Question Re: Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector in Technology Q&A

Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector

former_member82170 — Tue, 03 Apr 2018 21:34:13 GMT

Hello,

We are working on SAP Cloud Platform and SAP Cloud Connector integration. Our web security team recommended us to implement Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector integration to monitor, filter or block the data packets. Has any one implemented this approch? any suggestions or recommendations?

Thanks and Regards,

Prasad

Re: Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector

gregorw — Wed, 04 Apr 2018 05:32:58 GMT

Dear Prasad,

seems your web security team hasn't looked into the details of SAP Cloud Connector (SCC) yet. Putting it between SCP and the Cloud Connector will break it's functionality as the WAF has to break into the SSL connection. Which will result into changed certificates that should be rejected by SCC. But putting the WAF between SCC and the Gateway Frontend Server (FES) is a valid option. But also there you can run into issues when you would like to use X.509 based Principal Propagation.

Best regards
Gregor

Re: Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector

MortenWittrock — Wed, 04 Apr 2018 09:44:32 GMT

Prasad, adding to Gregor's excellent answer: Make sure to engage with the security team, and make certain that they understand the architecture of SAP Cloud Platform and Cloud Connector. The project will progress a lot smoother from that starting point.

Regards,

Morten

Re: Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector

former_member82170 — Thu, 05 Apr 2018 16:15:02 GMT

Thanks Gregor and Morten for your input. Are there any documents which talk about this? if yes, could you please point me to that guide, as I am unable to locate.

Re: Web application firewall (WAF) between SAP Cloud Platform and SAP Cloud Connector

MortenWittrock — Thu, 05 Apr 2018 23:41:52 GMT

Hi Prasad

The Security section of the Cloud Connector documentation is a good place to start.

Regards,

Morten