Netskope NewEdge BYOIP Integration Overview
This page outlines the technical and procedural information for using tenant-specific dedicated egress IP addresses (a BYOIP-adjacent model) with the Netskope NewEdge Security Service Edge (SSE) platform. Netskope does not document a classic “bring your own prefix” flow where your RIR-allocated block is originated under your ASN; instead, Netskope provisions customer-specific egress IP addresses from Netskope-owned NewEdge ranges and anchors your traffic to those IPs for SaaS allowlisting, IdP source-IP controls, and conditional-access use cases.
Provider Details
| Field | Information |
|---|---|
| Provider Name | Netskope |
| Website | Netskope Dedicated Egress IP Addresses (data sheet) | NewEdge Network overview | Security Cloud Platform Configuration (Dedicated Egress IP Footprint) | NewEdge IP ranges for allowlisting |
| ASN(s) | Global cloud delivered primarily from AS55256 (Netskope Inc) plus related NewEdge infrastructure prefixes registered with ARIN/other RIRs. |
| Regions Supported | Global NewEdge footprint (dozens of data centers; >70 regions) across North America, Latin America, Europe, Middle East, Africa, and Asia-Pacific. Typical POP countries include: US, Canada, Brazil, Mexico, Argentina, Chile, Colombia; UK, Ireland, Netherlands, Germany, France, Spain, Italy, Switzerland, Sweden, Norway, Denmark, Poland; UAE, Saudi Arabia, South Africa; India, Singapore, Hong Kong, Japan, Australia, New Zealand, and more. Exact DC list and DEIP availability are provided per-customer via Netskope design and support docs. |
| Support Contact | Netskope Support Portal | Contact Netskope (Sales & General) |
| Tech Article & Date | Netskope Dedicated Egress IP Addresses (data sheet) & Security Cloud Platform Configuration (includes “Dedicated Egress IP Footprint”). Community best-practice articles cover DEIP behavior and threat-protection use cases. |
| BYOIP Scope | Model: Tenant-specific Dedicated Egress IP Addresses (DEIP) sourced from Netskope-owned NewEdge ranges, reserved for a single customer tenant. Not classic BYOIP: The documented feature does not let you import your own RIR-allocated prefixes or originate them from your ASN. Instead, Netskope anchors your traffic to customer-specific IPs that can be allowlisted by SaaS/IdP/firewall policies. Use cases: IP-based SaaS allowlists, IdP source-IP controls, secure access to business-critical SaaS/IaaS, and blocking access from non-trusted locations. |
| Supported Versions | IPv4: Dedicated egress IP addresses are documented as IPv4 addresses from Netskope NewEdge ranges (for example 8.36.116.0/24, 8.39.144.0/24, 31.186.239.0/24, 162.10.0.0/17, 163.116.128.0/17). IPv6: NewEdge supports dual-stack connectivity in many regions, but explicit IPv6 “Dedicated Egress IP” entitlements are not clearly documented; confirm IPv6 DEIP availability with Netskope for your tenant. |
| Supported Services | DEIP is an add-on capability for traffic steered through the Netskope NewEdge cloud, including: – Next Gen Secure Web Gateway (SWG) – Cloud Firewall (FWaaS) – Zero Trust Network Access / Netskope Private Access (for some designs) – Traffic from Netskope clients, GRE/IPsec tunnels, and SD-WAN/partner integrations using NewEdge as egress. In all cases the goal is to present stable, tenant-specific source IPs to SaaS/IdP targets. |
Technical Requirements
| Requirement | Details |
|---|---|
| Prefix Size | No customer prefix import. Dedicated egress IPs are allocated from Netskope-owned ranges (for example 8.36.116.0/24, 8.39.144.0/24, 31.186.239.0/24, 162.10.0.0/17, 163.116.128.0/17) used by NewEdge data centers. When DEIP is enabled, Netskope assigns at least two IPv4 addresses per NewEdge data plane / region for your tenant; some tenants with Global DEIP report two per DC, resulting in large IP sets in big deployments. There is no customer-visible minimum prefix such as “/24 BYOIP”; the allocation model is per-IP from provider space. |
