UI5 App with Standalone App Router gets: Timed out waiting for tunnel to open for tunnelId account

[ckuczera]

Dear SAP Community,

we are facing an Issue having the following application setup:

• UII5 Application with Connection to On Premise Backend System
• XSUAA User Authentication, Principle Propagation SSO to On-Premise System
• Standalone App Router to be able to access the application using dedicated URL

The application. returns the following connection timeout when accessing the On-Premise Backen System: Timed out waiting for tunnel to open for tunnelId account:///subaccount-id

The Error Message is displayed as soon as the metadata file is requested from on premise backend.

We already checked:

• Cloud Connector / Destination is working as expected in BAS and Managed App Router Scenarios
• Connection to Backend works as expected for Workzone advanced, Managed App Router Applications and BAS running in same Subaccount and using the same destination
• Application Logs are empty, only error message can be found without further details
• Cloud Connector Logs do not contain any further details

The error occurs when switching to standalone app router in mta config.

Project Setup:

Please find attached mta.yaml, xs-security.json and approuter xs-app.json files.

Appreciate any helpfull hint.

Thanks

[ravijnj]

Hi
were you able to solve this? we're also facing same issue. 

[ckuczera · Accepted solution]

@ravijnj 

Yes we were able to solve the issue. At the end the request from cloud connector to the connectivity service IP addresses of the BTP wrer blocked by firewall settings. Only a set of IP addresses was allowed to be accessed by the cloud connector.

In fact this worked fine using the managed app router. But after deploying a standalone app including own app router, connectivity and destination service the ip address changed

[Joseph_1001 · Accepted solution]

Hi, What was the service request template you used? Which IPs did you add? I'd like to have an example of how to request it from SAP