SAProuter configuration on LAN

How to configure SAProuter, the connectivity with external World is through Hardware Firewall and IP address is configured on Firewall, the Servers are on static IP 192.168.xx.xx Additional IP is on the extra LAN card of Solution Manager. Firewall is not allowing to ping the additional IP which is on the Server.

Hi Hari,
Have you enable NAT in your firewall ? If not then you have to enable the NAT between the Public IP & the static IP on which you want to configure the SAP router.
Secondly you need to make policy to allow the traffic of SAP on this SAP ROUTER system which will be on port 3200 to 3299 as per your config.
Regards
Virendra
Edited by: Virendra Pandya on Jun 27, 2008 2:51 PM

Similar Messages

SNC with SAPRouter configuration for Third party company

Hi expers,
Need your advise for my below scenario.
We are running SAP on IBM i. My question is about outside world connectivity with encryption mechanism to SAP AS.
As of now , we are not using SNC either for internal / external network connectivity with SAP apps server. But we are going to allow third party company to connect for one of the payment processing takes place. Since the third party company not accepting VPN connectivity, we are planning to implement Separate SAPRouter configured with SNC, (encryption option), and open the firewall port for them. How much secured it is ? we are in the process of installaing and configuring windows server for SNC & SAPRouter installation. What are all the required configuration in SAP Application server level & new SNC server, for this ? How exactly SAPGui ( from third party company) to SAP Apps Server will go through the traffic ? Need experts advise on this ?
Basically I want to make sure, once it is configured, trafic will go through encrypted way outside of our network. Thanks in advance for all your valuable reply !

Hi mgrant,
The information at the bottem of the article in in Keith_Beddoe's personal website may help. Link: Using your own router for Infinity
The MTU Size needs to be set as 1492
Cheers
jac_95 | BT.com Help Site | BT Service Status
Someone Solved Your Question?
Please let other members know by clicking on ’Mark as Accepted Solution’
Try a Search
See if someone in the community had the same problem and how they got it resolved.

SAProuter configuration error

Hello Experts,
I have installed SAP ERP 6.0 SR3 on windows server 2003 64bit and done post installation steps.
For SAProuter configuration, I have followed below steps.
1. Downloaded .CAR file and extract into "user/sap/saprouter/ " folder.
2. Created SAProuter services and create same forlder in registry.
Only below link steps I have followed.
http://help.sap.com/saphelp_nw04/helpdata/en/4f/992dab446d11d189700000e8322d00/content.htm
Error / question.
1. SAProuter server will not running.
2. error in DEV_ROUT file i,e ./SAPROUTTAB file is not open.
3. Confused about CRYPROGHAPHY library.
4. Is there any version issue ?
Please suggest me for configuraing SAProuter in system.
Thanks & regards,
Rahul S.

Hello Chris,
There is no saprouttab file created in system.
For creating saprouttab file which command I have to follow ?
At the time of starting SAProuter below error in dev_rout file.
Sat Mar 05 15:36:07 2011
SAP Network Interface Router, Version 38.10
command line arg 0:     saprouter
command line arg 1:     -r
main: pid = 2272, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)
ERROR => fopen './saprouttab' (2: No such file or directory) [nirout.cpp   7611]
**LOG Q0I=> NiRRouttab: fopen (2: ENOENT: No such file or directory OR: The system cannot find the file specified. ) [nirout.cpp 7613]
cannot open './saprouttab': all routing disabled!!!
Could not open permission table
for starting which steps I have to follow ?
Thanks for replay,

SAPRouter configuration: ping to sapserv3 time out

Hello!!!
Could you please help me?
I try to configure RFC connection SAPOSS.
I need it to install ST-A/PI and use SAP Maintanence optimizer...
On saprouter host command
ping sapserv3
is time out...
Error message from sap system:
trc file: "dev_lg", trc level: 1, release: "700"
Tue Dec 2 16:14:58 2008
ERROR => NiBufIProcMsg: hdl 0 received rc=-5 (NIETIMEOUT) from peer [nibuf.cpp    2120]
ERROR => MsINiWrite: NiBufSend (rc=NIETIMEOUT) [msxxi.c      2476]
ERROR => MsIAttachEx: MsINiWrite (rc=NIETIMEOUT) [msxxi.c      731]
ERROR => LgIAttach: MsAttach (rc=NIETIMEOUT) [lgxx.c       3978]
ERROR => LgApplSrvInfo: LgIAttach(rc=LGEMSLAYER) [lgxx.c       1271]
LOCATION    SAProuter 38.10 on 'sap-router-01'
ERROR       connection to 147.204.2.5:sapdp99 timed out
TIME        Tue Dec 02 16:03:17 2008
RELEASE     700
COMPONENT   NI (network interface)
VERSION     38
RC          -5
MODULE      nirout.cpp
LINE        5441
DETAIL      RTPENDLIST::timeoutPend: ROUTED timeout
COUNTER     41
Reason is in sapserv3 firewall?
TIA!
Regards,
Tonya

