step 1.2: Verify Integration to confirm that logs are appearing in your Lumia Portal.