To prepare the hypervisors for Network Attack Blocker deployment, Install VMware NSX components:

1. Select Networking & Security.
2. Select Installation and click the Host Preparation tab.
3. Choose the cluster with the hypervisors on which you want to deploy SVMs with the File Anti-Virus and Network Attack Blocker components.
4. Click Actions and select Install. In the window that opens click Yes. 

You can view the progress in the Installation Status section on the Host Preparation tab.

5. Wait until the hypervisors are prepared. When the preparation is finished, the Installation Status section will show the versions of the installed NSX components.

To run Kaspersky Security in the infrastructure managed by VMware vCenter and VMware NSX Manager, deploy the Guest Introspection service on each cluster of VMware hypervisors where your SVMs with the File Anti-Virus component will be located. Thus, Guest Introspection service virtual machines must be deployed on each hypervisor in a cluster.

To deploy Guest Introspection:

1. Select Networking & Security.
2. Select Installation and click the Service Deployments tab.
3. Click the plus icon to launch the wizard. The window Deploy Network & Security Services appears.
4. At the first step of the wizard, select the Guest Introspection service in the table and click Next.

5. Select one or several VMware clusters on which you would like to install Kaspersky Security and then click Next.

6. At the next step, you can change the default settings and select the storage for the service virtual machines of Guest Introspection, which will be installed on the selected VMware clusters. 

1. Select the network to be used by the Guest Introspection service virtual machines and the storage for deploying these VMs.
2. If you want to configure the parameters of assigning IP addresses for service virtual machines, click the Change link in the IP assignment section. The Select IP Assignment mode window opens.
   
   
3. Select Use IP Pool and click the plus icon. The Add Static IP Pool window opens.
   
   
4. Configure the pool of static addresses and click OK. The new pool appears in the list of pools.
   
   
5. Click the pool you have added and click OK. The name of the selected pool will appear in the Deploy Network & Security Services window. Click Next.
   
   

7. Make sure all parameters are correct and click Finish.

8. The wizard window closes. The current status of Guest Introspection service deployment process is shown in the Installation Status section of the VMware vSphere Web Client console.

9. Wait until Guest Introspection is deployed.

10. In the VMware vSphere Web Client console, select Hosts and Clusters and make sure Guest Introspection service virtual machines have been deployed successfully on each hypervisor in the cluster.

To use Network Attack Blocker, an active license NSX for vSphere Advanced or NSX for vSphere Enterprise is required.

If you use a default license for NSX for vSphere, which is installed upon connection if VMware NSX to the VMware vCenter server, the feature “Network Service Insertion (Third Party Integration)”, which is required for enabling Network Attack Blocker on VMware ESXi hypervisors, is unavailable.

To view the information about the licenses in use:

1. Выберите Administration.

2. Click Licenses and select the Products tab.

If the licenses for NSX for vSphere Advanced or NSX for vSphere Enterprise are missing from the list, install the license using the corresponding wizard.

Kaspersky Security services are registered in VMware NSX Manager by the Integration Server. The Integration server is not registered in VMware NSX Manager as a Kaspersky Service Manager.
You can view the list of registered services and Service Managers in the VMware vSphere Web Client console:

1. Select Networking & Security.
2. Click Service Definitions and select the Services tab.
   The table shows:
   • Name – the Kaspersky Security service name: Kaspersky File Antimalware Protection or Kaspersky Network Protection.
   • Version – the version of the SVM image, the path to which you have specified in the Integration server’s console
   • Service Manager – Kaspersky Service Manager name (Integration server, registered in VMware NSX Manager).

3. In the VMware vSphere Web Client console, select Service Managers.
   The table shows:
   • Name – Kaspersky Service Manager name (Integration server, registered in VMware NSX Manager)
   • Vendor ID – Kaspersky Lab ID.
   • Vendor Name – Kaspersky Lab name.

Add all SVMs you want to protect with Kaspersky Security to the NSX Security Group. First, create the NSX Security Group and configure the rules for adding VMs to the group.

The following options of adding SVMs to the NSX Security Group are available:

• Adding SVMs to the NSX Security Group dynamically.
  The group includes all SVMs that meet the criteria which are running at the moment of NSX Security Group creation. Other SVMs that meet the criteria will be added to the group at their next startup. В
• Adding specified VMware management objects to the NSX Security Group.
  You can select the objects to be added to the group, e.g. the Datacenter object, the VMware cluster, a resource pool, оr specific VMs. By default, all child objects of the specified VMware management object are added to the group, including the VMs which are switched off at the moment. You can also specify theVMware management objects, which should not be added to the NSX Security Group.

You can combine these options when configuring the rules of adding SVMs to the NSX Security Group. For example, you can select adding the VMs to the group according to specified parameters dynamically and also specify the VMware management objects to be excluded from the group.
To configure a NSX security group:

1. Select Networking & Security.
2. Click Service Composer and select the Security Groups tab.
3. Click the Add icon. The wizard will be launched.

