Overview
This integration redirects all public GenAI traffic to F5 Workforce AI Security through Netskope proxy chaining. Netskope also calls this Forward-to-Proxy. A custom URL category defines the GenAI traffic. Netskope sends this traffic through its proxy system. The proxy system then forwards it to the Workforce AI Security Proxy before it reaches the final destination.
Both Netskope and Workforce AI Security log the traffic. You can use either platform to troubleshoot or analyze it.
The policy redirects public GenAI access to Workforce AI Security for every user whose traffic matches it. Make sure you understand this redirect before you set up the integration. These users must first authenticate with single sign-on (SSO). Only then can they use any GenAI service that Workforce AI Security governs.
For proof-of-concept or pilot deployments, set specific criteria in the Netskope Real-time Protection policy. This redirects traffic for a subset of users or groups. Most organizations use user groups during limited deployments. They then expand the policy to all users for production.
Prerequisites
Before you configure Netskope, distribute the SurePath AI Root CA to endpoints. Also gather the information that you need from the Workforce AI Security platform.
Distribute the root certificate to endpoints
Workforce AI Security recommends that you distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority (CA). Do this before you begin the Netskope configuration. The configuration steps also install the certificate in the Netskope store of trusted CAs. Distribute the certificate directly to endpoints as well, to add protection against certificate trust errors.
Suppose you exempt any services or domains from TLS decryption in Netskope. Workforce AI Security then presents its certificate directly to end users when they use those GenAI services. The endpoint might not have the SurePath AI Root CA in its trusted certificate store. Without the certificate, users might see certificate trust errors or warnings in their browsers or applications. If you distribute the certificate to endpoints, you avoid these errors. The certificate works regardless of which services Netskope decrypts and which services Workforce AI Security decrypts.
To download and distribute the certificate:
In CONFIGURE, go to Organization > Integration.
Select the certificate format for your endpoint operating systems.
Select DOWNLOAD CERTIFICATE.
Distribute the SurePath AI Root CA with your existing certificate deployment tools. Examples are Group Policy, mobile device management (MDM) platforms, and endpoint management tools.
Gather configuration information
Collect three items from the Workforce AI Security platform for the Netskope steps. The first is the proxy address that Netskope forwards traffic to. The second is the curated list of GenAI sites. The list defines which domains to redirect. The third is the Workforce AI Security certificate for the Netskope store of trusted CAs.
Proxy address
The Workforce AI Security proxy address is the hostname that Netskope uses as the destination for forwarded GenAI traffic.
To copy the proxy address:
In CONFIGURE, go to Organization > Integration.
Copy the proxy URL value and save it for the proxy configuration step in Netskope.
Public Services catalog
Workforce AI Security maintains a curated list of GenAI sites on the public internet. The list includes vendor names and associated risk levels. You download it in Netskope-compatible format. Then you import it into Netskope as a Destination Profile.
To download the catalog:
In GOVERN, go to Public Services.
Select DOWNLOAD CATALOG.
In the download format list, select Netskope Config.
Select DOWNLOAD to save the file.
The downloaded file has a name similar to workforce-ai-security-public-services-netskope-YYYY-MM-DD.txt. Don't add URLs to this file. If the catalog needs new sites, contact your Workforce AI Security technical representative for guidance.
Certificate
You download the Workforce AI Security certificate now. You install it in the Netskope store of trusted CAs during the configuration steps. With the certificate installed, Netskope trusts the TLS inspection of Workforce AI Security. The certificate also prevents warnings when Workforce AI Security decrypts and inspects GenAI traffic.
To download the certificate:
In CONFIGURE, go to Organization > Integration.
Select the PEM format (required for Netskope).
Select DOWNLOAD CERTIFICATE.
Create the Netskope connector
Workforce AI Security uses the connector to identify inbound traffic from your Netskope deployment as trusted. The connector has its own X-Authenticated-User setting. This setting is separate from the X-Authenticated-User setting in the Netskope admin console, and you turn on both.
To create the connector:
In CONFIGURE, go to Connectors.
Select ADD CONNECTOR.
Enter a name such as
Netskope Connectorin the Name box.Select Netskope from the Network Ingress section of the Type list.
Turn on Enable X-Authenticated-User Header.
Select SAVE.
Understand the X-Authenticated-User header
The X-Authenticated-User (XAU) header identifies the end user for Workforce AI Security. The user sees no SSO authentication prompt.
How the X-Authenticated-User header works
When Netskope forwards traffic to the Workforce AI Security proxy, Netskope can insert the X-Authenticated-User header into each request. The header contains the username of the end user whose traffic is proxied. Workforce AI Security validates that the traffic comes from a trusted Netskope connector. Workforce AI Security then links the user's identity to their GenAI activity. Users need no additional authentication step.
Header requirements
This integration requires the XAU header. Without XAU, the system sends users to an SSO authentication page the first time they use any GenAI service that Workforce AI Security governs. The system caches this authentication for a period of time. If you turn on XAU, users skip this requirement.
Netskope configuration steps
Open the Netskope admin console
Log in to the Netskope admin console with the URL of your organization. The URL follows the format https://<yourorgname>.goskope.com/ns#/dashboard.
Create the Destination Profile
The Destination Profile holds every hostname and domain from the Workforce AI Security Public Services catalog. The custom URL category references this profile in later steps.
To create the Destination Profile:
Go to Policies.
Under PROFILES, select Destination.
Select New Destination Profile.
Enter a descriptive name. These instructions use
WorkforceAISecurityas the example name throughout.Under Match Type, confirm that Exact is selected.
Under Definition, select TXT to upload the Workforce AI Security Public Services file that you downloaded earlier (named similar to
workforce-ai-security-public-services-netskope-YYYY-MM-DD.txt). Or paste the hostnames directly into the text box (one host per line).Select Save.
