In the infrastructure managed by the VMware vCenter server and VMware NSX Manager, deploy the Guest Introspection service for each VMware hypervisor cluster that will later deploy SVMs with the Network Threat Protection components:

1. Go to Networking and Security → Installation and Upgrade → Service Deployment.
2. Click Add to start the Deployment Wizard for network services and protection services for virtual machines.
3. Select the Guest Introspection service and click Next.

4. Select one or several VMware clusters to install SVMs with File Threat Protection components. Click Next.

5. If necessary, you can change the default network settings and select the storage for Guest Introspection service virtual machines, which will be installed on the selected VMware clusters.

1. Select the network to be used by the Guest Introspection service virtual machines and the storage for deploying these VMs.
2. If you want to configure the parameters for assigning IP addresses for service virtual machines, click the corresponding icon in the IP Assignment column.

3. Select Use IP Pool and then click Add.

   

4. Configure the pool of static addresses and click Save.

   

5. Select the added pool of static addresses and click OK.

   

6. The name of the selected pool will appear in the IP Assignment column. Click Next.

   

6. Make sure that all parameters are configured correctly. Click Finish.

The Wizard window will close. The current status of the Guest Introspection service deployment will appear in the Installation Status column.

7. Wait until the Guest Introspection service has been deployed.

8. Go to Hosts and Clusters.
9. Make sure that the Guest Introspection service virtual machines have been deployed successfully on each hypervisor in the cluster you selected.

The Guest Introspection service will be deployed on each hypervisor included in the cluster.

Install VMware NSX components:

1. Go to Networking and Security → Installation and Upgrade → Host Preparation.
2. Choose the cluster with the hypervisors on which you want to deploy SVMs with the Network Threat Protection component.
3. Click Actions → Install.

4. Click Yes.

Hypervisor preparation status will appear.

5. Wait until the hypervisors are prepared. 

The information about installed VMware NSX components can be found in the Hosts section.

To use the Network Threat Protection component, an active license for NSX for vSphere Advanced or NSX for vSphere Enterprise is required.

A standard license for NSX for vSphere is added by default upon connecting VMware NSX-V Manager to the VMware vCenter Server. If you use a standard license, the Network Service Insertion (Third Party Integration) feature, which is required for enabling Network Threat Protection on VMware ESXi hypervisors, is unavailable.

To view the information about the licenses in use:

1. Go to Menu → Administration.

2. Select Licenses → Assets → Solutions.

If the licenses for NSX for vSphere Advanced or NSX for vSphere Enterprise are missing from the list, install the license using the corresponding wizard.

To register Kaspersky Security services in VMware NSX-V Manager:

1. Publish all the SVM images with Kaspersky Security for Virtualization 6.x Agentless components on a file server with network access via HTTP or HTTPS. You can use the IIS web server integrated in Windows.
2. Install Kaspersky Security Center components: management plugin, the Integration Server console and the Integration Server. See the Online Help page for instructions.
3. Specify the settings of the Integration Server connection to VMware vCenter Server. See the Online Help page for instructions.
4. Enter the settings required for registration and deployment of Kaspersky Security services in the Wizard that is started from the Integration Server Console. See the Online Help page for instructions.

Kaspersky Security services will be registered in VMware NSX-V Manager.

The Integration Server registers Kaspersky Security for Virtualization 6.x Agentless services in VMware NSX Manager. The Integration Server is registered in VMware NSX Manager as Kaspersky Service Manager.

To view the list of registered services, go to Networking and Security → Service Definitions → Services. 

The table will contain:

• Name. The name of the Kaspersky File Antimalware Protection service and/or Kaspersky Network Protection service.
• Version. The version of the SVM image, the path to which you have specified in the Integration Server Console.
• Service Manager. Kaspersky Service Manager name (the Integration Server registered in VMware NSX Manager).

To view the list of Service Managers, go to Networking and Security → Service Definitions → Service Manager.

The table will contain:

• Name. Kaspersky Service Manager name (Integration server, registered in VMware NSX Manager).
• Vendor ID. Kaspersky Lab ID.
• Vendor Name. АО Kaspersky Lab name.

Add the virtual machines you want to protect with Kaspersky Security for Virtualization 6.x Agentless to one or several NSX Groups. To do so, create NSX Groups and configure the rules for adding virtual machines to a group:

• Dynamically. The group will include all the virtual machines that meet the specified criteria.
• By selecting VMware management objects. You can select the objects that should be added to the group. For example, a Datacenter object, a VMware cluster, a resource pool, оr specific virtual machines. By default, all child objects of the specified VMware management object are added to the group. You can also specify the VMware management objects that should not be added to the NSX Group.

You can combine these options when configuring the rules of adding SVMs to the NSX Group. For example, you can select adding the VMs to the group according to specified parameters dynamically and also specify the VMware management objects to be excluded from the group.

To configure the NSX Group:

1. Go to Networking and Security → Service Composer → Security Groups.
2. Click Add.

3. Enter a name for the new NSX Group. For example: Kaspersky Security Group or Protected by Kaspersky. 
4. Click Next.

5. If you want to add virtual machines to the group dynamically, proceed to the Define dynamic membership step and do the following:
   1. Click Add.
   2. Adjust the criteria for adding the VMs to the group. For example, if you want to add to the group all the virtual machines running Windows, set the Computer OS Name, Contains, Windows criteria.
   3. Click Next.

