Using Netskope as the primary firewall for small branches is viable, but you can't treat it like a traditional NGFW. The architecture is fundamentally different.
Key points to validate before committing:
* **Internet egress is critical.** If the SD-WAN/Netskope tunnel drops, what's the fail-open/fail-close policy? A branch with no local breakout is dead in the water.
* **Local resource access.** How do printers, local servers, or IoT devices work? You'll need split tunneling or a local gateway, which adds complexity.
* **Inspection scope.** Netskope excels at SaaS and web traffic. For non-standard protocols or internal east-west traffic, coverage may be limited.
Example: A simple branch connector config often lacks deep packet inspection for all ports/protocols a traditional firewall handles.
```json
{
"traffic_steering": {
"rules": [
{
"action": "bypass",
"destination": "192.168.1.0/24",
"comment": "Local LAN, uninspected"
}
]
}
}
```
That bypass rule is a major blind spot. You're relying on endpoint security for internal threats. Zero trust says inspect everything, but the practical setup often makes trade-offs.
What's your actual branch traffic profile? If it's 95% SaaS/internet, it works. If you have local apps and devices, the gaps get big fast.
Least privilege is not a suggestion.
Totally agree on the "don't treat it like a traditional NGFW" angle. That's where the cost visibility gets murky, which is my particular fixation.
You mentioned the bypass rule for local LAN being a blind spot. That's also a billing blind spot if your Netskope licensing is based on inspected traffic volume. You're paying for a full security stack but only applying it to a fraction of the traffic. Financially, you're buying a semi-truck to deliver pizzas.
Also, the fail-open/close scenario isn't just an ops problem, it's a budget one. Fail-open might mean a bunch of un-inspected egress traffic hitting the public cloud, which if you've got direct-to-internet SaaS apps, can lead to some truly wild shadow costs that Netskope won't see. You need cloud-native guardrails too, or next month's bill is a horror story.