Assigning distribution points manually

Expand all | Collapse all

Kaspersky Security Center allows you to manually assign devices to act as distribution points.

We recommend that you assign distribution points automatically. In this case, Kaspersky Security Center will select on its own which devices must be assigned distribution points. However, if you have to opt out of assigning distribution points automatically for any reason (for example, if you want to use exclusively assigned servers), you can assign distribution points manually after you calculate their number and configuration.

Devices functioning as distribution points must be protected, including physical protection, against any unauthorized access.

To manually assign a device to act as distribution point:

1. In the main menu, click the settings icon () next to the name of the required Administration Server.

   The Administration Server properties window opens.

2. On the General tab, select the Distribution points section.
3. Select the Manually assign distribution points option.
4. Click the Assign button.
5. Select the device that you want to make a distribution point.

   When selecting a device, keep in mind the operation features of distribution points and the requirements set for the device that acts as distribution point.

6. Select the administration group that you want to include in the scope of the selected distribution point.
7. Click the OK button.

   The distribution point that you have added will be displayed in the list of distribution points, in the Distribution points section.

8. Click the newly added distribution point in the list to open its properties window.
9. Configure the distribution point in the properties window:
   • The General section contains the setting of interaction between the distribution point and client devices:
     • SSL port

       The number of the SSL port for encrypted connection between client devices and the distribution point using SSL.

       By default, port 13000 is used.

     • Use multicast

       If this option is enabled, IP multicasting will be used for automatic distribution of installation packages to client devices within the group.

       IP multicasting decreases the time required to install an application from an installation package to a group of client devices, but increases the installation time when you install an application to a single client device.

     • IP multicast address

       IP address that will be used for multicasting. You can define an IP address in the range of 224.0.0.0 – 239.255.255.255

       By default, Kaspersky Security Center automatically assigns a unique IP multicast address within the given range.

     • IP multicast port number

       Number of the port for IP multicasting.

       By default, the port number is 15001. If the device with Administration Server installed is specified as the distribution point, port 13001 is used for SSL connection by default.

     • Distribution point address for remote devices

       The IPv4 address through which remote devices connect to the distribution point.

     • Deploy updates

       Updates are distributed to managed devices from the following sources:

       • This distribution point, if this option is enabled.
       • Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.

       If you use distribution points to deploy updates, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.

       If you disable this option, the number of update downloads and load on the Administration Server may increase. By default, this option is enabled.

     • Deploy installation packages

       Installation packages are distributed to managed devices from the following sources:

       • This distribution point, if this option is enabled.
       • Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.

       If you use distribution points to deploy installation packages, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.

       If you disable this option, the number of installation package downloads and load on the Administration Server may increase. By default, this option is enabled.

     • Run push server

       In Kaspersky Security Center, a distribution point can work as a push server for the devices managed through the mobile protocol and for the devices managed by Network Agent. For example, a push server must be enabled if you want to be able to force synchronization of KasperskyOS devices with Administration Server. A push server has the same scope of managed devices as the distribution point on which the push server is enabled. If you have several distribution points assigned for the same administration group, you can enable push server on each of the distribution points. In this case, Administration Server balances the load between the distribution points.

     • Push server port

       The port number for the push server. You can specify the number of any unoccupied port.

   • In the Scope section, specify the scope to which the distribution point will distribute updates (administration groups and/or network location).

     Only devices running a Windows operating system can determine their network location. Network location cannot be determined for devices running other operating systems.

   • If the distribution point works on a machine other than Administration Server, in the Source of updates section, you can select a source of updates for the distribution point:
     • Source of updates

       Select a source of updates for the distribution point:

       • To allow the distribution point to receive updates from the Administration Server, select Retrieve from Administration Server.
       • To allow the distribution point to receive updates by using a task, select Use update download task, and then specify a Download updates to the repositories of distribution points task:
         • If such a task already exists on the device, select the task in the list.
         • If no such task yet exists on the device, click the Create task link to create a task. The New task wizard starts. Follow the instructions of the wizard.

     • Download diff files

       This option enables the downloading diff files feature.

       By default, this option is enabled.

   • In the Internet connection settings subsection, you can specify the internet access settings:
     • Use proxy server

       If this check box is selected, in the entry fields you can configure the proxy server connection.

       By default, this check box is cleared.

     • Proxy server address

       Address of the proxy server.

     • Port number

       Port number that is used for connection.

     • Bypass proxy server for local addresses

       If this option is enabled, no proxy server is used to connect to devices on the local network.

       By default, this option is disabled.

     • Proxy server authentication

       If this check box is selected, in the entry fields you can specify the credentials for proxy server authentication.

       By default, this check box is cleared.

     • User name

       User account under which connection to the proxy server is established.

     • Password

       Password of the account under which the task will be run.

   • In the KSN Proxy section, you can configure the application to use the distribution point to forward KSN requests from the managed devices:
     • Enable KSN Proxy on distribution point side

       The KSN proxy service is run on the device that is used as a distribution point. Use this feature to redistribute and optimize traffic on the network.

       The distribution point sends the KSN statistics, which are listed in the Kaspersky Security Network statement, to Kaspersky. By default, the KSN statement is located in %ProgramFiles%\Kaspersky Lab\Kaspersky Security Center\ksneula.

       By default, this option is disabled. Enabling this option takes effect only if the Use Administration Server as a proxy server and I agree to use Kaspersky Security Network options are enabled in the Administration Server properties window.

       You can assign a node of an active-passive cluster to a distribution point and enable KSN proxy server on this node.

     • Forward KSN requests to Administration Server

       The distribution point forwards KSN requests from the managed devices to the Administration Server.

       By default, this option is enabled.