4. Enter the name for the new NSX Security Group, e.g. “Kaspersky Security Group” or “Protected by Kaspersky”. 
5. Click Next.

6. If you want to set up adding VMs to the group dynamically, proceed to the Define dynamic membership step of the wizard.
   1. Click the plus icon and then click Add in the Membership criteria 1 entry form.
   2. Adjust the criteria for adding the VMs to the group. For example, to add all VMs which meet the Kaspersky Security hardware requirements, use the parameter Computer OS Name – Contains – Windows.

7. If you want to specify the VMware management objects to be added to the NSX Security Group, proceed to the Select objects to include step.
   Select the object type in the Object Type field and move all VMware management objects you need to the Selected Objects list.

8. If you want to specify the VMware management objects to be excluded from the NSX Security Group, proceed to the Select objects to exclude step.
   Select the object type in the Object Type field and move all VMware management objects you want to exclude to the Selected Objects list.

9. To check the specified parameters, proceed to the Ready to complete step.
10. Click Finish. 

The wizard will close. On the Security Groups tab, you ca view the number of VMs which will be added to the group in the Virtual Machines section. 

You can view the list of VMs added to the group. To do it, click the number in the Virtual Machines section. 

If you selected adding the VMs to the group dynamically, the machines which are not running at the moment are not shown in the group. They will be added to the group the next time they are launched.

11. In the VMware vSphere Web Client console, select Hosts and Clusters and make sure the VMs you want to protect are in the group. For each virtual machine which meets the requirements of the group, in the Security Group Membership section of the Summary tab, the name of the NSX Security Group is specified.

To protect the VMs in the NSX Security Group, configure the NSX Security Policy and apply it to the NSX Security Group.

To configure the NSX Security Policy and apply it to the NSX Security Group:

1. Select Networking & Security.
2. Click Service Composer and select the Security Policies tab.
3. Click the policy creation icon. The policy creation wizard will open.
4. Enter the policy name and click Next.

5. If you want to use File Anti-Virus, at the next step of the wizard click the plus icon. The Add Guest Introspection Service window opens.
6. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky File Antimalware Protection service. Click OK. 

The wizard window shows the information about the Kaspersky File Antimalware Protection service. In the Action section, the action set for the service can be viewed.

7. If you want to use Network Attack Blocker, proceed to the Network Introspection Services tab. 
8. If you want to check the outbound traffic of VMs:
   1. Click the plus icon. The Add Network Introspection Service window opens.
      
   2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
   3. Enter the value for the Source field. Click the corresponding Change link located on the right. Select Policy's Security Groups and click OK.
   4. Enter the value for the Destination field. Click the corresponding Change link located on the right. Select Any and click OK.
      
   5. Click in the Add Network Introspection Service window.
9. If you want to check the inbound traffic of VMs:
   1. Open the Add Network Introspection Service by clicking the plus icon.
   2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
   3. Enter the value for the Source field. Click the corresponding Change link located on the right. Select Any and click OK.
      
   4. Enter the value for the Destination field. In the Add Network Introspection Service window, click the Change link located on the right from the Destination field. Select Policy's Security Groups and click OK.
      
   5. Click in the Add Network Introspection Service window.

the wizard window shows the information about the Kaspersky Network Protection service. In the Action section, you can view the action set for the sevice. In the Source and Destination sections, the values set for outbound and inbound traffic scan are available.

10. Exit the wizard.
11. On the Security Policies tab, select the policy you have created and open the expandable list of Actions. Select Apply Policy. The window of applying the NSX Security Policy to the NSX Security Group opens.

12. Select the NSX Security Group with the SVMs and click OK.
13. The window closes. On the Security Policies tab, the Successful status will appear for the created policy in the Sync Status section. 

The NSX Security Policy is now applied to the NSX Security Group.

Publishing the installer to the web server

Installers of Kaspersky Security for Virtualization 4.0 Agentless must be available to the NSX Manager through HTTP(s). You can use the built-in web server of Kaspersky Security Center:

1. On a computer with Kaspersky Security Center installed, open the path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Center\Share and create the folder named public.
2. Copy the installation files of Kaspersky Security for Virtualization 4.0 Agentless to this folder.

Installing Kaspersky Security Center components

Kaspersky Security Center components include the administration plug-in and the Integration Server required for interaction with vCenter and NSX. To install the components:

1. Run the file SecurityCenterComponents_x.x.x.x_setup.exe.
2. Select the language and click Next.
3. Read the License Agreement carefully and accept it if you agree to all its terms. Click Next.
4. View the Intergration Server parameters. Check if port 7271 is open. Click Next.
5. Click Finish.  