6. If you want to specify the VMware management objects to be added to the NSX Group, proceed to the Select Objects to Include step and do the following:
   1. Select the object type in the Object Type field.
   2. Move all the VMware management objects you want to include in the group to the Selected Objects list. 
   3. Click Next.

7. If you want to specify the VMware management objects to be excluded from the NSX Group, proceed to the Select Objects to Exclude step and do the following:
   1. Select the object type in the Object Type field.
   2. Move all the VMware management objects you want to exclude from the group to the Selected Objects list. 
   3. Click Next.

8. To check the specified parameters, proceed to the Ready to complete step.
9. Make sure that all parameters are configured correctly. Click Finish. 

10. Go to Hosts and Clusters and make sure that the virtual machines you want to protect are included in the NSX Group.
11. Make sure that the NSX Group name is displayed for each virtual machine meeting the inclusion criteria in the Summary tab of the Security Group Membership section.

The NSX Groups will be configured.

To protect the virtual machines in the NSX Group, configure the NSX Policy and apply it to the NSX Group:

1. Go to Networking and Security → Service Composer → Security Policies.
2. Click Add.

3. Enter the NSX Policy name and click Next.

4. If you want to use the File Threat Protection component, click Add.

5. Type the name into the Name field and select the Kaspersky File Antimalware Protection service in the Service Name drop-down list. Click OK. 

Information about the Kaspersky File Antimalware Protection service will appear in the Policy Wizard window. 

6. If you want to use the Network Threat Protection component, proceed to the Network Introspection Services tab. 
7. To monitor the outbound traffic of the virtual machines:

   1. Click Add.

      

   2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
   3. Set the Redirect to service toggle to Yes.

      

   4. Select Policy's Security Groups in the Source section and Any in the Destination section.

      

   5. Click OK.
8. To monitor the incoming traffic of the virtual machines:
   1. Click Add.
   2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
   3. Set the Redirect to service toggle to Yes.

      

   4. Select Any in the Source section and Policy's Security Groups in the Destination section.

      

   5. Click ОК.

Information about the Kaspersky Network Protection service will appear in the Policy Wizard window.

9. Exit the NSX Policy Wizard.
10. Go to the Security Policies tab and select the created policy. Click Apply.

11. Select the NSX Group with the protected virtual machines and click Apply.

On the Security Policies tab, the Successful status will appear for the created NSX Policy in the Status column. The Applied on SGs column will display the number of the NSX Groups to which this policy is applied.

The NSX Policy will be applied to the NSX Group.

SVMs with the File Threat Protection component are deployed on VMware ESXi hypervisors upon deploying the Kaspersky File Antimalware Protection service on the VMware vCenter clusters.

To deploy the Kaspersky File Antimalware Protection service:

1. Go to Networking and Security → Installation and Upgrade →Service Deployment.
2. Click Add. 

3. Select the Kaspersky File Antimalware Protection service and click Next.

4. Select one or several VMware clusters to which you want to install the File Threat Protection component. Click Next.

5. If necessary, you can change the default parameters for all the SVMs that will be deployed on the hypervisors in the selected cluster.

1. Select the network to be used by SVMs and the storage for deploying the SVMs with the File Threat Protection component.
2. If you want to configure the parameters for assigning IP addresses for service virtual machines, click the corresponding icon in the IP Assignment column.

3. Select Use IP Pool and click Add. 

   

4. Configure the pool of static addresses and click Save.

   

5. Select the added pool of static addresses and click OK. 

   

6. The name of the selected pool will appear in the IP Assignment column. Click Next.

   

6. Make sure that all parameters are configured correctly. Click Finish.

The Wizard window will close and the current status of the Kaspersky File Antimalware Protection service deployment will be shown in the Installation Status column.

7. Wait until Kaspersky File Antimalware Protection is successfully deployed.

8. Go to the Hosts and Clusters node.
9. Make sure that the SVMs have been deployed successfully on each hypervisor in the cluster you selected.

The SVMs with the File Threat Protection component will be deployed.

The SVMs with the Network Threat Protection component are deployed on VMware ESXi hypervisors upon deploying the Kaspersky Network Protection service on VMware clusters.

To deploy the Kaspersky Network Protection service:

1. Go to Networking and Security → Installation and Upgrade → Service Deployment.
2. Click Add. 
3. Select the Kaspersky Network Protection service and click Next.

4. Select one or several VMware clusters to install the Network Threat Protection component. Click Next.

5. If necessary, you can change the default parameters for all the SVMs that will be deployed on the hypervisors in the selected cluster.

1. Select the network to be used by SVMs and the storage for deploying the SVM with the Network Threat Protection component.
2. If you want to configure the parameters for assigning IP addresses for service virtual machines, click the corresponding icon in the IP Assignment column.

3. Select Use IP Pool and then click Add.

   

4. Configure the pool of static addresses and click Save. 

   

5. Select the added pool of static addresses and click OK.

   

6. The name of the selected pool will appear in the IP Assignment column. Click Next.

   

6. Make sure that all parameters are configured correctly. Click Finish.

The Wizard window will close and the current status of the Kaspersky Network Protection deployment will be shown in the Installation Status column.

7. Wait until Kaspersky Network Protection is successfully deployed.

8. Go to the Hosts and Clusters node. 
9. Make sure that the SVMs have been deployed successfully on each hypervisor in the cluster you selected.

The SVMs with the Network Threat Protection component will be deployed.