To install the Network Agent locally in connection gateway mode, do the following:

1. Run the installation file on the device that will become the connection gateway.

2. Read the license agreement and check the box I accept the terms in the License Agreement.

3. Select a folder for the installation.

4. Enter a Server address and uncheck the box Allow Network Agent to open UDP port.

5. Skip the Proxy server configuration step.
6. Select Use as connection gateway in DMZ.

7. Select Retrieve from Administration Server. 

8. If you use tags, enter them here. More information about using tags can be found in the article How to use tags in Kaspersky Security Center 10.

9. Skip the Advanced settings step.
10. Check the box beside Start application during installation.

11. Click Install.

1. Open Kaspersky Security Center 10.
2. Right-click on Managed devices in the left sidebar and select New → Group.

3. Enter a name for the new group and click OK.

4. Open the properties of the Administration Server.
5. Go to the Update agents section and uncheck the box beside Assign update agents automatically. Click Add.

6. In the drop-down menu for the field Device to act as update agent, select Add connection gateway in DMZ by address.

7. Enter the connection gateway address and click OK.

8. Select the Set of devices associated with this update agent. Click OK.

When the network is scanned again, the Administration Server will detect the connection gateway by its IP address and place it in Unassigned devices.

9. Add the connection gateway to the External devices group created in step 3.
10. Open the Properties for the Administration Server and go to the Update agentssection. Click Add.
11. From the drop-down menu for the field Device to act as update agent, select Add device from group. Add the connection gateway from the External devices group and click OK. Repeat step 8.
12. Select the connection gateway you have just added and open its Properties.

13. Go to the Gateway section. Check the boxes beside Connection gateway and Initiate connection gateway from Administration Server (if gateway is inside DMZ). Enter a Gateway address for remote devices, for example, abc-lab.kaspersky.com. Click OK.

You can also create a Network Agent policy for the connection gateway. Once you reach the Network step in the policy creation process, uncheck the box beside Use UDP port.

To check the status of the ports, execute the command -ano:

• The Network Agent connects to the Administration Server via TCP 13000 and TCP 14000.

• The connection gateway connects to the Administration Server via TCP 13000.

To troubleshoot the connection:

1. Run the klnagchk tool on the device where the Network Agent is installed in the connection gateway mode.

2. Run the klnagchk tool on the device which is used as a connection gateway. 

See the guide on using the tool in this article.