To eliminate the risk of IP spoofing attacks, we recommend locating servers that you plan to combine into a cluster in a separate virtual local area network (VLAN) to which other network devices and/or users cannot possibly establish unauthorized connections, or using the IPSec protocol.
A number of limitations apply when adding servers to the cluster.
If you are using multiple Kaspersky Sandbox servers, you can combine these servers into a cluster to improve the performance Kaspersky Sandbox.
All servers in the cluster are peers regardless of which server was used as the base for creating the cluster. When a server in the cluster processes an object, information about the result of processing is saved on all servers in the cluster.
The Kaspersky Sandbox application balances load among the servers. When integrating with Kaspersky Endpoint Security, objects that Kaspersky Endpoint Security sends for processing to Kaspersky Sandbox are processed on the least busy server.
Kaspersky Endpoint Security's list of Kaspersky Sandbox servers only displays the servers that you have added to the list. Nevertheless, objects can be processed by any server in the cluster thanks to load balancing. The current list of servers in the cluster is displayed in the web interface of Kaspersky Sandbox.
Kaspersky Endpoint Security can connect to a different Kaspersky Sandbox server in the list if one of the following errors occurs:
When you delete a server from a cluster, the following object processing scenarios are possible:
After creating the cluster, the Cluster management section of Kaspersky Sandbox web interface window displays the server table of the cluster, as well as server status monitoring data for the cluster.
You can add servers to the cluster or remove servers from the cluster.