Hi.
Try to connect to sapserv2 instead, with IP address 194.39.131.34, port 99.
You can change these settings in t-code OSS1 -> Parameter -> Techincal settings.
Also, are you sure that the necessary ports are open in your firewall:
<Customer SAProuter> -> 194.39.131.34:3299/tcp
194.39.131.34 -> <Customer SAProuter>:3299/tcp
<Customer SAProuter> -> 194.39.131.34:icmp (echo-reply, type 0)
194.39.131.34 -> <Customer SAProuter>:icmp (echo-request, type 8)
See SAP Note 48243 for details.
Regards,
Thomas
Edited by: Thomas Kjelsrud on Dec 2, 2008 3:45 PM

Can you help us improve our SAProuter configuration process?

Have you recently discussed installing SAProuter in order to enable remote connectivity to your SAP BusinessObjects systems with an SAP Support Consultant?
Perhaps you have watch a video or read some of the material at http://service.sap.com/remote-supportability ?
If so we would like to hear from you! Please have a look at my recent blog post for more details: Interested in SAProuter? Please let us know.
Thanks!

Alexey Lukin wrote:
That's a good attempt, Steve! You can do even better if you complement Denoiser with Decrackler to reduce that residual buzz, esp. at higher frequencies.
Alexey, I only spent a few minutes on it! The NR really didn't take too long to set up, and I didn't investigate it any further - this was merely an attempt to find out how possible it would be at all, rather than perfection. .
The link you gave appears to have an extra http:// on the end of it which has to be removed before the file will download. Now I've listened to it, I think that a combination of both approaches is the real answer to cleaning it up - that way you get just about zero crackle and less pumping artefacts on the voice. I still think you need the advanced version to get rid of the pumping though, although I agree that you don't for the rest of it.
And for everybody else who's wondering where Alexey has suddenly popped up from - well, basically iZotope, but he also created the RightMark analyser and ExtraBit, and deserves much kudos for everything he's touched! He does a lot of iZotope's DSP and yes, there's some of his stuff in Audition (the radius time and pitch algorithm is his, and obviously there's more in the rest of the iZotope-based plugins).

Error in saprouter configuration

hi
I am trying to configure sap router but when i am tring to import the received certificate sapgenpse import_own_cert -c srcert -p local.pse i get this error
C:\sap_oss\ntintel>sapgenpse import_own_cert -c srcert -p local.pse
import_own_cert: Installation of certificate failed
ERROR in ssf_install_CA_response: (1281/0x0501) aux_file2OctetString failed : "
o such file or directory"
ERROR in ssf_read_certs_from_file: (1281/0x0501) aux_file2OctetString failed :
No such file or directory"
ERROR in aux_file2OctetString: (1281/0x0501) stat("srcert") returned : "No such
file or directory"
C:\sap_oss\ntintel>
pls help me with an solution
regards
senthil

Hi,
you are not able to download the newer version?
try following link ( Note 455033 - SAPCRYPTOLIB versions, bugs and fixes )
SAPCRYPTOLIB software download:
http://service.sap.com/TCS
Download Area -> SAP Cryptographic Software
for 32 bit windows use following
https://websmp104.sap-ag.de/~sapidb/011000358700001216242007E/90000101.SAR
for 64 bit windows use following
https://websmp104.sap-ag.de/~sapidb/011000358700001218362007E/90000114.SAR
regards,
kaushal

Saprouter configuration

Hi,
I am getting follwing error
C:\saprouter\ntintel>sapgenpse get_pse -v -r certreq -p local.pse "CN=solman, OU
=0000731019, OU=SAProuter, O=SAP,C=DE"
Got absolute PSE path "C:/saprouter/ \local.pse".
Please enter PIN:
Please reenter PIN:
Supplied distinguished name: "CN=solman, OU=0000731019, OU=SAProuter, O=SAP,C=D
E"
Creating PSE with format v2 (default)
get_pse: Can't create PSE.
ERROR in af_create: (4352/0x1100) could not flush : "SW-PSE"
ERROR in create_PSE: (4352/0x1100) could not flush : "SW-PSE"
ERROR in modified_PSEFile: (4352/0x1100) could not flush : "SW-PSE"
ERROR in flush_PSEFile: (1283/0x0503) Can't write file : "C:/saprouter/ \local.p
se"
ERROR in aux_OctetString2file: (1283/0x0503) Can't write file : "C:/saprouter/ \
local.pse"
Please help me on this
Regards
Siva

