B2B Deployment Architecture

[Former Member]

Hi - We use SAP PO 7.4 for A2A and are assessing for B2B. I am researching options on what the deployment architecture options are, suspect a PO cluster would reside in the Internal zone that performs majority of integration logic (maping/xform/orchestration...) for both A2A/B2B and components would reside in DMZ to secure the Trading Partner connections (verfiy certs/usernames/passwords, filter out attacks...), DMZ components would hand-off to internal PO after security checks verified. Suspect load balancer would be required also as we would would require HA.

Wondering if anyone can share any information on what components they use for B2B, what function they provide, where they are depoyed and why deployed there, or links that I can look through. (I have scanned various links but not clear to me right now how a Trading Partner would connect and where the security checking/load balancing/EDI mapping/orchestration.. performed)

We will be using typical B2B protocols and formats (AS2, sftp, EDIFACT, X12..).

Thanks in advance

[HoHi-cbs · Accepted solution]

Hi Pat,

to my knowledge there is no offical SAP document in regards to the recommended system architecture for B2B integration.

Using a decentral adapter engine in the DMZ depends on your general architecture and security approach. Most - but not all - customers I know only have a central AEX and use reverse proxies, network and application firewalls to block unwanted attacts and traffic.If you use a decentral AE in the DMZ, it should only forward the data to the central AEX. Otherwise you would open up ports from the DMZ to internal applications which causes even a higher security risk.

If you use a decentral AE, TPM is configured on the central AEX, but the values can also be accessed from the decentral AE.

Regards, Holger