The Destination Profile now appears in the list of configured Destination Profiles. The profile has more entries than the catalog has services. Some GenAI services require multiple hostnames to capture all relevant traffic.
Create the custom category for uniform resource locators
The custom URL category groups the Destination Profile into a reusable object. You can reference this object in Netskope policies. The category defines which traffic counts as GenAI traffic for the forwarding policy.
To create the custom URL category:
Go to Policies.
Under PROFILES, select Custom Categories.
Select New Custom Category.
Enter a descriptive name, such as
WorkforceAISecurity.In the Destination Profile (Include) box, select the Destination Profile that you created in the previous step.
Select Save.
The custom category now appears in the list of configured custom categories.
Add the certificate to Netskope
Install the Workforce AI Security root certificate in the Netskope store of trusted CAs. With the certificate installed, Netskope trusts the TLS inspection of Workforce AI Security. The certificate also prevents warnings for end users when Workforce AI Security decrypts and inspects GenAI traffic.
To add the certificate:
From the Netskope home page, select Settings. The page opens in a new window.
Go to Manage > Certificates.
Select New Trusted CA.
In the File Name box, enter a descriptive name to display in the UI, such as
WorkforceAISecurity.Select SELECT FILE.
Select the
.pemcertificate file that you downloaded from Workforce AI Security.Select VALIDATE to verify the certificate.
Select SAVE to complete the installation.
The certificate now appears in the list of Trusted CAs.
Create the proxy configuration
The proxy configuration defines the Workforce AI Security proxy as a forwarding destination for Netskope. The proxy settings include the hostname and port number that Netskope connects to when it forwards GenAI traffic.
To create the proxy configuration:
Open the Settings page from the Netskope home page.
Go to Manage > Forward to Proxy Integration.
Select Setup Proxy.
Enter a descriptive name, such as
WorkforceAISecurity.In the Host box, enter the proxy URL value that you copied earlier from the Admin UI.
Unless Workforce AI Security told you to use a different port number, enter
8080in the Port box.
Continue with the XAU configuration in the next section.
Configure the X-Authenticated-User header
When you turn on the XAU option, Netskope inserts the XAU header into every proxy request. The header passes the username of the end user to Workforce AI Security. Workforce AI Security validates that the traffic comes from a trusted Netskope connector. You create this connector in Create the Netskope connector. Workforce AI Security then links the user's identity to the traffic without an additional authentication prompt.
To configure the header:
Under OPTIONS, turn on the X-Authenticated-User option and the Tenant-Info option.
Save the settings.
Create the forwarding policy
The forwarding policy tells Netskope to redirect traffic that matches the custom URL category to the Workforce AI Security proxy. This policy turns on the integration and starts to redirect GenAI traffic.
To create the forwarding policy:
Go to Policies > Real-time Protection.
Select New Policy > Web Access.
Enter a descriptive name, such as
WorkforceAISecurity.Set the Source criteria:
For pilot or proof-of-concept deployments, set the criteria for specific test users or groups. This limits the policy to those test users or groups.
For production deployments, leave the criteria unrestricted to apply the policy to all users.
Under Destination, set Category to the custom category that you created earlier. To find the category faster, type
workforce.Under Profile & Action, set Action to Forward to Proxy.
Under Profile & Action, set Proxy to the proxy configuration that you created earlier.
Select SAVE.
The policy now appears in the policy list. Review and adjust the policy order within your overall policy structure. Position the Workforce AI Security forwarding policy before other AI-related policies, so that Netskope redirects GenAI traffic before other rules take effect.
Apply the configuration
To publish the changes and make the integration active, select Apply Changes. This option appears on most Netskope configuration pages.
Verification and troubleshooting
After you apply the configuration and deploy it to test users or groups, verify the integration with the Ready tool. Users whose traffic is redirected see successful results for certificate trust and for network configuration. If either test fails, check the Destination Profile and the custom category. Check the certificate installation and the forwarding policy too. Also confirm that the policy applies to the intended users.
Migrate from a list of uniform resource locators to a Destination Profile
If you configured this integration earlier with a URL list, you can migrate to Destination Profiles without disrupting the forwarding policy. The forwarding policy references the custom URL category, not the URL list. You update only the URL list and the custom category.
Download the latest catalog
Before you migrate, download an updated copy of the Workforce AI Security Public Services catalog. The new copy makes sure that the Destination Profile reflects the current list of GenAI services.
To download the catalog:
In GOVERN, go to Public Services.
Select DOWNLOAD CATALOG.
In the download format list, select Netskope Config.
Select DOWNLOAD to save the file.
Create the Destination Profile
To create the Destination Profile:
In the Netskope admin console, go to Policies.
Under PROFILES, select Destination.
Select New Destination Profile.
Enter the same name as the existing URL list, or enter a new descriptive name.
Under Match Type, confirm that Exact is selected.
Under Definition, select TXT to upload the newly downloaded Workforce AI Security Public Services file. Or paste the hostnames directly into the text box (one host per line).
Select Save.
Update the custom category for uniform resource locators
To update the custom URL category:
Go to Policies.
Under PROFILES, select Custom Categories.
Open the custom category that your forwarding policy uses.
Remove the existing URL list from the include list.
Add the new Destination Profile to the include list in its place.
Select Save.
Apply and verify
To apply the configuration and verify it:
Select Apply Changes to publish the updated configuration.
Verify that the integration still works with the Ready tool.
After you confirm that the migration works, you can remove the original URL list. Go to Policies. Under PROFILES, select URL Lists, and delete the list. The forwarding policy needs no changes during or after the migration.