SAPROUTER string

We found that the SAPROUTER String maintained in Service Connection
Data on SAP Marketplace was automatically changed to
/H/<LAN IP-address or hostname of your SAPRouter>/S/3299
Thereafter SAP Support is not able to logon to our SAP system through
SAP Router. We have checked all the setting for SAP Router and seems
fine.
Our firewall global IP address 59.163.51.149 which NAT to 10.1.2.199.
Kindly guide us the following route string is correct so that we will
update the corrected string.
/H/59.163.51.149/H/10.1.2.199/S/3299

Hi
Just tell t o administrator to allow your IP (Router machine )
Amd sap server IP In your firewall
then sap can login your syste m definetly
best of luck

Similar Messages

How to remote connect from NWBC to r/3 with saprouter string

Hi Experts,
We've just installed and configure Business Client and succesfully login abap system, and i wonder is it possible to remote connect ERP 6.0 Abap system from Business Client via saprouter string,
Regards,

Hi Atakan,
Did you solve the problem?. I need o do the same.
Regards,
Carlos.

ERROR IN SAPROUTER STRING

Dear Team,
We are going to access sap from out side internet without using the office VPN or network.
Now I want to set SAP Router string thru which any person who wants to access our SAP system can do so without getting into our VPN or network. Basically people in Sales when they are at the customer sites.
My saprouter is working fine, as SAP can login to our systems.The NAT is completed so that does not seem any issue.
find the below is our configuration..
Our sap router has configured in SOLMAN SERVER.
For Solman server below are the IP:
132.147.166.3  Private IP for internal access
210.18.50.134Public IP address.
ROUTAB file is in the below path C:\usr\sap\saprouter.
Below is the content of ROUTAB file
SNC connection to and from SAP
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *
SNC connection to local system for R/3-Support
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.19 3202
Access from the local Network to SAP
P 192.168.. 194.39.131.34 3299
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.11 5631
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.11 23
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.19 3389
P * 194.39.131.34 3299
P "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" * *
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.7 3201
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.5 3200
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.5 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.7 3389
deny all other connections
D * * *
Now I want to access my production server with ip =132.147.166.11from outside .
So I had configured the below setting in Sap GUI .
Application server=132.147.166.11                   [public ip of server where saprouter has installed]
SAProuter String=/H/210.18.50.134/S/3299
system id=ELP
system number=02
but when i click on login it is showing below error..
router permission denied(210.18.50.134 to 132.147.166.11 ,sapdp02
location =saprouter 38.10 ON 'SOLMAN'
relese=700
version=38
returncode=-94
counter=012
Is it nacessary to make any change in routab file , as net work admin is saying problem is from saprouter to production server
please help us for the same
Regards
Rabin Nayak
SAP Basis Team

Dear Sourabh,
Thanks for your support, I am using /H/210.18.50.134/H/132.147.166.11/H/ for production server only
& /H/210.18.50.134/H/132.147.166.5/H/ for my developement server.
Please find the below is the Log of dev_rout file.
trc file: "dev_rout", trc level: 1, release: "700"
Mon Mar 29 10:51:26 2010
SAP Network Interface Router, Version 38.10
command line arg 0:     saprouter
command line arg 1:     -r
command line arg 2:     -S
command line arg 3:     3299
command line arg 4:     -K
command line arg 5:     p:CN=SOLMAN, OU=0000849045, OU=SAProuter, O=SAP, C=DE
SncInit(): Initializing Secure Network Communication (SNC)
      PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 8/32/32)
SncInit(): Trying environment variable SNC_LIB as a
      gssapi library name: "C:\usr\sap\saprouter\sapcrypto.dll".
File "C:\usr\sap\saprouter\sapcrypto.dll" dynamically loaded as GSS-API v2 library.
The internal Adapter for the loaded GSS-API mechanism identifies as:
Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2
main: pid = 5260, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)
reading routtab: './saprouttab'
ERROR => invalid token (p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE) in IPadr-string, skip line 11 [nirout.cpp   8585]
Mon Mar 29 10:56:20 2010
checkRoute: route not permitted (15)
ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 'mail.supremegroup.co.in' failed (rc=-94) [nirout.cpp   2243]
Mon Mar 29 10:56:44 2010
checkRoute: route not permitted (15)
ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 'mail.supremegroup.co.in' failed (rc=-94) [nirout.cpp   2243]
Mon Mar 29 11:25:43 2010
checkRoute: route not permitted (15)
ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 '210.18.50.134.sify.net' failed (rc=-94) [nirout.cpp   2243]
I had addedd another twolines in my routab file as below mentioned Hilited mark.
SNC connection to and from SAP
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *
SNC connection to local system for R/3-Support
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.19 3202
Access from the local Network to SAP
P 192.168.. 194.39.131.34 3299
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.11 5631
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.11 23
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.19 3389
P * 194.39.131.34 3299
P "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" * *
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.7 3201
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.5 3200
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.5 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.7 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.5 3299
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.7 3299
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 132.147.166.11 3299
deny all other connections
D * * *
P * * *
I had checked my Public Ip already registered with SAP,still i am getting same error at time of login.
Regards
Rabin
Edited by: RABIN-SAP BASIS on Mar 29, 2010 8:03 AM

