You are troubleshooting an issue with users who are unable to reach a financial SaaS...

When a SaaS application enforces IP restrictions that block traffic originating from Netskope’s egress IP ranges, the traffic must be routed through a corporate egress point whose IP is whitelisted by the SaaS vendor. Netskope Private Access (NPA) supports a feature called Source IP Anchoring, which routes NPA traffic through a designated Publisher installed on-premises, allowing the traffic to egress from the corporate data center with the organization’s known public IP address. This enables the traffic to satisfy the SaaS vendor’s IP restriction requirements without requiring Netskope’s IP ranges to be added to the allowlist. This is distinct from EPoT or IPsec tunnel approaches, which are primarily steering mechanisms and do not inherently provide the same targeted source IP control as NPA Source IP Anchoring.