I've been conducting a rather extensive evaluation of Netskope's ZTNA client (version 97.x and now 98.x) within our event-driven microservices development environment, which is predominantly operated on Apple Silicon Macs (M2 and M3 Pro). Since the last two client updates, we've observed a pattern of persistent and problematic behavior that seems to correlate directly with the architecture transition.
The core issue manifests as intermittent but severe latency in tunnel establishment, specifically when the client attempts to broker connections to our internal API gateways and event brokers. This isn't merely a slow connection; the client process (`netskope`) occasionally enters a state where it consumes disproportionate CPU cycles (often 100%+ of a single core) while seemingly stuck in a handshake loop. The operational symptoms include:
* Timeouts in `curl` and programmatic REST calls to internal endpoints, despite a "Connected" status in the UI.
* Delayed or completely failed webhook deliveries from our internal systems to external SaaS partners, which we route through the ZTNA tunnel for security inspection.
* Inconsistent behavior across the team; some Macs will work for hours, then degrade, while others fail immediately post-login.
We've ruled out baseline network issues and have conducted packet captures. The logs (with appropriate verbosity enabled) show repetitive cycles of DTLS tunnel setup attempts, followed by what appear to be cryptographic handshake realignments. This leads me to hypothesize an incompatibility with the compiled binaries or low-level network stack integration on ARM64 macOS.
Has anyone else in the community undertaken a deep dive on this? I'm particularly interested in:
* Any observed differences in the network extension or system extension behavior between Intel and Apple Silicon Macs under Netskope.
* Formal or informal workarounds, such as specific client configuration parameters (e.g., `"tunnel_mode"` or `"dtls_parameters"`) that might mitigate the handshake thrashing.
* Whether reverting to a specific prior client version (94.x, for instance) provides stable relief, as this would strongly point to a regression in the recent releases.
Our team is currently maintaining a parallel VPN connection for critical CI/CD pipelines, which defeats the purpose of our ZTNA pilot. Any shared insights or diagnostic comparisons would be invaluable.
API whisperer
We're seeing something similar on our M1 service desk machines. Not as detailed as your API gateway problem, but definitely that high CPU state when connecting to our internal IT asset system. Has anyone tried rolling back to version 96.x as a comparison? Curious if the problem started then.
That high CPU state when connecting is something I've heard whispers about too, though it's not on my current team. Your point about the webhook deliveries failing is particularly worrying; that kind of silent breakage in automated workflows is a nightmare to trace. Have you been able to correlate the CPU spikes with any specific logging output from the client, or is it pretty opaque?