RFC with SAProuter-String?!

Hi,
well i am trying to set up a RFC Connection to a external 4.6c because i would like to send an IDoc into our XI. I have no clue if this will work, it seems not to work so I ask all of you if you could give me a hand to use the SAProuter-String inside a RFC-Connection.
I have the router-string, means the /H/Host/H/Service/H/ and also the IP-Adress of the 4.6c- System
Can u please help me?! best regards, Jens
btw, I already posted this question in the XI forum.

Hi Rolf,
well i can only say that we can connect with the SAP-Logon via SAProuter-String - yes. From Client-side i have no clue because i am no admin
Thx for your detailed description - it's the way i did it.
BUT: i have also the IP-Adress of the target 4.6c system. But where to add this IP.
<b>what i have in detail:
Connection type 3
/H/<ip of saprouter seen from source system>/S/3299/H/<ip of 2. saprouter seen from 1. saprouter>/S/3299/H/<ip of destination system seen from saprouter box>
/H/62.XXX.YY.232/S/3299/H/170.XX.YY.54/S/3299/H/170.56.XXX.80
IP-Adress 1. SAProuter: 62.XXX.YY.232
IP-Adress 2. SAProuter: 170.XX.YY.54
destination system: 170.56.XXX.80
</b>
To make it clear: from SAP-Logon everything works fine - but in RFC-Dest. the connection fails!!
Have u any idea what could be wrong? the user is able to connect to the system....
br, cheers, Jens

SAProuter string in SAPlogon pad

Hi Team,
I have read the posts and followed the steps for configuring the saprouter entry in the SAPGui. For some reasons, I am just not able to connect to my SAP system thru the SAPgui. These are the details of our connection
SAProuter is installed as service on our SAP Dev box (windows 2003)
Public ip - 66.147.170.102
This public ip is NAT to the local SAP DEV box 192.168.101.4 where the saprouter is installed.
This is the saprouttab entry
#SNC-connection from and to SAP
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34
#SNC-connection from SAP to local R/3 system for support
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.101.4
3200
#Access from local network to SAPNet - R/3 Frontend
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" * *
P * 194.39.131.34 3299 password
D * * *
Can someone please give me the exact string that should be put in the SAPgui.
Thanks for your help
Vishal

Hi Joe,
Thanks for your quick reply.
My objective is to come in from the internet without using the office VPN or network.
My saprouter is working fine, as SAP can login to our systems.
Now I want to set something thru which any person who wants to access our SAP system can do so without getting into our VPN or network. Basically people in Sales when they are at the customer sites.
The NAT is completed so that does not seem an issue.
I tried using the /H/public ip/H of our saprouter connection, but its not working. Also tried introducing a password in the saprouttab, restarted the service, and then tried with the W parameter, but did not work.
Normally what would be the string if I have to enter it in the SAPlogon.
Thanks,
Vishal

Connect to SAP R/3 using SAP GUI for HTML through saprouter

Hello,
I have my system running on my intranet, but I need to connect some support enginners through an Internet connection. Nowadays some users can connect to QAS and PRO systems using SAP GUI for windows and java with the saprouter string, but the support enginners are using SAP GUI for HTML, do I need a special string or configuration so html users can connect to my system from the Internet?
Thanks in advance.

thanks, I can get the data from SAP R/3 to crystal report.
but still dont know how to do the second question mentioned in previous message:
once the table I want to get the data from is a cluster, and have found the mapping data dictionary of this data cluster, which displayed in crystal report connection as well, however, the data is not what I wanted.

