Hey everyone! 👋 I was just diving into the Netskope ZTNA console this week, trying to optimize our remote work setup, and it got me thinking about a very specific scenario. We've been loving the security posture, but I'm a bit of a stickler for user experience and performance metrics—you know me, I can't help but compare every little setting to a feature matrix!
So here's my current puzzle: our team relies heavily on VoIP applications like Zoom, Teams, and a custom WebRTC platform for client calls. We've noticed that when the full tunnel is active for all traffic, call quality sometimes suffers, especially for users on less-than-ideal home networks. The latency and jitter introduced by routing everything through the ZTNA gateway can be a real conversation killer (literally!).
I want to configure split tunneling specifically for our VoIP traffic to keep media streams direct and preserve call quality, while still securing everything else. From what I've read in the docs, this should be possible with private application access and steering rules, but I'd love to hear from anyone who has actually implemented this.
My main questions for the community are:
* **Rule Granularity:** How are you defining the VoIP traffic? Are you using:
* Specific FQDNs (like `*.zoom.us`, `*.teams.microsoft.com`)
* IP ranges (though these can be dynamic for cloud services)
* Port/protocol combinations (UDP on certain high ports for RTP/STUN)
* Or the new "Application" based rules, if Netskope's CASB identifies them?
* **Performance Impact:** After setting this up, did you see measurable improvements in your call quality metrics (MOS score, latency, packet loss)? I'm planning an A/B test on this, of course!
* **Security Trade-offs:** What are the potential pitfalls? I assume we'd still want to inspect the signaling traffic (SIP, etc.) even if the media is bypassed. How are you ensuring that the split tunnel exception isn't creating a blind spot?
* **Real-world Workflow:** Any gotchas in the Netskope admin console when creating these steering rules? A step-by-step of your policy logic would be incredibly helpful.
I'm about to start my own configuration deep-dive, but I always find the community's hands-on reports more valuable than any vendor whitepaper. If you've been down this road, please share your setup and results!