How to install Kaspersky Security for Virtualization 6.x Agentless in an infrastructure managed by VMware NSX-V Manager

This article concerns:

Kaspersky Security for Virtualization 6.1 Agentless
Kaspersky Security for Virtualization 6.0 Agentless

Before installing the application, make sure that:

SVM (Secure Virtual Machine) images are received from a trusted source. See this article for instructions.
Agent VM Settings are configured for each hypervisor: network and storage for service virtual machines and the SVM. To learn more about configuring Agent VM Settings, see VMware documentation.

To install Kaspersky Security for Virtualization 6.x Agentless in an infrastructure managed by VMware NSX-V Manager, complete 9 steps listed below using the VMware vSphere Client console.

1. Deploy Guest Introspection

In the infrastructure managed by the VMware vCenter server and VMware NSX Manager, deploy the Guest Introspection service for each VMware hypervisor cluster that will later deploy SVMs with the Network Threat Protection components:

Go to Networking and Security → Installation and Upgrade → Service Deployment.
Click Add to start the Deployment Wizard for network services and protection services for virtual machines.
Select the Guest Introspection service and click Next.

Selecting the Guest Introspection service in the Deployment Wizard

Select one or several VMware clusters to install SVMs with File Threat Protection components. Click Next.

Selecting VMware clusters to install SVMs with File Threat Protection components

If necessary, you can change the default network settings and select the storage for Guest Introspection service virtual machines, which will be installed on the selected VMware clusters.

Changing default network settings and selecting storage for Guest Introspection service virtual machines

Select the network to be used by the Guest Introspection service virtual machines and the storage for deploying these VMs.
If you want to configure the parameters for assigning IP addresses for service virtual machines, click the corresponding icon in the IP Assignment column.
Select Use IP Pool and then click Add.
Configure the pool of static addresses and click Save.
Select the added pool of static addresses and click OK.
The name of the selected pool will appear in the IP Assignment column. Click Next.

Make sure that all parameters are configured correctly. Click Finish.

Starting deployment of the Guest Introspection service

The Wizard window will close. The current status of the Guest Introspection service deployment will appear in the Installation Status column.

Monitoring the process of the Guest Introspection service deployment

Wait until the Guest Introspection service has been deployed.

Successful deployment of the Guest Introspection service

Go to Hosts and Clusters.
Make sure that the Guest Introspection service virtual machines have been deployed successfully on each hypervisor in the cluster you selected.

Checking Guest Introspection service virtual machines

The Guest Introspection service will be deployed on each hypervisor included in the cluster.

2. Prepare VMware ESXi hypervisors for Network Threat Protection deployment

3. Read the license information for NSX for vSphere

4. Register Kaspersky Security services in VMware NSX-V Manager

5. View the list of registered services

6. Configure NSX Groups

Add the virtual machines you want to protect with Kaspersky Security for Virtualization 6.x Agentless to one or several NSX Groups. To do so, create NSX Groups and configure the rules for adding virtual machines to a group:

Dynamically. The group will include all the virtual machines that meet the specified criteria.
By selecting VMware management objects. You can select the objects that should be added to the group. For example, a Datacenter object, a VMware cluster, a resource pool, оr specific virtual machines. By default, all child objects of the specified VMware management object are added to the group. You can also specify the VMware management objects that should not be added to the NSX Group.

You can combine these options when configuring the rules of adding SVMs to the NSX Group. For example, you can select adding the VMs to the group according to specified parameters dynamically and also specify the VMware management objects to be excluded from the group.

To configure the NSX Group:

Go to Networking and Security → Service Composer → Security Groups.
Click Add.

Creating an NSX Group

Enter a name for the new NSX Group. For example: Kaspersky Security Group or Protected by Kaspersky.
Click Next.

Entering a name for the new NSX Group

If you want to add virtual machines to the group dynamically, proceed to the Define dynamic membership step and do the following:
1. Click Add.
2. Adjust the criteria for adding the VMs to the group. For example, if you want to add to the group all the virtual machines running Windows, set the Computer OS Name, Contains, Windows criteria.
3. Click Next.

Adding virtual machines to the NSX Group dynamically

If you want to specify the VMware management objects to be added to the NSX Group, proceed to the Select Objects to Include step and do the following:
1. Select the object type in the Object Type field.
2. Move all the VMware management objects you want to include in the group to the Selected Objects list.
3. Click Next.

Selecting VMware management objects to add to the NSX Group

If you want to specify the VMware management objects to be excluded from the NSX Group, proceed to the Select Objects to Exclude step and do the following:
1. Select the object type in the Object Type field.
2. Move all the VMware management objects you want to exclude from the group to the Selected Objects list.
3. Click Next.

Selecting VMware management objects to exclude from the NSX Group

To check the specified parameters, proceed to the Ready to complete step.
Make sure that all parameters are configured correctly. Click Finish.

Completing creation of the NSX Group

Go to Hosts and Clusters and make sure that the virtual machines you want to protect are included in the NSX Group.
Make sure that the NSX Group name is displayed for each virtual machine meeting the inclusion criteria in the Summary tab of the Security Group Membership section.

Checking NSX Groups for virtual machines

The NSX Groups will be configured.

7. Configure NSX Policies

To protect the virtual machines in the NSX Group, configure the NSX Policy and apply it to the NSX Group:

Go to Networking and Security → Service Composer → Security Policies.
Click Add.

Creating an NSX Policy

Enter the NSX Policy name and click Next.

Naming the NSX Policy

If you want to use the File Threat Protection component, click Add.

Adding the File Threat Protection component to the NSX Policy

Type the name into the Name field and select the Kaspersky File Antimalware Protection service in the Service Name drop-down list. Click OK.

Configuring the File Threat Protection component in the NSX Policy

Information about the Kaspersky File Antimalware Protection service will appear in the Policy Wizard window.

Checking the information about the Kaspersky File Antimalware Protection service

If you want to use the Network Threat Protection component, proceed to the Network Introspection Services tab.
To monitor the outbound traffic of the virtual machines:
1. Click Add.
2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
3. Set the Redirect to service toggle to Yes.
4. Select Policy's Security Groups in the Source section and Any in the Destination section.
5. Click OK.
To monitor the incoming traffic of the virtual machines:
1. Click Add.
2. Type the name into the Name field and in the Service Name drop-down list select the Kaspersky Network Protection service.
3. Set the Redirect to service toggle to Yes.
4. Select Any in the Source section and Policy's Security Groups in the Destination section.
5. Click ОК.

Information about the Kaspersky Network Protection service will appear in the Policy Wizard window.

Checking the Kaspersky Network Protection service configuration in the NSX Policy

Exit the NSX Policy Wizard.
Go to the Security Policies tab and select the created policy. Click Apply.

Selecting the created policy on the Security Policies tab

Select the NSX Group with the protected virtual machines and click Apply.

Selecting the NSX Group in the security policy

On the Security Policies tab, the Successful status will appear for the created NSX Policy in the Status column. The Applied on SGs column will display the number of the NSX Groups to which this policy is applied.

Checking the created NSX Policy