RFC Problem saprouter

Hi Friends,
I want to establish a RFC connection to a system.
Normaly, then I logon to the destination system using the gui I have to provide a saprouter string like /H/123.23.22.222/H/.
So then I connect through rfc how can I provide the string.
Thanks in advance.
Jimbob

Hi Jimbob,
Provide something like "/H/<sap_router_hostname>/S/sapdp99/H/194.39.131.34/S/sapdp99/H/oss001" string into target with sysnr "01". Don't forget to define "sapdp99" in your services file on the host, if it is not exist.
Best regards,
Orkun Gedik

SAP ROUTER CONNECTION STRING FOR SAP SERVERS

Hi,
I want to create saprouter string for accessing ecc6.0 server, router is given with one public ip and my server is in domain,help me in creating saprouter string.
Thanks & Have a good day
Naveen

Hi Naveen,
There are some SAP notes that can help you understand how to create such strings.
The main idea is to create a string like this:
/H/<ip address of your saprouter>/S/<service port of your saprouter>/H/
Regards,
Val

How to fill the SAP router String :

Dear friends ,
During GUI installation 1 field is SAProuter String so what i fill here .
Please guide us for SAProuter String .
i) what is SAProuter String .
ii)What is use of SAProuter String.
Thanks & Regard
SAURAV KUMAR

Dear sourav,
Hope you got answer of your question if not following is the answer.
i think you need to know about the router string first.
router string is nothing but the external IP of the saprouter system which is mapped with the local IP of the saprouter system.
if you know router string you can put it directly, no need to add any thing extra. suppose your router string is 12.35.56.952 you can put it directly over their if you want to access remote SAP system if you are in LAN you don't need to put that.
hope this will solve you problem.
Regards
Rupesh Kr singh

SAPOSS connection Failed (saprouter)

Dear Gurus,
- We have already registered our public ip to SAP.
- Saprouter certificate renewed.
- Telnet functions ok
- Saprouttab ok
Saprouter String : /H/xxxxxx/S/sapdp99/H/194.39.131.34/S/sapdp99/H/oss001
Sm59 error =
Connection Error
Error when opening an RFC connection (LB: Hostname or service of the message ser
ERROR: The connection to the specified message server (? / ?) failed. Please
LOCATION: SAP-Server xxxxxx_00 on host xxxxxx (wp 10)
COMPONENT: MS (message handling interface, multithreaded)
Dev_rout file=
NiBufIProcMsg: hdl 1 received rc=-94 (NIEROUT_PERM_DENIED) from peer
What could be the problem ?
Best Regards

Dear Ashutosh,
3299 port is already opened. What is 3289 port for ? by the way there is saprouttab informations. Also there is 3389 for something. Do you mean that 3289 port should be opened in saprouter machine in firewall ?
# SNC connection to and from SAP
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *
# SNC connection to local system for R/3-Support
# R/3 Server: xxxxxxx
# R/3 Instance: 00
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" xxxxxx 3200
# SNC connection to local WINDOWS system for WTS, if applicable
# Windows server:xxxxxx
# Default WTS port: 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" xxxxxxx 3389
# SNC connection to local UNIX system for SAPtelnet, if applicable
# UNIX server: xxxxx
# Default Telnet port: 23
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" xxxxxx 23

SAPROUTER - connection to partner broken

Hi gurus,
I log to my company using a saprouter (the distance from my office is 300 Km).
All seems to work fine, the only problem (big problem) is that the connection is broken very frequently: I think that the average period lasts 10 minutes. This is the error:
DV1: connection to partner '195.223.140.219:3299' broken
Component     NI (network interface)
Release     710
Version     39
Module     nixxi.cpp
Line          4554
Method     NiRead
Return Code      -6
System call     recv
Error No     10054
Error text     WSAECONNRESET: connection reset by peer
Counter     1
What could be the reason?
I think that the saprouter string is correct because I can log to the system. Also the internet connection seems stable ...
Thanks a lot
Guido

hi guido,
it seems that you have low quality network connection with your SAP server. Check your connection first.
ardhian
http://sapbasis.wordpress.com

