Kaspersky Security Center allows you to assign devices to act as distribution points.
We recommend that you assign distribution points automatically. In this case, Kaspersky Security Center will select on its own which devices must be assigned distribution points. However, if you have to opt out of assigning distribution points automatically for any reason (for example, if you want to use exclusively assigned servers), you can assign distribution points manually after you calculate their number and configuration.
Devices functioning as distribution points must be protected, including physical protection, against any unauthorized access.
To manually assign a device to act as distribution point:
In the console tree, select the Administration Server node.
In the context menu of the Administration Server, select Properties.
In the Administration Server properties window, select the Distribution points section and click the Add button. This button is available if Manually assign distribution points has been selected.
The Add distribution point window opens.
In the Add distribution point window, perform the following actions:
Select a device that will act as distribution point (select one in an administration group, or specify the IP address of a device). When selecting a device, keep in mind the operation features of distribution points and the requirements set for the device that acts as distribution point.
Indicate the specific devices to which the distribution point will distribute updates. You can specify an administration group or a network location description.
Click OK.
The distribution point that you have added will be displayed in the list of distribution points, in the Distribution points section.
Select the newly added distribution point in the list and click the Properties button to open its properties window.
Configure the distribution point in the properties window:
The General section contains the settings of interaction between the distribution point and client devices.
If this option is enabled, IP multicasting will be used for automatic distribution of installation packages to client devices within the group.
IP multicasting decreases the time required to install an application from an installation package to a group of client devices, but increases the installation time when you install an application to a single client device.
By default, the port number is 15001. If the device with Administration Server installed is specified as the distribution point, port 13001 is used for SSL connection by default.
Updates are distributed to managed devices from the following sources:
This distribution point, if this option is enabled.
Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.
If you use distribution points to deploy updates, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.
If you disable this option, the number of update downloads and load on the Administration Server may increase. By default, this option is enabled.
Installation packages are distributed to managed devices from the following sources:
This distribution point, if this option is enabled.
Other distribution points, Administration Server, or Kaspersky update servers, if this option is disabled.
If you use distribution points to deploy installation packages, you can save traffic because you reduce the number of downloads. Also, you can relieve the load on the Administration Server and relocate the load between the distribution points. You can calculate the number of distribution points for your network to optimize the traffic and load.
If you disable this option, the number of installation package downloads and load on the Administration Server may increase. By default, this option is enabled.
In Kaspersky Security Center, a distribution point can work as a push server for the devices managed through the mobile protocol. For example, a push server must be enabled if you want to be able to force synchronization of KasperskyOS devices with Administration Server. A push server has the same scope of managed devices as the distribution point on which the push server is enabled. If you have several distribution points assigned for the same administration group, you can enable push server on each of the distribution points. In this case, Administration Server balances the load between the distribution points.
If you manage devices with KasperskyOS installed, or plan to do so, you must use a distribution point as a push server. You can also use a distribution point as a push server if you want to send push notifications to client devices.
The KSN proxy service is run on the device that is used as a distribution point. Use this feature to redistribute and optimize traffic on the network.
The distribution point sends the KSN statistics, which are listed in the Kaspersky Security Network statement, to Kaspersky. By default, the KSN statement is located in %ProgramFiles%\Kaspersky Lab\Kaspersky Security Center\ksneula.
By default, this option is disabled. Enabling this option takes effect only if the Use Administration Server as a proxy server and I agree to use Kaspersky Security Network options are enabled in the Administration Server properties window.
You can assign a node of an active-passive cluster to a distribution point and enable KSN proxy server on this node.
The distribution point forwards KSN requests from managed devices to the KSN Cloud or Private KSN. The KSN requests generated on the distribution point itself are also sent directly to the KSN Cloud or Private KSN.
The distribution points that have Network Agent version 11 (or earlier) installed cannot access Private KSN directly. If you want to reconfigure the distribution points to send KSN requests to Private KSN, enable the Forward KSN requests to Administration Server option for each distribution point.
The distribution points that have Network Agent version 12 (or later) installed can access Private KSN directly.
Enable this option, if you have the proxy server settings configured in the distribution point properties or in the Network Agent policy, but your network architecture requires that you use Private KSN directly. Otherwise, requests from the managed applications cannot reach Private KSN.
This option is available if you select the Access KSN Cloud/Private KSN directly over the internet option.
If you need Network Agent to connect to Administration Server through a UDP port, enable the Use UDP port option and specify a UDP port number. By default, this option is enabled. The default UDP port to connect to Administration Server is 15000.
In the Device discovery section, configure the polling of Windows domains, Active Directory, and IP ranges by the distribution point.
You can enable network polling for Active Directory and set the schedule for the poll.
If you use a Windows distribution point, you can select one of the following options:
Poll current Active Directory domain.
Poll Active Directory domain forest.
Poll selected Active Directory domains only. If you select this option, add one or more Active Directory domains to the list.
If you use a Linux distribution point with installed Network Agent version 15, you can poll only Active Directory domains for which you specify the address and user credentials. Polling of the current Active Directory domain and the Active Directory domain forest is not available.
If you enable the Use Zeroconf to poll IPv6 networks option, the distribution point automatically polls the IPv6 network by using zero-configuration networking (also referred to as Zeroconf). In this case, the specified IP ranges are ignored because the distribution point polls the whole network. The Use Zeroconf to poll IPv6 networks option is available if the distribution point runs Linux. To use Zerocong IPv6 polling, you must install the avahi-browse utility on the distribution point.
In the Advanced section, specify the folder that the distribution point must use to store distributed data.
If you select this option, in the field below, you can specify the path to the folder. It can be a local folder on the distribution point, or it can be a folder on any device on the corporate network.
The user account used on the distribution point to run Network Agent must have read/write access to the specified folder.
The selected devices act as distribution points.
Only devices running a Windows operating system can determine their network location. Network location cannot be determined for devices running other operating systems.