Preparing the IT infrastructure for program components installation
Before installing the program, prepare your corporate IT infrastructure for the installation of components of Kaspersky Anti Targeted Attack Platform:
Ensure that the servers, the computer intended for working with the program web interface, and the computers to be installed with the Endpoint Sensors component all satisfy the hardware and software requirements.
Perform the following preliminary preparations of the corporate IT infrastructure for installation of the Sandbox component:
For both network interfaces, block access of the server hosting the Sandbox component to the corporate LAN in order to keep the network safe from the objects being analyzed.
For the first network interface, allow Internet access for the server hosting the Sandbox component for the purposes of database updates and analysis of the behavior of objects.
For the second network interface, allow inbound connections to the following ports for the server hosting the Sandbox component:
TCP 22 for connection to the server over the SSH protocol.
TCP 443 for receiving objects to scan from the Central Node component.
TCP 8443 for using the program web interface.
Perform the following preliminary preparations of the corporate IT infrastructure for installation of the Central Node component:
Allow inbound connections to the following ports for the server hosting the Central Node component:
TCP 22 for connection to the server via SSH.
TCP 8081 for receiving data from a server with the Sensor component.
TCP 9092 for adding metadata to the Targeted Attack Analyzer database (if the Sensor component is installed on a standalone server).
TCP 443 for receiving data from computers with the Endpoint Sensors component.
TCP 6379 for synchronization with the Redis database on a server with the Sensor component.
TCP 8443 for viewing scan results in the program web interface.
TCP 4443 when redirecting traffic from Endpoint Sensors components trought the server with the Sensor component to the server with the Central Node component.
Allow outbound connections to the following ports for the server hosting the Central Node component:
UDP 161 for receiving data on the status of the Sensor component (if the Sensor component is installed on a standalone server).
TCP 80 and 443 for communication with servers of the KSN service and Kaspersky Lab update servers.
TCP 443 for sending objects to the Sandbox component so that they can be scanned.
TCP 601 for sending messages to a SIEM system.
TCP 13299 for integration with Kaspersky Security Center.
Perform the following preliminary preparations of the corporate IT infrastructure for installation of the Sensor component:
For the network interface used for integration with a proxy server and mail server, allow inbound connections to the following ports for the server hosting the Sensor component:
TCP 22 for connection to the server via SSH.
TCP 1344 for receiving traffic from a proxy server.
TCP 25 for receiving SMTP traffic from a mail server.
TCP 443 when redirecting traffic from Endpoint Sensors components to the server with the Central Node component.
UDP 161 for sending data on the status of components and their databases to the server with the Central Node component.
Allow outbound connections to the following ports for the server hosting the Sensor component:
TCP 8081 for sending objects to the server with the Central Node component.
TCP 80 and 443 for communication with servers of the KSN service and Kaspersky Lab update servers.
TCP 6379 for synchronization with the Redis database on the server with the Central Node component.
TCP 9092 for sending metadata from mirrored traffic to the server with the Central Node component.
TCP 995 (or TCP 110 for unprotected connections) for integration with a mail server.
TCP 4443 when redirecting traffic from Endpoint Sensors components to the server with the Central Node component.
If you install a second network interface that receives only mirrored traffic in a VMware ESXi virtual environment, use the E1000 network adapter or disable the LRO (large receive offload) option on a VMXNET3 network adapter.
Allow incoming connections to computers hosting the Endpoint Sensors component and the server hosting the Central Node component directly, without a proxy server.
On network equipment, allow an encrypted communication channel between servers that have the Central Node and Sensor components.
The connection between servers that have the Central Node and Sensor components is established within the encrypted communication channel based on IPSec using the ESP protocol.
If you are using distributed solution and multitenancy mode, perform the following preliminary preparations of the corporate IT infrastructure for installation of the Central Node components:
Allow inbound connections to ports 8444 and 5432 for the server with the PCN role.
Allow inbound connections to port 5432 for the server with the SCN role.
On network equipment, allow the establishment of an encrypted communication channel between servers that have the Central Node and Sensor components.
The connection between servers that have the PCN and SCN role is established within the encrypted communication channel based on IPSec using the ESP protocol.
If needed, you can designate other ports for the program's components to use in the administrator menu of the server with the Central Node component. If you change the ports in the administrator menu, you need to allow connections to these ports in your corporate IT infrastructure.