2

Trying to set up Kaspersky server on win server 2019 machine. Everything went ok, until I found that server's network had a Private type. After changing it back to domain, KSC became unaccessible from every PC in network, though all ports are opened for domain network too. Local kaspersky for winserver is visible in the console, port is listened but seems to be closed somewhere:

TCP    0.0.0.0:13000          SERVER:0               LISTENING       17092

There's a Mikrotik router in network. I tried to telnet 192.168.0.100 13000 on both network machine and Mikrotik terminal, both returned connection failure on this port. Other services such as rdp or smb are continue to working. Firewall log doesn't tell anything about 13000 port drops, nmap tells port is filtered. Where is the **** problem?

EDIT: That's what I'm getting in Wireshark when trying to connect:

124 65.035174   192.168.0.101   192.168.0.100   TCP 66  50297 → 13000 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
125 66.042763   192.168.0.101   192.168.0.100   TCP 66  [TCP Retransmission] 50297 → 13000 [SYN] Seq=0 Win=64240 Len=0 MSS=1460 WS=256 SACK_PERM=1
14
  • You need to define your local and trusted networks correctly in the AV policies. The AV will not work across public networks / non-local IPs unless you define them specifically. Also, the IPs in your network should be allowed in the Firewall policy section of the AV main policies.
    – Overmind
    Mar 6, 2020 at 6:51
  • There's no firewall in server version of Kaspersky, so windows seems to use its default firewall with advanced security. Or am I getting you wrong? Mar 6, 2020 at 6:55
  • The server policy has a Firewall policy that if active applies to all computers that have the network agent installed. Practically, the Windows FW settings will be dictated by the AV policy.
    – Overmind
    Mar 6, 2020 at 6:57
  • How can it be applied if all computers have network agent but none are accessible? I mean no user can't even connect to it and server can't connect to any user Mar 6, 2020 at 7:00
  • If it worked before, the initial applied policy stays. One often seen configuration mistake is to block PCs in different VLANs between each other, or to use improper settings that end up blocking communications between PCs and a server like the AV server. So 1st of all, check what you have the networks defined correctly. Then, do some ping-testing between AV server, PCs and backwards.
    – Overmind
    Mar 6, 2020 at 7:08

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.