Initial setup of Kaspersky Security Center Cloud Console

Expand all | Collapse all

This guide contains information about features of the Select and Advanced editions of Kaspersky Endpoint Security for Business managed via the on-premises console and features of the Advanced edition of Kaspersky Endpoint Security for Business managed via the cloud console. For information about other editions, please refer to Online Help for the Kaspersky applications included in the solution.

In this main scenario of the initial setup of Kaspersky Endpoint Security for Business managed via the cloud-based console, you begin with registration of company and workspace creation and finish with the monitoring of the protection status of your managed devices.

The main deployment scenario guides you through the following:

• You will start working with a workspace of your company as an administrator.
• You will assign distribution points and manually install distribution packages on them, you will be able to discover devices in your network.
• You will be able to deploy managed Kaspersky applications on the client devices and to configure policies and tasks, monitoring, and regular updates of Kaspersky databases, software modules, and applications.

When you complete this scenario, the policies and tasks based on Kaspersky applications will be configured. You will be able to proceed to the monitoring of the protection status of your managed devices.

Stages

The scenario of initial setup of Kaspersky Endpoint Security for Business managed via the cloud-based console proceeds in stages:

1. Preparation for the deployment

   Before you start initial setup of Kaspersky Endpoint Security for Business managed via the cloud-based console, do the following:

   • View the architecture of Kaspersky Security Center Cloud Console to understand interaction between the main application components.
   • Make sure that all necessary ports are open for interaction between your network and the Kaspersky infrastructure. Also, if you plan to use the Administration Server hierarchy, make sure that all necessary ports are open for interaction.

   View details

   Ports that must be open on client devices to allow the internet connection

   Port (or port range)	Protocol	Purpose of the port (or port range)
   23100-23199	TCP/TLS	Receiving connections from Network Agents and secondary Administration Servers on Kaspersky Security Center Cloud Console Administration Server at *.ksc.kaspersky.com. The Kaspersky infrastructure can use any port within this range and any web address within this mask. The port and the web address can change from time to time.
   23700-23799 (only if you manage mobile devices)	TCP/TLS	Receiving connections from mobile devices. Connection to the Kaspersky Security Center Cloud Console Administration Server at *.ksc.kaspersky.com. The Kaspersky infrastructure can use any port within this range and any web address within this mask. The port and the web address can change from time to time.
   27200-27299	TCP/TLS	Receiving connections for application activation from managed devices (except for mobile devices). Connection to the Kaspersky Security Center Cloud Console Administration Server at *.ksc.kaspersky.com. The Kaspersky infrastructure can use any port within this range and any web address within this mask. The port and the web address can change from time to time.
   29200-29299	TCP/TLS	Tunneling connections to managed devices by using the klsctunnel utility through Kaspersky Security Center Cloud Console Administration Server at *.ksc.kaspersky.com. The Kaspersky infrastructure can use any port within this range and any web address within this mask. The port and the web address can change from time to time.
   443	HTTPS	Connection to Kaspersky Security Center Cloud Console discovery service at *.ksc.kaspersky.com. The Kaspersky infrastructure can use any web address within this mask.
   1443	TCP	Connection to Kaspersky Security Network
   80	TCP	Connection is used to check validity of the Kaspersky Security Center certificates at *.digicert.com. The Kaspersky infrastructure can use any web address within this mask.

   The table below lists the ports that must be open on client devices where Network Agent is installed.

   Ports that must be open on client devices

   Port number	Protocol	Port purpose	Scope
   15000	UDP	Receiving data from connection gateways (if in use)	Managing client devices
   15000	UDP broadcast	Getting data about other Network Agents within the same broadcasting domain	Delivering updates and installation packages
   15001	UDP	Receiving multicast requests from a distribution point (if in use)	Receiving updates and installation packages from a distribution point

   Please note that the klnagent process can also request free ports from the dynamic port range of an endpoint operating system. These ports are allocated to the klnagent process automatically by the operating system, so klnagent process can use some ports that are used by another software. If the klnagent process affects that software operations, change the port settings in this software, or change the default dynamic port range in your operating system to exclude the port used by the software affected.

   The table below lists the additional ports that must be open on client devices where Network Agent is installed as a distribution point.

   Ports used by Network Agent functioning as distribution point

   Port number	Protocol	Port purpose	Scope
   13000	TCP/TLS	Receiving connections from Network Agents	Managing client devices and delivering updates and installation packages
   13111 (only if KSN proxy service is run on the device)	TCP	Receiving requests from managed devices to KSN proxy server	KSN proxy server
   13295 (only if you use the distribution point as a push server)	TCP/TLS	Sending push notifications to managed devices	Distribution point used as a push server
   15111 (only if KSN proxy service is run on the device)	UDP	Receiving requests from managed devices to KSN proxy server	KSN proxy server
   17111 (only if KSN proxy service is run on the device)	HTTPS	Receiving requests from managed devices to KSN proxy server	KSN proxy server

2. Creating the workspace of your company

   You must register your company and create a workspace. By creating a workspace, you receive your instance of Kaspersky Security Center Cloud Console. At this step the Kaspersky infrastructure is configured to enable you to manage your devices via Kaspersky Security Center Cloud Console.

