Sapwebdispatcher: ERROR: Connection to message server failed

Question

Hi Team,
We have been facing an issue on the webdispatcher. Web-disaptcher is notable to communicate with the Message Server[PRD-XI].
=====================
Environment: Set-up =
=====================
1. The Webdispatcher is in DMZ. We have opened the port 8100 at the firewall.
==========================================================================
ERROR MESSAGE
==========================================================================
[Thr 2058] Fri Jan 11 18:53:27 2008
[Thr 2058] *** ERROR => NiBufIConnect: non-buffered connect pending after
5000ms (hdl 4;10.1.10.56:8100) [nibuf.cpp 4611]
[Thr 2058] *** ERROR => Connection request from (-1/65535/0) to host:
10.1.10.56, service: 8100 failed (NIECONN_REFUSED)
[icxxconn_mt.c 2738]
[Thr 2058] *** ERROR => IcmConnClientRqCreate() failed (rc=-8)
[icrxx_mt.c 5100]
[Thr 2058] *** ERROR => Could not connect to SAP Message Server at
10.1.10.56. URL=/msgserver/text/logon?version=1.2 [icrxx_mt.c 2459]
[Thr 2058] *** ERROR => rc=-1, HTTP response code: 0 [icrxx_mt.c 2460][Thr 2058] *** ERROR => see also OSS note 552286 [icrxx_mt.c 2461]
==========================================================================
SAPWEBDISPATCHER VERSION DETAILS:
==========================================================================
wd011:wpiadm 73> sapwebdisp -v
SAP Web Dispatcher Version 7.00.10, multithreaded, ASCII, 64 BIT
kernel information
system name =
kernel release = 700
database library =
compiled on = AIX 2 5 005DD9CD4C00
compile time = May 19 2007 01:59:47
update level = 0
patch number = 110
source id = 0.111
supported environment
operating system
AIX 1 5
AIX 2 5
AIX 3 5
=============================================================================
TEST OUTPUT
==========================================================================
wd011:wpiadm 71> sapwebdisp -bootstrap
SAP Web Dispatcher Bootstrap
============================
This bootstrap will perform the following steps:
1. create profile file "sapwebdisp.pfl"for SAP Web Dispatcher (if not
already existing)
2. create user for web based administration in file "icmauth.txt"(if notalready exisiting)
3. start SAP Web Dispatcher with the created profile
After the bootstrap you can use the web based administration
Generating Profile "sapwebdisp.pfl"
Hostname of Message Server (rdisp/mshost): 10.1.10.56
HTTP Port of Message Server (ms/http_port): 8100
Checking connection to message server...
ERROR: Connection to message server failed: NIECONN_REFUSED
Do you want to continue with these settings? no
==========================================================================
BACK-END APPLICATION MESSAGE SERVER DETAILS: SID: PPI [PI/XI]
==========================================================================
icm/server_port_0 PROT=HTTP,PORT=80$$
ms/server_port_0 PROT=HTTP,PORT=81$$
trc file: "dev_ms", trc level: 1, release: "700"
[Thr 1] Thu Jan 3 15:31:05 2008
[Thr 1] WLM Tag 'PPI/MSG' successfully set for this process
[Thr 1] MsSSetTrcLog: trc logging active, max size = 20971520 bytes
systemid 324 (IBM RS/6000 with AIX)
relno 7000
patchlevel 0
patchno 110
intno 20050900
make: multithreaded, Unicode, 64 bit, optimized
pid 2519162
[Thr 1] ***LOG Q01=> MsSInit, MSStart (Msg Server 1 2519162)
[msxxserv_mt. 1824]
[Thr 1] SigISetDefaultAction : default handling for signal 20
[Thr 1] load acl file = /usr/sap/PPI/SYS/global/ms_acl_info
[Thr 1] MsGetOwnIpAddr: my host addresses are :
[Thr 1] 1 : [10.1.10.56] pi100 (HOSTNAME)
[Thr 1] 2 : [127.0.0.1] loopback (LOCALHOST)
[Thr 1] 3 : [10.1.99.4] pi100v (NILIST)
[Thr 1] MsHttpInit: full qualified hostname = pi100
[Thr 1] HTTP logging is switch off
[Thr 1] set HTTP state to LISTEN
[Thr 1] ms/icf_info_server : deleted
[Thr 1] *** I listen to port sapmsPPI (3600) ***
[Thr 1] *** I listen to internal port 3900 (3900) ***
[Thr 1] *** HTTP port 8100 state LISTEN ***
[Thr 1] CUSTOMER KEY: >R1306811094<
[Thr 1] Thu Jan 3 15:31:28 2008
[Thr 1] MsHttpReadUrl2: H-1 url = /sap/public/icf_info/urlprefix (403
Forbidden)
[Thr 1] MsHttpReadUrl2: H-1 url = /sap/public/icf_info/logon_groups (403
Forbidden)
======================+++++++++++++++++++++++++++==============================
Please find the attached file for a better understanding of the trace file.
A quick action on this would be much appreciated.
Please let me know for any information required.
Thank you.
Regards,
~sagar