Use HTTP connection over SAPROUTER?

hallo
i have 2 saprouters connected so i can access sap with sapgui by using saprouter string
/H/212.xx.xx.xxx/S/sapdp99/H/212.yy.yy.yyy/S/sapdp99/H/
so far no problem
i added entries in saprouttab for port 8000 as well (same es for oss service required)
how can i now access to bsp application by using this saprouter-tunnel?
i find a lot of documentation how to setup the saprouttab for http connection but not how to use it
regards
joerg

> I bet the same applies for http.
yes.
If the SAP support clicks on an HTTP connection some local scripts on their PCs will act as a proxy, so basically the connect "locally" and internal programs/proxies forward that through the saprouter connections.
To make an HTTP access from outside the network possible you can install an apache webserver and configure it as a reverse proxy.
Markus

SAPRouter in SM59

Hi!
I need to create an RFC destination to an external partner (also SAP), and I am supposed to use a SAPRouter string in my communication.
First question is: Do I need to specify the router string in my RFC dest in SM59? I have tried this options, but I get an "hostname unknown" error. Maybe I need to ask the basis guys to add the SAPRouter string to the servers host file?
Thanks!
regards Ole

OK, found the solution. In addition to the SAPRouter string in the host name field, the host name itself should be added:
/H/'ipaddress'/H/'hostname'

SAProuter certificate

Dear Expert,
I would like to ask regarding the SAProuter certificate.
Our SAProuter certificate will expire soon, on June 2009.
However, this year we already discontinue the Enterprise Support maintenance contract.
Therefore we will no longer be able to send OSS messages and also ask SAP support to connect remotely to our SAP Systems through SAProuter and SNC.
Now, since we have other branches and mobile users we were using the SAProuter for them to connect to our SAP System remotely and where they have Internet connection. We use the SAProuter String in the SAP Logon settings to do this.
After June 2009, can we still use the SAProuter for our external users without renewing the certificate?
Thank you and we will appreciate your prompt reply on this matter.
Best regards,
Josephine

Thank you for your reply but when I tried to go into SAP Market Place to apply for a new certificate there was a selection to make in the first part where there is the Target (on SAP-side).
So I realized that I do not need a certificate if we will not use the SNC to connect to SAP for support because since we already discontinue the service then we do not need to connect anymore to SAP for OSS messages or remote connection to and from SAP Support.
Just to make sure I'm in the right track,
The message below is the message we received from SAP when our certificate was about to expire on June 2008.
"Your certificate will expire on 22. June 2008.
IF YOU USE THIS SAPROUTER WITH SECURE NETWORK COMMUNICATION (NOT VPN) THIS WILL MEAN THAT YOU CAN NO LONGER USE THIS SAPROUTER TO ESTABLISH A CONNECTION TO THE SAP SUPPORT."
Does this mean that we only need the certificate for connecting to SAP through SNC for Support?
Now that we do not need to connect to SAP for support then does this mean we can still use the SAProuter program for the purpose of providing a connection to external users (from branch and home users) to our Company's SAP System?
The SAProuter service can be started with different switches and parameters. So if the certificate is only needed with the -K switch for (-K [myname] : activate SNC; if given, use 'myname' as own sec-id) does this mean that I just don't use this -K switch which needs a certificate for the SNC connection to and from SAP then the SAProuter will still run normally?
I'll just start the SAProuter service with the needed switches like the following:
start router : saprouter -r
-R routtab : name of route-permission-file (default ./saprouttab)
and no need for the -K switch anymore since we will no longer need the SNC connection to SAP for support.
To conclude my question, is the saprouter certificate only needed for the -K [myname] switch in the saprouter command?
Please advise.
Thank you.
Josephine

WebGUI iview with SAP route string in system connector

HI SAP Expert
Anyone try creating a WebGUI iview connecting to the backend R/3 instance with a SAProuter String?
We are trying to start a WebGUI connection to an external SAP instance, however the connection require a SAProuter string plus the Application Server address.
Anyone knows where we should specify the SAProuter string? iview or system connector?
Any suggestion will be greatly appreciated.

All I can suggest is to use a SAP Web Dispatcher or similar sitting in a firewall. It's not what you want, but it may alleviate the security concern

SAPROUTER string

Similar Messages

Maybe you are looking for