Your company has a Symantec BlueCoat proxy on-premises and you want to deploy Netskope using proxy chaining. Which two prerequisites need to be…

In a proxy chaining deployment, the on-premises proxy (Symantec BlueCoat) forwards traffic to the Netskope cloud proxy. For this architecture to be effective, Netskope must have visibility into the original traffic source and its content.

First, the on-premises proxy must be configured to insert the original client's IP address into the X-Forwarded-For (XFF) HTTP header. Without this, Netskope would only see the IP address of the on-premises proxy, preventing accurate logging and the application of source IP-based policies.

Second, to inspect encrypted HTTPS traffic for threats, data loss (DLP), and granular application control, SSL decryption must be enabled within the Netskope platform. This is a fundamental requirement for a Security Service Edge (SSE) solution to be effective.

A. Disabling SSL decryption would prevent Netskope from inspecting encrypted content, defeating a primary purpose of the deployment and severely limiting its security capabilities.

B. Disabling the X-Authenticated-User header (or a similar mechanism) would prevent Netskope from identifying the specific user, making user-centric policies and reporting impossible.

1. Netskope Official Documentation

"Proxy Chaining": This document outlines the prerequisites for a proxy chaining deployment. It explicitly states

"To get the end-user source IP address

you must configure your on-premise proxy to insert the IP address in the X-Forwarded-For header." This directly supports the requirement for the XFF header (Option D). The document also notes the need for a header to carry user identity

making the disabling of such a header (Option B) incorrect.

(Note: Specific document ID or direct link is available via the Netskope Support Portal to registered customers and partners.)

2. Netskope Official Documentation

"SSL Decryption": This guide explains the critical role of SSL decryption. The overview section states

"Netskope recommends decrypting all of your traffic to get the most out of the Netskope platform... Without SSL decryption

Netskope has limited visibility into the traffic and cannot provide protection against cloud threats or prevent data loss." This establishes enabling SSL decryption (Option C) as a core prerequisite for an effective security posture.

(Note: This content is part of the standard platform documentation available on the Netskope Support Portal.)