Installing a Server without external sensors
When installing a Server without external sensors, all data to be processed and analyzed is received only by the computer that performs Server functions. You can use this installation method if the computer has a sufficient number of network interfaces to receive data from various sources.
If traffic aggregation tools (such as aggregation switches or network packet brokers) are used to transmit traffic to the Server in a distributed network architecture, the application may not be able to receive important data about the sources of information security events. In addition, if the same device addresses are used in different network segments, they cannot be processed correctly without additional configuration of traffic aggregation tools and the application. Moreover, individual network segments and devices may not be available for monitoring in the application, and the response and active polling functions may not be available for devices. For the most efficient operation of the application with traffic in a distributed network architecture, it is recommended to use the deployment scheme that involves the Server and external sensors.
The computer must have network interfaces to receive traffic on monitoring points from all industrial network segments. Due to the limit on the number of monitoring points on the Server, there must be no more than four of these network interfaces.
The computer must also have one more network interface so that other computers can connect to the Server through the web interface. There must be no monitoring points on this network interface. If there are no more free network interfaces on the computer, this same network interface can also be used for other connections from the dedicated Kaspersky Industrial CyberSecurity network.
The figure below shows an example scenario for deploying a Server without sensors. The network interfaces of the computer that performs Server functions are connected to the SPAN ports of network switches (SPAN ports and connections are marked yellow) and receive a copy of traffic from three segments of the industrial network. The dedicated Kaspersky Industrial CyberSecurity network is designated by green lines.
Example deployment of a Server without sensors