Netskope steering-method explainer

The methods, and what each costs

1. Endpoint clientfits

   The endpoint agent is the recommended method for end-user traffic, and the only one that carries user identity and device posture with the flow rather than inferring them. It follows the user off the corporate network, which a tunnel from a site cannot do.

   • It has to be deployed and kept current on every device, which is an endpoint-management problem before it is a security one.
   • Steering exceptions live on the client, so a device that has been tampered with is a device whose exceptions you no longer control.
2. IPsec tunneldoes not apply here

   A tunnel steers a site. It cannot follow a user who is not at that site.

   • It knows the site, not the person. User identity has to come from somewhere else - commonly the client deployed alongside it purely to provision certificates and identify the user.
   • Build at least two tunnels to different data planes. One tunnel is a single point of failure for an entire site.
3. GRE tunneldoes not apply here

   A tunnel steers a site. It cannot follow a user who is not at that site.

   • Unencrypted on that hop, so it belongs only where the path is genuinely trusted.
   • Same identity gap as IPsec: it knows the site.
4. Explicit proxypossible

   Point the browser or the operating system at the service and traffic goes there without an agent or a tunnel. It is the method for legacy and regulated environments, and for cases where policy-based routing cannot be configured.

   • It steers what is configured to use it, and nothing else. An application that ignores proxy settings is simply not steered, and nothing will tell you so.
   • It is a per-application or per-system setting, which means it is a per-application or per-system failure.
5. Proxy chainingdoes not apply here

   There is no existing proxy to chain from. Introducing one to enable this would be adding a hop in order to have a hop.

   • The first proxy is still in the path and still yours to run, patch and troubleshoot. Two proxies fail in more ways than one.
   • Treat it as a phase rather than a destination, and record what would end it.

Worth knowing

• Steering decides what the edge can see. Everything downstream - inspection, data protection, policy - is limited by what arrived, and a connected client or an established tunnel is one checkpoint rather than proof that a particular request was inspected.
• A steering bypass and a do-not-decrypt rule are different things. The first means the traffic never reaches the service; the second means it arrives and is not opened. Certificate-pinned applications usually need the first, and confusing them produces a policy that looks applied and never ran.