Hi,
Thanks for your reply,
I am geeting diffrent error. When iam applying certificate in service market place it is giving follwing error.
The submitted Distiguished Name (DN) does not match the DN contained in the request for the SAProuter certificate.
Regards
Siva

Configuration help for 2nd lan to lan vpn link

Hello,
I have successfully configured a lan to lan vpn link between two offices. I am attempting to add another link to a 3rd office from my home office but am having some trouble. I have attached my configuration and am hoping someone can help me fix my problem. Right now I have a working vpn to 172.16.0.0/24 network and am trying to set up the link to 172.16.3.0/24 as well. To the new vpn connection I can ping the outside interfaces but can't ping anything internally.
Thanks for your time and help,
Jason

Jason
There is one significant mistake that is easy to fix. You have correctly created a second instance of the crypto map to create a VPN tunnel to the second site. But as currently configured both instances of the crypto map use the same access list:
crypto map clientmap 1 ipsec-isakmp
match address 100
crypto map clientmap 5 ipsec-isakmp
match address 100
But each VPN session/tunnel needs its own access list. So I suggest that you make the following changes:
crypto map clientmap 5 ipsec-isakmp
match address 101
no access-list 100
access-list 100 permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 172.16.3.0 0.0.0.255
This provides a separate access list for each session/tunnel and should resolve that issue. Give it a try and let us know the result.
HTH
Rick

Help required related to solman 7.0 configuration

Dear all,
I am installed solution manager 7 , then download solution manager patches stack 7.0 initial to 26 and apply .SCA in java instance but unfortunately some patches required approval , then I restart server and after startup unable to connect in
http://host:port/nwa and SOLMAN_STEUP web page but I am able to connect config tool, now I am confused that what is the process to configure solman or which steps I follow for example
saprouter configuration ( connect to sap )
Maintenance optimizer
or else
plz guide me and if possible then provide configuration related to solman 7.0
regards
Rayyan Shahid

Hello,
You can follow the SPRO, it has information for every activity that has to be run.
You can also have a look at the Solution Manager 7 EHP1 configuration guide at
https://websmp105.sap-ag.de/~sapidb/011000358700000308502009E.PDF
There are also tutorial documents to configure Solution Manager at
http://service.sap.com/rkt-solman , you can download the ones you need at https://websmp206.sap-ag.de/~sapidb/011000358700001991742008E.zip
Please ask questions related to the content of the guides if needed.
Best regards,
Miguel Ariñ

How to configure Solaris 10 on a dell laptop to connect to internet

Hi,
I am student and have installed Solaris 10 on my Dell laptop using SUN's Virtual box. I also have Opensolaris on my laptop that is able to connect to internet using any available wireless because of its auto settings. Can some one please guide me with the steps or tutorial to configure Solaris 10 to connect to internet either by LAN or wireless(preferable)
Some information about my Laptop:
Windows IP Configuration
Wireless LAN adapter Wireless Network Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::548:a39d:e943:4144%12
IPv4 Address. . . . . . . . . . . : 192.168.100.198
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Ethernet adapter VirtualBox Host-Only Network:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::4112:b7fa:5de1:2f6e%15
IPv4 Address. . . . . . . . . . . : 192.168.56.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Tunnel adapter Local Area Connection* 6:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Tunnel adapter Local Area Connection* 7:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Tunnel adapter Local Area Connection* 11:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Tunnel adapter Local Area Connection* 14:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
ifconfig -a
lo0: flags=2001000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4,VIRTUAL> mtu 8232 index 1
inet 127.0.0.1 netmask ff000000
e1000g0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2
inet 0.0.0.0 netmask ff000000
ether 8:0:27:60:84:8d
#netstat -nrv
IRE Table: IPv4
Destination Mask Gateway Device Mxfrg Rtt Ref Flg Out In/Fwd
224.0.0.0 240.0.0.0 127.0.0.1 lo0 8232* 0 1 U 0 0
127.0.0.1 255.255.255.255 127.0.0.1 lo0 8232* 0 33 UH 976 0
Please let me know if you need any other information

For a start I would give my interface an inet number:
ifconfig <interface> inet <ip_address>
ifconfig e1000g0 inet 192.168.100.198
...further than that I would need to study.
Also see " How to configure internet Solaris 10" thread .
http://forums.sun.com/thread.jspa?threadID=5093731&tstart=0
Edited by: plasmichive on Nov 10, 2009 10:25 AM

Can the RV180W have multiple SSIDs with different security configurations?