Register the services of Kaspersky Security for Virtualization 4.0 Agentless

1. Open Kaspersky Security Center.
2. Click Next in the configuration wizard. 
3. Click Finish when the update task is created. 
4. Click Start the Integration Server Management Console  in the main window.
5. Click Consider certificate to be trusted.
6. In the Virtual infrastructure protection, click Add.
7. Specify the connection settings to vCenter Server.
8. Click Certificate verification.
9. Click Consider as trusted.
10. In the Manage protection section, select Register Kaspersky Security services.
11. Specify the connection settings to NSX Manager.
12. Click Consider as trusted.
13. Go to http://x.x.x.x:8060/public/ksv, where “x.x.x.x” stands for the address of the computer with Kaspersky Security Center installed.
14. Copy the link to the OVF file. 
15. Paste the link into the field and verify it.
16. Click Next.
17. In the next view, leave the settings as they are and click Next.
18. At the next step, you can configure tthe connection settings of the SVM to Kaspersky Security Center, NSX Manager to the Integration Server, and the SVM to the Integration Server.  
19. Click Next.
20. Create a new password for klconfig and root. Click Next.
21. Check the settings and click Next.
22. When the process is completed, click Next and close the Integration Server management console.

Checking the services of Kaspersky Security for Virtualization 4.0 Agentless

1. Open the main menu and select Networking & Security.

2. Go to Service Definitions.
3. Make sure the Kaspersky Security for Virtualization service is registered on NSX Manager.

4. Go to the Service Managers tab.
5. Select Kaspersky Service Manager and the edit icon.

6. Pay attention to the Base API URL field. The field contains the Integration Server address, which is required for correct work of Kaspersky Security for Virtualization 4.0 Agentless.

7. Click Cancel.

The SVM with the File Anti-Virus component is deployed on VMware ESXi hypervisors when you deploy the Kaspersky File Antimalware Protection service on the VMware clusters. Deployment is performed via VMware vSphere Web Client:

To deploy the SVM with the File Anti-Virus component:

1. Select Networking & Security.
2. Select Installation and click the Service Deployments tab.
3. Click the plus icon to launch the wizard. The window Deploy Network & Security Services appears. The list shows the Kaspersky File Antimalware Protection service.
4. At the first step of the wizard, select the Kaspersky File Antimalware Protection service in the table and click Next.

5. Select one or several VMware clusters to which File Anti-Virus will be installed, and click Next.

6. At the next step of the wizard, you can change the default network parameters, select the storage for SVMs to be deployed on the hypervisors in the selected cluster.

1. Select the network to be used by SVMs and the storage for deploying the SVM with the File Anti-Virus component.
2. If you want to change the parameters of assigning IP addresses for SVMs, click the Change link in the IP assignment section. The Select IP Assignment mode window opens.
3. Select Use IP Pool and click the plus icon. 
   
   The Add Static IP Pool window opens.
4. Configure the pool of static addresses in the Add Static IP Pool window and click ОK.
   
   The new pool appears in the list of pools.
   
5. Click the pool you have added and click OK. The name of the selected pool will appear in the Deploy Network & Security Services window.
   
6. Click Next.

7. Make sure all parameters are correct and click Finish.

8. The wizard window closes. The current status of Kaspersky File Antimalware Protection service deployment process is shown in the Installation Status section of the VMware vSphere Web Client console.

9. Wait until Kaspersky File Antimalware Protection is successfully deployed.

10. In the VMware vSphere Web Client console, select Hosts and Clusters and make sure SVMs have been deployed successfully on each hypervisor in the cluster.

The SVMs with the Network Attack Blocker component are deployed on VMware ESXi hypervisors through deployment of the Kaspersky Network Protection service on VMware clusters. Deployment is performed via VMware vSphere Web Client:

Deploy an SVM with the Network Attack Blocker component:

1. Select Networking & Security.
2. Select Installation and click the Service Deployments tab.
3. Click the plus icon to launch the wizard. The window Deploy Network & Security Services appears. The list shows the Kaspersky Network Protection service.
4. At the first step of the wizard, select the Kaspersky Network Protection service in the table and click Next.

5. Select one or several VMware clusters on which you would like to install Kaspersky Network Protection and then click Next.

6. At the next step of the wizard, you can change the default network parameters, select the storage for SVMs to be deployed on the hypervisors in the selected cluster.

1. Select the network to be used by SVMs and the storage for deploying the SVM with the Network Attack Blocker component. 
2. If you want to change the parameters of assigning IP addresses for SVMs, click the Change link in the IP assignment section. The Select IP Assignment mode window opens.
   
3. Select Use IP Pool and click the plus icon. The Add Static IP Pool window opens.
4. Configure the pool of static addresses in the Add Static IP Pool window and click OK.
   
   The new pool appears in the list of pools.
   
5. Click the pool you have added and click OK. The name of the selected pool will appear in the Deploy Network & Security Services window.
   
6. Click Next.

7. Make sure all parameters are set correctly and click Finish.

8. The wizard window closes. The current status of Kaspersky Network Protection service deployment process is shown in the Installation Status section of the VMware vSphere Web Client console.

9. Wait until Kaspersky Network Protection is successfully deployed.

10. In the VMware vSphere Web Client console, select Hosts and Clusters and make sure SVMs have been deployed successfully on each hypervisor in the cluster.