Primary Administration Server on LAN and two secondary Administration Servers

The figure below shows the hierarchy of Administration Servers: the primary Administration Server is on a local area network (LAN). A secondary Administration Server is in the demilitarized zone (DMZ); another secondary Administration Server is on the internet.

The primary Administration Server and its managed devices are on a LAN, a secondary Administration Server and its managed devices are in the DMZ,another secondary Administration Server,its managed devices,and an administrator device are on the internet.

Hierarchy of Administration Servers: primary Administration Server and two secondary Administration Servers

The arrows indicate the initiation of traffic: each arrow points from a device that initiates the connection to the device that "answers" the call. The number of the port and the name of the protocol used for data transfer are provided. Each arrow has a number label, and details about the corresponding data traffic are as follows:

Administration Server sends data to the database. If you install the Administration Server and the database on different devices, you must make available the necessary ports on the device where the database is located (for example, port 3306 for MySQL Server and MariaDB Server, or port 1433 for Microsoft SQL Server). Please refer to the DBMS documentation for the relevant information.
Requests for communication from the Administration Server are transferred to all non-mobile managed devices through UDP port 15000.
Network Agents send requests to each other within one broadcasting domain. The data is then sent to the Administration Server and is used for defining the limits of the broadcasting domain and for automatic assignment of distribution points (if this option is enabled).
Information about shutdown of the managed devices is transferred from Network Agent to the Administration Server through UDP port 13000.
The Administration Server receives connection from Network Agents and from secondary Administration Servers through SSL port 13000.
If you used an earlier version of Kaspersky Security Center, the Administration Server on your network can receive connection from Network Agents through non-SSL port 14000. Kaspersky Security Center also supports connection of Network Agents through port 14000, although using SSL port 13000 is recommended.

The distribution point was called "Update agent" in earlier versions of Kaspersky Security Center.
The managed devices (except for mobile devices) request activation through TCP port 17000. This is not necessary if the device has its own access to the internet; in this case, the device sends the data to Kaspersky servers over the internet directly.
Data from MMC-based Administration Console is transferred to the Administration Server through port 13291. (The Administration Console can be installed on the same or on a different device.)
Applications on a single device exchange local traffic (either on the Administration Server or on a managed device). No external ports have to be opened.
Data from the Administration Server to the Kaspersky servers (such as KSN data or information about licenses) and data from the Kaspersky servers to the Administration Server (such as application updates and anti-virus database updates) are transferred using the HTTPS protocol.
If you do not want your Administration Server to have access to the internet, you must manage this data manually.
Kaspersky Security Center 13.2 Web Console Server sends data to the Administration Server, which may be installed on the same or on a different device, through TLS port 13299.
9a. Data from the browser, which is installed on a separate device of the administrator, is transferred to Kaspersky Security Center 13.2 Web Console Server through TLS port 8080. The Kaspersky Security Center 13.2 Web Console Server can be installed either on the Administration Server or on another device.