I am trying to configure the RV180W with a guest network and regular wireless network. The regular wireless network is just a bridge to the wired network, using WPA2-Pers for authentication. I built and enabled another wireless SSID, using a different VLAN and no authentication. I can get both SSIDs to function at the same time if I turn off security. Once I turn on Security, the regular one no longer functions.

It is actually all in the manual:
SEE: PDF MANUAL
Page 63 of PDF and onwards
Do note that you need to assign multiple VLAN per SSID. Check the manual it is there :D
and based on the manual you need to enable multiple VLAN support: See page 34 of the manual: Configuring Virtual LAN (VLAN) Membership
Don't forget to rate and mark as answer helpful posts! :)

ASA 5520: Configuring Active/Standby High Availability

Hi,
I am new to Cisco firewalls. We are moving from a different vendor to Cisco ASA 5520s.
I have two ASA 5520s running ASA 8.2(5). I am managing them with ASDM 6.4(5).
I am trying to setup Active/Standby using the High Availability Wizard. I have interfaces on each device setup with just an IP address and subnet mask. Primary is 10.1.70.1/24 and secondary is 10.1.70.2/24. The interfaces are connected to a switch and these interfaces are the only nodes on this switch. When I run the Wizard on the primary, configure for Active/Standby, enter the peer IP of 10.1.70.2 and I get an error message saying that the peer test failed, followed by an error saying ASDM is temporarily unable to connect to the firewall.
I tried this using a crossover cable to connect the interfaces directly with the same result.
Any ideas?
Thanks.
Dan

The command Varun is right.
Since you want to know a little bit more about this stuff, here goes a bit. Every interface will have a secondary IP and a Primary IP where the Active/Standby pair will exchange hello packes. If the hellos are not heard from mate, the the unit is delcare failed.
In case the primary is the one that gets an interface down, it will failover to the other unit, if it is the standby that has the problem, the active unit will declare the other Unit "standby failed). You will know that everything is alright when you do a show failover and the standby pair shows "Standby Ready".
For configuring it, just put a secondary IP on every interface to be monitored (If by any chance you dont have an available secondary IP for one of the interfaces you can avoid monitoring the given interface using the command no "monitor-interface nameif" where the nameif is the name of the interface without the secondary IP.
Then put the commands for failover and stateful link, the stateful link will copy the connections table (among other things) to avoid downtime while passing from One unit to another, This link should have at least the same speed as the regular data interfaces.
You can configure the failover link and the stateful link in just one interface, by just using the same name for the link, remember that this link will have a totally sepparate subnet from the ones already used in firewall.
This is the configuration
failover lan unit primary
failover lan interface failover gig0/3
failover link failover gig0/3
failover interface ip failover 10.1.0.1 255.255.255.0 standby 10.1.0.2
failover lan unit secondary
failover lan interface failover gig0/3
failover link failover gig0/3
failover interface ip failover 10.1.0.1 255.255.255.0 standby 10.1.0.2
Make sure that you can ping each other secondary/primary IP and then put the command
failover first on the primary and then on the secondary.
That would fine.
Let me know if you have further doubts.
Link for reference
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008080dfa7.shtml
Mike

WAN router LAN interface Best practice for speed

Hello
I have an ASR router with a WAN link of 100M.
The LAN connection for this router is Gig capable.
Should I configure the LAN interface on the router for Gig or would this cause problems with potentially 10 times the data
exiting the LAN out to the WAN with only a 100M pipe?

Disclaimer
The Author of this posting offers the information contained within this posting without consideration and with the reader's understanding that there's no implied or expressed suitability or fitness for any purpose. Information provided is for informational purposes only and should not be construed as rendering professional advice of any kind. Usage of this posting's information is solely at reader's own risk.
Liability Disclaimer
In no event shall Author be liable for any damages whatsoever (including, without limitation, damages for loss of use, data or profit) arising out of the use or inability to use the posting's information even if Author has been advised of the possibility of such damage.
Posting
If you set your LAN interface to run at 100Mbps, likely you would just be moving your possible bottleneck one hop deeper into your LAN (often on devices with weak QoS support).
Leave your LAN interface at gig. If congestion, on WAN egress, becomes an issue, you can then try QoS to mitigate it. For example, for starters, you might want to place your WAN egress traffic into fair-queue.

