SAP CPI - High Availability using Azure Traffic Manager

[santhosh_kumarv]

In this blog let us see how to achieve High Availability for SAP CPI service using cross-region failover configuration. The method shown here is not only limited to failover configuration but can also be used to distribute traffic optimally for high responsiveness. The same can be applied to other SAP Cloud Platform Services too.

If you haven't yet, I suggest reading this blog How to crash your iflows and watch them failover beautifully by martin-pankraz. An excellent article detailing why failover is required and how to achieve it using Azure Front Door. His blog also saves me some writing effort to explain the same and hence let's jump directly into the Solution.

The Solution

The solution is to run two SAP CPI instances in a different region and load balance them with Azure Traffic Manager. Azure Traffic Manager is a DNS based load balancing solution and supports six different routing methods as documented here. The proposed solution below is based on the Priority routing method.

High Availability Setup

• The two tenants i.e. one primary and one secondary tenant in this example are provisioned in EU2 and EU3 Region.


• Both the Subaccount has the Custom Domain configuration and use the same URL i.e. intSBX.scp.imagine.com for the IFL application a.k.a. CPI Runtime.


• Set-Up SAP CPI tenant to host a Health Check Endpoint, so Azure Traffic Manager can automatically detect the unavailability of an instance to determine DNS resolution.


• A traffic manager controls which SSL Host i.e. eu2*.ssl.ondemand.com or eu3*.ssl.ondemand.com is resolved for the client and also sets DNS TTL to an acceptable minimum duration i.e. 60 seconds.

Primary and Secondary Tenant Set-Up

The easiest part here is spinning two tenants, while the difficult part is having them both in synch always i.e.maintaining the same version of Interface, same configuration values, credentials, Trust Certificates, Client Authentication Certificates etc. This can be done manually (everytime), however, I choose to enhance the Command line tool released here SAP CPI : Artifact Extractor – Command Line Utility to download and upload Package from Primary to Secondary, similarly apply the IFlow configuration from Primary to Secondary tenant, with a help a custom IFlow download the Security Artifacts with password from Primary and create/update them in Secondary, Download the Trust Certificate and create/update them in Secondary etc. Most of these operations were done leveraging the Platform APIs. I'm looking to publish this version of the tool too in near future.

Custom Domain Set-Up

Read my previous blog SAP CPI – How to Configure Custom Domain to create a custom domain for SAP CPI primary and secondary tenant. It's important to have the same custom domain name in the both primary and secondary tenant.

SAP CPI Health Check Endpoint

We need to set-up a ping kind of service in SAP CPI for Azure Traffic Manager to check if the configured Tenant is reachable. This heartbeat result will enable Azure Traffic Manager to determine the availability and latency to the SCPI tenant and thus decide which tenant should the DNS resolution happen to.

Set-up a simple iflow and control access to it using a custom role of your choice. It's advised to create a new role a not share it with other productive interfaces.

Tenant Ping IFlow

Traffic Manager Set-Up

1. Create a new Traffic Manager in Azure.
   


2. Add SAP CPI Primary Tenant as External Endpoint with Priority 1. It should be configured to resolve to SSL Host created as part of Custom Domain Creation on Primary Tenant Subaccount i.e. EU2*.ssl.ondemand.com in my example.
   
   

   Maintain Customer Header Setting with SAP CPI Custom Domain Host. This is because in this step-2 & 3 we will only maintain the SSL Hostname and in step-4 just the HTTP path to SCPI Health Check Interface. So Traffic manager will perform the Health Check Interface all performing an HTTP get to SSL HOST with the configured path (which is wrong). So this custom header setting will send additionally the hostname of SAP IFL application to SSL Host which will route the message to correct CPI IFL Application.

   
   


3. Add SAP CPI Secondary Tenant as External Endpoint with Priority 2. It should be configured to resolve to SSL Host created as part of Custom Domain Creation on Secondary Tenant Subaccount i.e. EU3*.ssl.ondemand.com in my example.
   


4. Configure Traffic Manager to set the DNS TTL to 60 seconds. This way the DNS records resolved expire after 60 seconds and smart clients will attempt to resolve it once again. Also set-up the Endpoint Monitoring to the SCPI Ping Interface created before. There is no provision to choose an Authentication method, hence as a workaround base64 encode username:password and send it in the Custom Header. Don't use a privileged user credential here since the password here can be decoded.
   


5. Create a CNAME record in your DNS Server i.e. imagine.com and map it to traffic manager Domain Name. Traffic Manager will inturn decide to resolve to SSL host of Primary or Secondary based on the routing method configuration.

Runtime Behaviour

When a Client attempt connection to intSBX.scp.imagine.com a

• A DNS resolution happens to Azure traffic manager Domain i.e. intSBX.trafficmanager.net


• Traffic Manager Domain will then resolve to custom SSL Host eu*.ssl.ondemand.com.


• Custom SSL host will resolve to an IP


• The client will initiate message exchange to the IP with the host header containing value intSBX.scp.imagine.com


• SSL host will let message reach SAP CPI runtime since we have mapped the custom domain to SAP CPI IFL application while creating the custom domain.

Conclusion

The approach defined here with Azure Traffic Manager is for Push based interface i.e. Interfaces listening to HTTP traffic. Pull/Interface Polling from a Message Broker / Event Streaming Platform is to be approached differently.