Answer 1

Vipin,
I don't have access to our firewall myself to confirm what ports and services we opened (I worked with our Network Operations team to get this done), but if I recall correctly, it was pretty limited, just http and https over tcp ports 80, 443, 8100, and 8101.  Probably could even restrict that to just https over 443 and 8101.  However, from your configuration, you don't yet have your web dispatcher configured to talk to your message server over https, only http.  I would recommend that you get the web dispatched completely configured and working in as close to your final desired configuration as possible while keeping it inside your firewall, not your dmz.  Then move it to the dmz and see what breaks, and that way you know it's just the firewall that needs configuration at that point.
To configure the SSL termination, the following are the parameters required and the way that I configured them in our scenario (which terminates incoming SSL requests and re-encrypts them when sending them on to the backend, and also uses SSL for message server communication):
rdisp/mshost = mshost.domain.org
ms/https_port = 8101
wdisp/server_info_protocol = https
wdisp/group_info_protocol = https
wdisp/url_map_protocol = https
icm/server_port_1 = PROT=HTTPS,PORT=443,TIMEOUT=30,PROCTIMEOUT=600
icm/server_port_2 = PROT=HTTPS,PORT=8101,TIMEOUT=30,PROCTIMEOUT=600
icm/host_name_full = wdhost.domain.org     (note, use the externally visible name as registered on your SSL certificate for web dispatcher here; does not need to match the actual machine hostname, but must be resolvable in external DNS)
icm/HTTP/admin_0 = PREFIX=/sap/admin,DOCROOT=\usr\sap\RW1\W00\data\icmanroot/admin,AUTHFILE=\usr\sap\RW1\SYS\global\security\data\icmauth.txt,PORT=8101
ssl/ssl_lib = $(DIR_EXECUTABLE)\sapcrypto.dll
ssl/server_pse = $(DIR_INSTANCE)\sec\SAPSSLS.pse
ssl/client_pse = $(DIR_INSTANCE)\sec\SAPSSLC.pse
wdisp/ssl_encrypt = 2
wdisp/ssl_auth = 1
is/HTTP/show_detailed_errors = FALSE
wdisp/permission_table = $(DIR_INSTANCE)\sec\ptab
On the backend host I have the following parameters:
sec/libsapsecu = \usr\sap\RP1\DVEBMGS00\exe\sapcrypto.dll
ssl/ssfapi_lib = \usr\sap\RP1\DVEBMGS00\exe\sapcrypto.dll
ssl/ssl_lib = \usr\sap\RP1\DVEBMGS00\exe\sapcrypto.dll
ssf/name = SAPSECULIB
icm/server_port_2 = PROT=HTTPS,PORT=443,PROCTIMEOUT=-1
ms/server_port_1 = PROT=HTTPS,PORT=8101
Naturally, a server certificate is configured on the backend that the web dispatcher trusts (it can be an internally generated certificate; the outside public just needs to trust the web dispatcher's certificate, so that one should come from a recognized CA).  Port 8101 is NOT open from the outside, just from the dmz and only to/from the web dispatcher host (this does allow me to use the webadmin interface from the inside).  The https service also has to be activated on the backend in SMICM.
There's good advice about security setup for the web dispatcher in Note 870127, and troubleshooting advice in the Note mentioned in your tracefile output, 552286.  Fairly complete documentation is in the online help at http://help.sap.com/saphelp_nw70/helpdata/en/de/89023c59698908e10000000a11402f/frameset.htm.  Note 538405 is also good, more for performance configuration than security.
I hope you find this helpful.
--Matt