Timeout occured while connecting sap system from saprouter string

[pnagar]

Dear Expert,

I am getting below issue while connecting my systems from saprouter please help on this.

Plz help on this.

[Isaias_SAP · Accepted solution]

Hello Prashant,

Can you clarify the landscape here?

Are you running the SAP GUI outside of your corporate network (e.g., at home), and want to connect to the SAP systems at the corporate network by exposing the saprouter on the internet?

If that is the case, I would advise not doing it. Be aware that anyone on the internet would be able to at least reach your system's logon screen. This is already too dangerous.

You should consider using a VPN software to create a secure channel to your company's network. This way, only authorized users would be able to connect.

If you wish to proceed nonetheless, at least configure SAP GUI encryption (SNC) to protect the traffic and prevent your data from being stolen.

Proceed at your own risk!

That being said, the error on the SAP GUI suggests that it might not be reaching your saprouter.

You can use the "niping" tool on the SAP GUI folder ("C:\Program Files (x86)\SAP\FrontEnd\SAPgui") to do some tests and see where the connection breaks:

• niping -c -H 120.89.72.135 -S 3299 -O
• niping -c -H /H/120.89.72.135/S/3299/H/10.91.11.119/S/3201 -O

(the last character on the command lines is the uppercase letter 'o', not the number zero)

If the command outputs "connect to server o.k." then the connection was successful, even if an error occurs afterwards.

Regards,

Isaías

[pnagar · Accepted solution]

Dear isaias.freitas

Please find the output of the commands as below.

[Isaias_SAP · Accepted solution]

Dear Prashant,

As sumitjais mentioned, the connection from your machine to the saprouter is fine.

The issue is from the saprouter onwards.

Besides the telnet test from the saprouter to your SAP system (on port 3201) suggested by Sumit, you can also analyze the saprouter trace (dev_rout) and saprouter log (if activated; the log is optional and defined by the "-G <file>" argument on the saprouter command line) to see whether any issues are logged.

Also as Sumit suggested, confirm that the saprouttab allows the connection:

P    <IP from the client1>    10.91.11.119   3201
P    <IP from the client2>    10.91.11.119   3201

-> "IP from the clients" would be the public (internet) IP, not the IP from the computer itself; or you can add an asterisk ("*") which will mean "all IPs", and the danger and risk are increased exponentially 🙂

Best regards,

Isaías

[dasistdochscheisse · Accepted solution]

did you restart the saprouter after changing the saprouttab?

[pnagar · Accepted solution]

Dear Isaias Freitas

Did all the things as suggested by you but from internet issue remains the same. Also one more point that i noticed is i can connect to the sap system internally using sap router string.But issue remains the same when i try to connect the same system from the internet.

[Isaias_SAP · Accepted solution]

Dear Prashant,

Part of me is glad that it is still not working from the internet, as it seems that you going forward with this despite of all our warnings.

This is really dangerous. You should not expose your SAP system on the internet like that.

I would say that we need a level 2 trace from your saprouter to see what is happening.

Regards,

Isaías

[pnagar · Accepted solution]

Thanks isaias.freitas

issue got resloved as port 3299 of saprouter was open for only sapserv9, and i have removed the wild entries from saproutab file as well.

[Isaias_SAP · Accepted solution]

You are welcome pnagar !

But please, consider closing this as soon as possible and moving to a VPN solution... what was done is very dangerous... you should not expose your systems to the internet like that...

[TawfikKHORB · Accepted solution]

Dear isaias.freitas

I got the same problem here and I did the steps you described (screenshot) but I don't know how to solve this issue, I am trying to connect to university server, I got this problem only when I am trying to connect through my WIFI, with other wifi may not happen this issue.

[Isaias_SAP · Accepted solution]

Dear tek_20

Do you have access to the saprouter running on "cloud.ucc.ovgu.de" ?

You could verify whether any issues are logged at its log / trace files.

Since it works on a different WiFi, maybe the saprouter is not allowing your address in?

Perhaps discuss this with the university team responsible for this system.

Regards,

Isaías

PS: sorry for the delay in replying 🙂

[sumitjais]

Hi Prashant,

From your error screen, you are trying to connect your SAP system using sap routerstring ( and without VPN). As isaias.freitas mentioned, you should avoid such connectivity as it's not secure. You may try only for sandbox or demo systems when security is not a concern.

Coming to your issue. The request from GUI to your router is fine, but from your router to your sap system it's not connecting at port 32xx

1. Check if you can telnet from <router host> (you can install telnet client if it is not) -

telnet <sap system IP> 32<instance number>

it must connect.

2.Check if your SAPROUTTAB file has permission entry :

KP <router IP> <sap system ip> 32<instance no>

OR

P <router IP> <sap system ip> 32<instance no>

[pnagar]

Dear sumitjais

i checked all the points suggested by you and everything is ok. but issue still remains the same,

[sumitjais]

Hi Prashant,

If these tests are fine, I don't see any other reason why the connectivity through string will not work. (I could reproduce this issue myself ).

Are you able to reach the router service at port at 3299 (from say sap application)?

You may share the results of the tests.

[pnagar]

Dear Sumit Jaiswal,

On doing telnet to sap router from application server on port 3299 i am getting below issue.

☺NI_RTERR( ∙*ERR*1connection timed out-5NI (network interface)74540D:/depot/bas/745_REL/src/base/ni/nirout.cpp7959RTPENDLIST::timeoutPend: no route received within 20s (CONNECTED)Thu May 28 15:20:56 2020427SAProuter 40.4 on 'DENSOLMAN'*ERR*

Connection to host lost.

[sumitjais]

Hope you got something like " Connected to xxxxx. Escape character is '^]' " before this timeout message.

(If yes,this shouldn't be an issue .This shows timeout after connection on telnet.)

Check : Did you get the connection message on check 1 too (telnet <sap system IP> 32<instance number>) ?

If both telnet are connecting , the issue is with saproutab .

Make this entry in the last in the last of saproutab(this is just for testing!) and restart the router service

P * * * 

[pnagar]

Dear Sumit Jaiswal,

Did all the things as suggested by you but error still remains the same.

[S_Sriram]

Hi Prashant.

Are you able to ping the SAP host from SAP Router? Check with network admin, from SAProuter to SAP host access has been allowed?

Regards

SS

[alejandro_navajas3]

Prashant,

Are you able to login to SAP through a saprouter string connection? Does the timeout error occur after some time you logged in and idle time?

[pnagar]

No,

This is not the case.