You deployed IPsec tunnels to steer on-premises traffic to Netskope.

In the scenario where you have deployed IPsec tunnels to steer on-premises traffic to Netskope and are experiencing issues with an application, the correct statement isC: Steering bypasses for IPsec tunnels must be applied at your edge network device. This means that to effectively bypass the steering for a specific application, the configuration must be done on the network device that is establishing the IPsec tunnel, such as a firewall or router. This device controls the traffic before it enters the tunnel, so applying the bypass there ensures that the application’s traffic does not get directed through the tunnel and can reach its destination directly.

References: The solution is based on standard practices for IPsec tunnel configuration and steering exceptions as described in Netskope’s documentation on traffic steering and IPsec configuration12.