This document explains the step-by-step procedure for the setting up of SAP router 7.0 with SNC technology on UNIX. Your SAProuter should be located in DMZ and you must open port 3299 for incoming and outgoing traffic between 144.36.54.31 and 194.39.131.34. From tcode OSS1 you will not be able to logon, but when you configure OSS1 correctly, you should be able to perform a connection test for RCF destination SAPOSS in tcode SM59. Saprouter -r -K 'p:CN=example, OU=, OU=SAProuter, O=SAP, C=DE' If you omit -S, the process is being started on default Port 3299. Note: If the O.S. Of SAProuter is OS400, implement SAP Note 1818735. If SAProuter fails to start, also implement C-runtime packages as described here: C-runtimes needed to run SAP executables. Hi all, I am doing router installation step by step process, we have all ready register SAProuter at service marketplace. Now i am download SAPSECULIB and SAPCRYPTO from service marketplace and copy saprouter.exe and niping.exe into.

Introduction

SAPRouter is a software based proxy used for communications among SAP based systems on-premise or with SAP global support centers. If you have all your SAP systems on your internal network you may not need SAPRouter unless you want SAP global support centers getting remote access to you servers for troubleshooting and monitoring. That is why I highly recommend to have SAPRouter in place regardless of your network architecture.

Placement

You may place SAPRouter in your DMZ or inside your network and the choice is entirely yours. However, you must make sure that your firewall rules are changed accordingly to allow the following:

1) Your SAPRouter can connect to SAP global support centers on ports 3299 (TCP) and ICMP Ping (UDP). A list of IPs for the global support center is provide on SAP Note # 48243.

2) The SAP global support centers can connect to your SAPRouter on ports 3299 (TCP) and ICMP Ping (UDP). You must have a public IP routing to your SAPRouter preferably associated with a public DNS.

3) Your on-premise SAP systems can connect to your SAPRouter on ports 3299 (TCP) and ICMP Ping (UDP).

4) Your SAPRouter can connect to your on-premise SAP systems on any regular port (>1023).

Installation

The SAPRouter is available for most Windows and UNIX/Linux distributions. Here are the steps to install:

1. Download SAPRouter specific to your OS and distribution from the SAP support portal (https://support.sap.com).

NOTE: The following instructions are for Windows system only. But instructions for UNIX/Linux are not that different. Please follow this as a general guideline.

2. The above download may most probably be a .SAR file. You need to download a utility called SAPcar to extract the .SAR file. E.g. (for Windows)

sapcar.exe -xvf 'saprouter_622-20010469.sar'

3. After the extraction, you would find the following three files:

1) niping.exe

3) patches.mf

4. Copy the files to a location on the server. E.g. Create D:usrsapsaprouter, D:usrsapsaprouterlogs and D:usrsapsaproutertraces folders. Copy the above files to D:usrsapsaprouter.

5. Create an empty text file called saprouttab at D:usrsapsaprouter.

NOTE: Prior to Windows 2003 there were no native tools to manipulate windows services. That is when SAP recommended to use ntscmgr.exe. This tool is no longer supported on Windows 2003 and later systems.

6. The command to install the service is:

sc.exe create <NameOfTheService> binPath= '<PathToServiceExecutable> service -r <parameter>' type=own start=auto

For example, the following will install a windows service called SAProuter with autostart with log files rolling off at 1MB with trace verbose level set at 1 and restart count set at 3. For more information, you may refer to the SAProuter installation guide.

sc.exe create SAProuter binPath= 'D:usrsapsaproutersaprouter.exe service -r -G D:usrsapsaprouterlogssaprouter.log -J 1048576 -T D:usrsapsaproutertracessaproutertrace.log -V 1 -E -Y 3' type= own start= auto

Smoke Test

1. After the service is installed, start the service.

2. Check the logfile at D:usrsapsaprouterlogs to verify that the service started successfully.

3. You now need two other machines to server as a test server and a test client. Copy niping.exe to both the machines.

4. On the box designated as the test server, start niping as follows:

niping -s

5. On the box designated as the test client, start niping to connect to the test server as follows:

niping -c -H testserverboxname

6. After the above ping test is successful, on the box designated as the test client, start niping to connect to the SAProuter via the test server as follows:

niping -c -H /H/saprouterboxname/H/testserverboxname

NOTE: Instead of box names, you may use IP addresses.

You may receive a 'route permission denied' error while running the above test. We'll get back to it later.

7. On the box designated as the SAProuter, do a self test as follows:

niping -t

The result should be OK.

8. On the SAProuter box, stop the SAProuter service, open D:usrsapsaproutersaprouttab with notepad and add the following entry:

S 10.124.*.*

where 10.124 is the subnet that your test client and server machines are.

9. Save the file and start the service again. Run the test from test client again:

niping -c -H /H/saprouterboxname/H/testserverboxname

The ping should be successful.

Add your SAProuter to SAP

1. Work with your network team to create a public DNS and IP and have it NATed to your SAProuter box. Make sure the firewall rules as explained under 'Placement' section are still in place. E.g.

DNS 'A' Record

Public Address: saprouter01.example.com

2. Download SAP Note 28976 (Remote connection data sheet) and fill it out. There are several connection types supported by SAP including VPN and dial-up. The simplest way is to configure it via secured connections on internet. If that is the case, fill out only the 'Remote connection data sheet (Internet)' section.
3. Create an incident with SAP with component 'XX-SER-NET-NEW'. The short description should say 'Remote Connection Data Sheet'. Attach the filled out remote connection data sheet.
4. Once it has been worked by SAP, you would see that your SAP router is added to your organization's SAP router list. To check, go to https://support.sap.com/remote-support/saprouter/saprouter-certificates.html and click on 'Apply Now' button on the right. You should see something like the following:

Target (on SAP-side)

CN=SAPROUTER01, OU=0000123456, OU=SAProuter, O=SAP, C=DE

5. Click on 'Continue' button. On the next screen, copy the distinguished name (DN) to notepad. The DN should look like:
CN=SAPROUTER01, OU=0000123456, OU=SAProuter, O=SAP, C=DE
6. Cancel this request for the time being, as we have more work to do as below.

Secure the connection

In order to secure connection between your SAProuter and SAP's SAProuter, you need to enable SNC (Secured Network Connection). There are several steps involved here.

Install SAP Cryptolib

1. Download SAPCryptolib specific to your OS and distribution from the SAP support portal (https://support.sap.com).

NOTE: The following instructions are for Windows system only. But instructions for UNIX/Linux are not that different. Please follow this as a general guideline.

2. The above download may most probably be a .SAR file. You need to download a utility called SAPcar to extract the .SAR file. E.g. (for Windows)

sapcar.exe -xvf 'SAPCRYPTOLIB_38-10010888.SAR'

3. After the extraction, you would find the following files/folders:

1) ntia64

3) nt-x

Saprouter Installation Step By Step