     • Access KSN Cloud/Private KSN directly over the internet

       The distribution point forwards KSN requests from managed devices to the KSN Cloud or Private KSN. The KSN requests generated on the distribution point itself are also sent directly to the KSN Cloud or Private KSN.

       The distribution points that have Network Agent version 11 (or earlier) installed cannot access Private KSN directly. If you want to reconfigure the distribution points to send KSN requests to Private KSN, enable the Forward KSN requests to Administration Server option for each distribution point.

       The distribution points that have Network Agent version 12 (or later) installed can access Private KSN directly.

     • Ignore proxy server settings when connecting to Private KSN

       Enable this option, if you have the proxy server settings configured in the distribution point properties or in the Network Agent policy, but your network architecture requires that you use Private KSN directly. Otherwise, requests from the managed applications cannot reach Private KSN.

       This option is available if you select the Access KSN Cloud/Private KSN directly over the internet option.

     • Port

       The number of the TCP port that the managed devices will use to connect to KSN proxy server. The default port number is 13111.

     • Use UDP port

       If you need the managed devices to connect to KSN proxy server through a UDP port, enable the Use UDP port option and specify a UDP port number. By default, this option is enabled.

     • UDP port

       The number of the UDP port that the managed devices will use to connect to KSN proxy server. The default UDP port to connect to the KSN proxy server is 15111.

   • If the distribution point works on a machine other than Administration Server, in the Connection gateway section, you can configure the distribution point to act as a gateway for connection between Network Agent instances and Administration Server:
     • Connection gateway

       If a direct connection between Administration Server and Network Agents cannot be established due to organization of your network, you can use the distribution point to act as the connection gateway between Administration Server and Network Agents.

       Enable this option if you need the distribution point to act as a connection gateway between Network Agents and Administration Server. By default, this option is disabled.

     • Establish connection to gateway from Administration Server (if gateway is in DMZ)

       If Administration Server is located outside the demilitarized zone (DMZ), on local area network, Network Agents installed on remote devices cannot connect to Administration Server. You can use a distribution point as the connection gateway with reverse connectivity (Administration Server establishes a connection to distribution point).

       Enable this option if you need to connect Administration Server to the connection gateway in DMZ.

     • Open local port for Kaspersky Security Center Web Console

       Enable this option if you need the connection gateway in DMZ to open a port for Web Console that is in DMZ or on the internet. Specify the port number that will be used for the connection from Web Console to the distribution point. The default port number is 13299.

       This option is available if you enable the Establish connection to gateway from Administration Server (if gateway is in DMZ) option.

     When connecting mobile devices to Administration Server via the distribution point that acts as a connection gateway, you can enable the following options:

     • Open port for mobile devices (SSL authentication of the Administration Server only)

       Enable this option if you need the connection gateway to open a port for mobile devices and specify the port number that mobile devices will use for connection to distribution point. The default port number is 13292. The mobile device will check the Administration Server certificate. When establishing the connection, only Administration Server is authenticated.

     • Open port for mobile devices (two-way SSL authentication)

       Enable this option if you need connection gateway to open a port that will be used for two-way authentication of Administration Server and mobile devices. Mobile device will check the Administration Server certificate, and Administration Server will check the mobile device certificate. Specify the following parameters:

       • Port number that mobile devices will use for connection to the distribution point. The default port number is 13293.
       • DNS domain names of the connection gateway that will be used by mobile devices. Separate domain names with commas. The specified domain names will be included in the distribution point certificate. If the domain names used by mobile devices do not match the common name in the distribution point certificate, mobile devices do not connect to the distribution point.

         The default DNS domain name is the FQDN name of the connection gateway.

     In both cases, the certificates are checked during the TLS session establishment on distribution point only. The certificates are not forwarded to be checked by the Administration Server. After a TLS session with the mobile device is established, the distribution point uses the Administration Server certificate to create a tunnel for synchronization between the mobile device and Administration Server. If you open the port for two-way SSL authentication, the only way to distribute the mobile device certificate is via an installation package.

   • Configure the polling of Windows domains, Active Directory, and IP ranges by the distribution point:
     • Windows domains

       You can enable device discovery for Windows domains and set the schedule for the discovery.

     • Active Directory

       You can enable network polling for Active Directory and set the schedule for the poll.

       If you use a Windows distribution point, you can select one of the following options:

       • Poll current Active Directory domain.
       • Poll Active Directory domain forest.
       • Poll selected Active Directory domains only. If you select this option, add one or more Active Directory domains to the list.

       If you use a Linux distribution point with installed Network Agent version 15, you can poll only Active Directory domains for which you specify the address and user credentials. Polling of the current Active Directory domain and the Active Directory domain forest is not available.

     • IP ranges

       You can enable device discovery for IPv4 ranges and IPv6 networks.

       If you enable the Enable range polling option, you can add scanned ranges and set the schedule for them. You can add IP ranges to the list of scanned ranges.

       If you enable the Use Zeroconf to poll IPv6 networks option, the distribution point automatically polls the IPv6 network by using zero-configuration networking (also referred to as Zeroconf). In this case, the specified IP ranges are ignored because the distribution point polls the whole network. The Use Zeroconf to poll IPv6 networks option is available if the distribution point runs Linux. To use Zerocong IPv6 polling, you must install the avahi-browse utility on the distribution point.

   • In the Advanced section, specify the folder that the distribution point must use to store distributed data:
     • Use default folder

       If you select this option, the application uses the Network Agent installation folder on the distribution point.

     • Use specified folder

       If you select this option, in the field below, you can specify the path to the folder. It can be a local folder on the distribution point, or it can be a folder on any device on the corporate network.

       The user account used on the distribution point to run Network Agent must have read/write access to the specified folder.

10. Click the OK button.

The selected devices act as distribution points.