| ASN Ownership Required | No. You do not bring your own ASN for this feature. All dedicated egress IP addresses remain announced under Netskope’s ASN(s), primarily AS55256, as part of the NewEdge anycast infrastructure. |
| IRR / Route Objects | All BGP announcements, IRR objects, and RPKI/ROA management for DEIP ranges are handled by Netskope. Customers do not create or modify route/route6 objects for DEIP space. |
| ROA or LOA | Not required from the customer side, since the IPs remain owned and operated by Netskope. Some SaaS/IdP vendors may still request evidence when creating IP allowlists (for example, a screenshot of the Netskope portal listing your DEIP addresses); this is handled on a case-by-case basis rather than via formal RIR LOAs. |
| RIR Limitations | NewEdge IP ranges are drawn from Netskope’s allocations across ARIN/RIPE/APNIC and mapped to specific regions/data centers. Customers do not control which RIR their DEIP addresses are sourced from; selection is tied to the NewEdge POP placement and your licensed regions. |
Step-by-Step BYOIP Process (Dedicated Egress IPs)
Estimated Setup Time:Typically a few business days from ordering Regional/Global DEIP until addresses are visible in your tenant and SaaS allowlists are updated. IP allocation inside NewEdge is automated, but commercial approval and external SaaS/vendor allowlist changes can add latency.Tested By Us:Not yet
Dedicated Egress IPs on Netskope NewEdge (tenant-specific egress IPs from provider ranges)
Engage your Netskope account team to…
In the admin console, navigate to…
Netskope allocates dedicated IP addresses from…
Verify your assigned DEIP addresses in…
Coordinate with SaaS, IdP, and internal…
Follow Netskope guidance
use DEIP primarily for IP-based allowlisting and sensitive SaaS/IaaS access, and rely on shared NewEdge IPs/localization zones for generic web browsing to avoid unnecessary IP sprawl.
1
Engage your Netskope account team to…
Engage your Netskope account team to scope and purchase a Regional or Global Dedicated Egress IP (DEIP) license for your tenant (often as an add-on to SWG/SSE/SASE).
Step 0 of 0
Cost and Limitations
| Item | Details |
|---|---|
| Fees | Dedicated Egress IP is a paid add-on entitlement (Regional DEIP or Global DEIP) on top of core Netskope subscriptions. Pricing is not public; distributors and customers note that Global DEIP can become expensive because you receive multiple IPs per NewEdge DC (e.g., two IPs per data center, resulting in large dedicated IP sets). Confirm commercial terms with Netskope Sales or partners. |
| Bundled or Standalone | Offered as an add-on feature for Netskope SWG/SSE/SASE deployments. Technically integrated with the NewEdge network and used alongside: – Netskope clients (endpoint) – GRE/IPsec tunnel steering – SD-WAN and partner integrations DEIP is not sold as a standalone IP-transit or hosting service; it is always tied to Netskope’s cloud security platform. |
| Traffic/Peering Restrictions | – DEIPs are intended primarily for traffic that must present a stable, tenant-specific source IP (SaaS/IdP allowlists, critical business apps). – Netskope recommends using DEIP for allowlisting and leveraging NewEdge “localization zones” and shared IPs for generic browsing. – DEIP addresses cannot be aggregated by NOC/SaaS teams into a smaller arbitrary prefix unless you use the larger Netskope-published ranges; in many cases each IP must be allowlisted explicitly or via the documented NewEdge CIDR blocks. – As with all Netskope traffic, customers must comply with Netskope’s AUP and abuse policies. |
| Other Limitations | – Number of IPs and regions covered depend on your license (Regional vs Global) and the set of NewEdge DCs serving your users. – IP ownership stays with Netskope; organizations that require strict regulatory control over RIR WHOIS/RPKI in their own name may consider this “BYOIP-adjacent” rather than true BYOIP. – Some special environments (for example, GovCloud or region-restricted deployments) may use different IP pools or have different DEIP availability; these are documented in customer-only matrices. |