saprouttab entry not working

[Former Member]

Hi guys,

I need some help regarding saprouter. My saprouter works fine. Recently, I got an issue with my portal system and so logged the issue to SAP. SAP wants to connect to the system and so I added the following in my saprouttab:

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <portalhostname.domain> 50000

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <backendhostname.domain> 8000

The entry for the portal works because SAP is able to access the portal page but is unable to access the iviews that access the backend. So the second entry seems to be not working. Is there a way I can test the second entry by command line etc?

regards.

[Former Member]

What is the type of the portal system object for the backend system? Is it connection string, dedicated application server or load balancing? In case it is load balancing, you also need to allow the HTTP message server port of the backend system.

[former_member193518]

You could add an entry that permits your PCs IP address through the SAP router, to <backendhostname.domain> on port 8000.

Then from your PC, use NIPING to ping the port.

This depends on how your network is configured.  e.g. Can you access the SAProuter from your PC...

[former_member193518]

Also, you may want to check what hostname is defined for the iview backend access.

hostname.domain  may not be used.  In which case, the SAP person would need to add just hostname to their hosts file.

Previously I've had a VM setup and just permitted them access to RDP into the VM through SAPRouter.  Then this gets round all the peculiarities, plus you can control the environment on the VM so that they can access the O/S level of Windows servers or Unix servers using pre-configured RDP/PUTTY shortcuts/sessions and passwords.
Turn the VM on when they need it only.

Regards.

Darryl

[Former Member]

Thanks Darryl,

Any idea what tool SAP may be using to access my portal system - I may use it to test when I do changes to the saprouttab file?

I was thinking about niping. Niping from Solman to backend server and vice versa is working but maybe I need to check it from outside the network.

regards.

[former_member193518]

No I don't know, sorry.  They have their own that we don't know about.  Something that allows them to route http over RFC and SAProuter.

If your SAProuter is in the DMZ, and if your PC can ping the SAProuter on port 3299 ("C:\Program Files (x86)\SAP\FrontEnd\SAPgui\niping.exe" -c /H/<saprouterhost>/S/3299), then you just need to add your PC IP address into the routtab:

P  <PC_IP>  <HTTPServer>  8000

Then you are permitting:

PC -> SAPRouter -> HTTPServer:8000

You can then try pinging it using NIPing:

niping.exe -c /H/<saprouterhost>/S/3299/H/<HTTPServer>/S/8000

If you get a return code of -6 (NIREAD) then it means it worked, but that the HTTP server disconnected the connection because it didn't get a valid HTTP request.

Hope that gives you a little more hope.

Regards,

Darryl

[周建华]

Note 30289