Moving from Solman to C-ALM, what about users with no external network

[Greg_Starke]

Looking forward towards the impending End of Life situation for Solution Manager and the push to C-ALM and FRUN.

My big concern here is how will C-ALM work with customers that do not have or allow external network connectivity.  Since C-ALM will have the Early Watch reporting / recommendations, and we do not have or allow connectivity back to SAP, this is a big concern for us - we use EWR for future planning, weekly reporting, and cyber security compliance.

My question is - how will Earlywatch function in C-ALM to customers that are unable to connect back to SAP?  Is there a plan for some sort of local deployment, integration of EWR functionality into FRUN, or some other method - maybe a longer term Solman deployment for those customers?

[gregorw]

I don't think that SAP will move away from their Cloud Strategy. So I think you have to find ways how the users can access the Internet. Maybe on special jumphosts.

[Greg_Starke]

our implementation - and many related implementations will 100% not have connectivity back to SAP in any way. Today we get EWR from Solution Manager which is regularly patched. SAP is going to have to provide some mechanism with no connectivity to continue to receive those reports and other solman functions they intend to move to C-ALM.

[romysachse]

Hello Greg,
Are you only having on Premise Systems or already some Cloud Systems and already using SAP Cloud ALM?
Generally there are a couple of Services available which can be delivered without a SAP Solution Manager. KBA 2899458 - "Remote Service Delivery without SAP Solution Manager" gives an overview. But indeed for some of the services we would need a data download which might probably not available if all of your systems do not have a connection to SAP.
If you already have a Cloud ALM Tenant you can probably already access services which have been delivered for you cloud systems directly in the CALM tenant. 
Also we do have a customer influencing program running for CALM for Services which is currently running here. If you already have SAP Cloud ALM or plan to use SAP Cloud ALM I would encourage you to submit your request via the influencing.
best regards,
Romy

[Greg_Starke]

All SAP systems - including Solman are 100% on prem and will never have external access we are unable to move to any sort of cloud offering either. My concern overall is if Earlywatch delivery and functions move to SAP cloud ALM, do we just lose access to it because our systems will not be able to send data back to SAP? I have to imagine there will be way to allow this functionality since it is contractually obliged.

[Vera_Jiang]

We helped you to accept the answer, since there were no updates after 7 days. You can unaccept it anytime if the answer provided was not helpful enough and you have further questions.

[Vera_Jiang · Accepted solution]

Dear Customer, 

At the moment, CALM does not have a plan in place to support EWA reports. FRUN does support EWA by sending the content to SAP to generate the reports, therefore it will not function without a connection to SAP. It is recommended to maintain an on-premise Solution Manager to support the EWA report. SAP is aware of customers in this situation and will work towards providing a final solution in the future. Thank you for your understanding and patience.

Best regards,
Vera Jiang 

[SusanneGlaenzer]

There are no plans to integrate the SAP EarlyWatch Alert Report generation into SAP Focused Run. After end of maintenance of SAP Solution Manager, the consumption of the SAP EarlyWatch Alert results is driven by SAP for Me only. The EWA apps in SAP for Me can send out email notifications on critical findings to inform users. If you have a central team with access to SAP for Me, this team can download the EWA reports on demand and share them with users who have no external access in your company.

[Greg_Starke]

So the SAP systems are 100% on prem and will never have access to SAP. How will the data get from the systems to SAP for Earlywatch functions?

[Gavin_G]

Hi 

@Greg_Starke, I only just came across your question.

I understand your question. It seems that there are ever changing ways to connect to connect to 'SAP'. My answer is perhaps more a perspective and to perhaps raise discussion / debate. 

For CALM the 'managed system' set up (/SDF/ALM_SETUP) allows for a Proxy Host, Proxy Port, Proxy Username, Proxy Password. Much as my PC would use to access the internet.

Big picture it does seem the SAP approach is to move to standards and to centralise the network security.

In time sequence as far as I know:

1. SAPROUTER - installed and configured by Basis (??). This would be in a DMZ but nevertheless be exposed to the internet and those supporting it would need to ensure it was hardened and monitor the security
2. Cloud Connector. A reverse proxy. Once again installed and configured by Basis (??) and in the DMZ. More modern and only allows connections to be initiated from inside your network (that's how I understand it). Once again this would be in a DMZ but nevertheless be exposed to the internet and those supporting it would need to ensure it was hardened and monitor the security
3. Connection to CALM using the organisations standard proxy (or perhaps  one dedicated to servers making connections out for Software updated, etc ?)

While I at 1st wasn't sure about the approach, after some thought it made more sense that the security / network team would worry about the connection to the internet and the SAP team would simply take advantage of it. 

Gavin