   When you start using Kaspersky Security Center Cloud Console, you can either request a trial workspace (in this case, you are granted a 30-day trial license that is embedded in your workspace) or enter an activation code for a commercial license.

   You cannot convert a trial workspace into a commercial one. To continue using Kaspersky Security Center Cloud Console after the trial license expires, you must delete the trial workspace and create another one with a commercial license.

   View detailed instructions

3. Configuring Kaspersky Security Center Cloud Console

   The Quick Start Wizard of Kaspersky Security Center Cloud Console allows you to create a minimum of necessary tasks and policies, adjust a minimum of settings, and start creating installation packages of Kaspersky applications.

   View detailed instructions

4. Centralized deployment of Kaspersky Security Center Cloud Console

   Deploy Kaspersky applications.

   View detailed instructions

   The Kaspersky applications initial deployment proceeds in stages:

   1. Selection of a device to act as a distribution point

      View details

      In Kaspersky Security Center Cloud Console, a distribution point is intended for:

      • Network polling and device discovery
      • Remote installation of Network Agent on client devices
      • Connection of client devices to Administration Server (when it is acting as a connection gateway)

      Select a device in your organization's network to act as a distribution point for an administration group. Selected device must meet the requirements for distribution point. Depending on the amount of client devices in your organization's network, select proper number of devices to act as distribution points.

      A set of devices grouped by function and by installed Kaspersky applications. Devices are grouped as a single entity for the convenience of management. A group can include other groups. Group policies and group tasks can be created for each installed application in the group.

   2. Creating a stand-alone installation package for Network Agent

      View details

      Create a stand-alone installation package for Network Agent to install it on the distribution point.

      If your client devices do not have direct internet access to connect to Administration Server, in the Network Agent installation package settings, configure connection gateway and proxy server settings.

   3. Installing Network Agent on the selected device to act as a distribution point

      View details

      Deliver the stand-alone installation package for Network Agent to the selected device by any method. For example, you can copy the stand-alone installation package to a removable drive (such as a flash drive), or place it in a shared folder.

      In the Properties window of the stand-alone installation package file, verify that the stand-alone installation package for Network Agent is signed by Kaspersky.

      Run the installation of the stand-alone installation package for Network Agent on the selected device. As a result, Network Agent is installed according to the settings of the Network Agent installation package and is connected to Administration Server. The device with Network Agent is placed in the administration group that was specified when the stand-alone installation package for Network Agent was created.

   4. Assigning the device with Network Agent installed to act as a distribution point

      View details

      Assign the device with Network Agent installed to act as a distribution point.

   5. Configuring and performing network polling for the distribution point

      View details

      Configure network polling for the distribution point with the Network Agent installed. As an option, you can configure network polling in the Network Agent policy.

      After network polling according to schedule is complete, the client devices connected to your organization's network are discovered and placed to the Unassigned devices group.

   6. Creating installation packages for Network Agent and managed Kaspersky applications

      View details

      If you did not start Quick Start Wizard, or skipped the step of creating installation packages, create installation packages for Kaspersky applications. You must create both installation packages—for Network Agent and for managed Kaspersky applications appropriate for the operating system installed on client devices in your organization's network.

   7. Removing third-party security applications

      View details

      If third-party security applications are installed on client devices in your organization's network, remove them before Kaspersky applications installation.

   8. Installing Kaspersky applications on client devices

      View details

      Create tasks to install Network Agent and managed Kaspersky applications on client devices in your organization's network. When creating the tasks, use the Install application remotely task type. For the task to install Network Agent, use the Using operating system resources through distribution points option. For the task to install managed Kaspersky applications, use the Using Network Agent option. After the tasks are created, you can configure their settings. Make sure that the schedule for each task meets your requirements. First, the task to install Network Agent must be run. After Network Agent is installed on client devices, the task to install managed Kaspersky applications must be run.

      As an option, you can create one remote installation task to install Network Agent and managed Kaspersky applications on client devices in your organization's network. In this case, in the Installation packages block, use Select installation package option and Select Network Agent option; in the Force installation package download block, use Using operating system resources through distribution points option.

      You also can create several remote installation tasks to install managed Kaspersky applications for different administration groups or different device selections.

      If you have client devices that are out of the network with distribution point, for example, laptops of remote users, you must create and deliver the Network Agent stand-alone installation package to those client devices by any method. Install Network Agent stand-alone installation package locally on those client devices. Then you can install managed Kaspersky applications on those remote users' devices following the same instructions as for other devices discovered by the distribution point.

      Run the remote installation tasks.

      As an option, to install Kaspersky applications you can start the Protection deployment wizard.

   9. Verifying initial deployment of Kaspersky applications

      View details

      Generate and view the Report on Kaspersky software versions. Make sure that the managed Kaspersky applications are installed on all client devices in your organization.

   10. Licensing Kaspersky security applications

       View details

What to do next

After the initial setup is complete, the policies and tasks are configured with the default parameters, which may turn out to be sub-optimal for your organization. Complete the following scenarios to fine-tune the policies and tasks and the monitoring of the protection status of your managed devices.

1. Creating policies and tasks.
2. Regular updating of Kaspersky databases, configuring update of Kaspersky databases, and applications.
3. Configuring notifications and other monitoring tools.