Netskope Private Access (NPA)

I have been looking into Netskope Private Access (NPA) recently. Here is a quick summary of what I learned.

NPA is Netskope's ZTNA (Zero Trust Network Access) solution. It allows users to access private applications without giving them full access to the internal network.

VPN vs NPA

Traditional VPN normally connects the device into the company network:

User -> VPN -> Internal Network -> Application

NPA works differently:

User -> Netskope Client -> NewEdge -> Publisher -> Private App

The main difference is NPA gives access to the application, not the whole network.

For example, instead of allowing access to 10.0.0.0/8, we can only allow:

app01.internal
TCP 443

This reduces unnecessary network access.

Main Components

There are a few important parts:

• Netskope Client - installed on the user's device and steers the traffic.
• NewEdge - Netskope cloud network where policy and access are handled.
• Publisher - deployed inside the private network or cloud, close to the application.
• Private App - the internal application the user needs to access.

The Publisher makes an outbound connection, so normally we don't need to expose the private application directly to the Internet.

Conclusion

The naming ZTNA - Zero Trust Network Access can be a little confusing at first. It sounds like we are still giving the user access to a network.

But the main idea is actually more granular control at the application level, rather than exposing the whole internal network.

Traditional VPN is more like:

"You can enter this network."

ZTNA/NPA is more like:

"You can access this application because your identity, device and policy allow it."

So for me, the important part of ZTNA is not really the "network access". It is about reducing network exposure and only giving access to what the user actually needs.