Interface configuration in UCS 6120

Experts, first I need to admit I am new to this technology.
With reference to some issue in our network I have identified I need to change the native vlan configuration for the UCS 6120 from the nxos cli.
Question is how to do this?
I have looged into the cli and see this command:
hou-rd-ucs03-6120-A(nxos)# sh run int eth1/1
!Command: show running-config interface Ethernet1/1
!Time: Thu Jul 12 06:43:32 2012
version 5.0(3)N2(2.02q)
interface Ethernet1/1
description U: Uplink
switchport mode trunk
switchport trunk native vlan 15
switchport trunk allowed vlan 1,10,15,20,25,29-32,34
spanning-tree bpduguard disable
no shutdown
hou-rd-ucs03-6120-A(nxos)#
I need to change that native vlan to 3, how do I do this?
Regards,
Nikhil

Hello Nikhil,
The NX-OS CLI context on Fabric Interconnect ( FI ) is read only and we cannot make any configuration changes from that space.
You need to use UCS Manager to make the necessary changes.
http://www.cisco.com/en/US/docs/unified_computing/ucs/sw/gui/config/guide/2.0/b_UCSM_GUI_Configuration_Guide_2_0.html
I guess you might have disjoint L2 where different uplinks needs to have different native VLANs.
You need to configure under LAN tab using LAN manager.
HTH
Padma

SNC Configuration

Hi Gurus,
I am working on the Contract Manufacturing Scenario for SNC. The system landscape is ECC-XI-APO-ICH.
When Purchase Order is created idoc is sent out to XI already but having problems with sending XI to APO.
Do you know if there are SNC Configurations to be done in SCM as the receiver of the XML Message.
Thanks a lot for your answers.
Regards,
Armi

Hi Armi,
Hi,
SAProuter/SNC via Internet
u2022 SNC secured SAProuter u2013 SAProuter connections are established between SAP and the customeru2019s SAProuter to provide data confidentiality and integrity services. These SNC connections complement the leased lines in the current SAPNet R/3 Frontend environment. State-of-the-art encryption, authentication, and access control technology will be employed. No additional hardware compared to a leased-line setup is required at either end of the connection. (See diagram below).
u2022 Customers are required to install a SAProuter with an official, static IP address (DHCP Addresses will not work) running SNC inbound and outbound connection to SAP at their end of the connection in a Demilitarized Zone. This SAProuter must be accessible from the Internet. All service connections between SAP and the customer must be made over the respective SAProuters.
u2022 Certificates needed are available on the SAP Service Marketplace.
Requirement:-
Internet connection: recommended
minimum bandwidth = 64 kbps
SAProuter machine
Official IP address (static) for the SAProuter host.
SAProuter installation package
SAP SNC libraries and executables.
These may be downloaded from the SAP Service Marketplace.
A Demilitarized Zone at the customer site with a minimal setup as described in the networking section at: http://service.sap.com/SYSTEMMANAGEMENT Choose: Security > Technical Track
SAP Security Guide.
More information on SNC connections is also available in the SAP Service Marketplace.
Since the host running the SAProuter software is a full computer with operating system, the security at the operating system level must be hardened in order to minimise the risk of the machine being hacked from the Internet. One recommendation will be for example to run a C2 security level compliant operating system. SAP takes no liability if the security of the companyu2019s network is compromised.
Other networking equipment (routers and hubs) needed to form the network at the customeru2019s premises
Comparisions
Property SAProuter / SNC via Internet
Hardware requirements Firewall + SAProuter host in DMZ
Software SAProuter starting from NI version 35
SAPSECULIB can be obtained from the Service Marketplace
Network addresses (besides address of Internet router, firewall, u2026) 1 official static IP address for SAProuter
Configuration issues Careful setup of saprouttab necessary for security. Saprouttab influences security strongly as access is controlled via saprouttab and firewall.
Encryption By software
Encrypted data TCP packets
Only the data stream between SAProuters is encrypted
Encryption is handled on Application layer (OSI network layer 7)
Minimum required free bandwidth 64 kbit/s but may work also with
32 kbit/s
Supported services on SAP side All except FTP (files download)
Key management Digital certificates being requested via Service Marketplace Public Key Infrastructure (PKI)
Key storage In file system
Operating system SAProuter resides on a computer
therefore it is necessary to harden the security at the operating system level (for example, C2 level OS) to minimize the risk of the machine being hacked from the Internet
Additional expertise SAProuter knowledge usually available, SNC configuration requires additional knowledge
Standards Based on SNC, SAP proprietary standard
Contributing to costs u2022 Firewall hardware and software
u2022 Firewall administration costs
u2022 No additional license fee for security library based on SECUDE
Hope this helps.,
Thanks,
Naga

SAProuter configuration on LAN

Similar Messages

Maybe you are looking for