Use HTTP connection over SAPROUTER?

[JK]

hallo

i have 2 saprouters connected so i can access sap with sapgui by using saprouter string

/H/212.xx.xx.xxx/S/sapdp99/H/212.yy.yy.yyy/S/sapdp99/H/

so far no problem

i added entries in saprouttab for port 8000 as well (same es for oss service required)

how can i now access to bsp application by using this saprouter-tunnel?

i find a lot of documentation how to setup the saprouttab for http connection but not how to use it

regards

joerg

[former_member291008 · Accepted solution]

Just found this, so I thought to update here as well :

SAProuter as Port Forwarder

SAP NetWeaver Security Guide - SAP Library

Basically it explains how to setup port-forwarding using the SAProuter so you can use Telnet, HTTP and whatnot over a SAProuter connection.

Cheers!

[Former Member · Accepted solution]

Simplified here with example

[ghulamraza]

Dear All,

I have situation that our sap HANA 2021 server needs HTTPS connection to our third party APIs which is on https://xyz.com/index.asp to insert entries into their system. I have opened https port on my firewall and it is working fine but i doubt it is a security hazard to open a direct connection on SAP server.

I want to use SAP Router for this purpose as we use in RFCs but dont know how?

Please help to set it security.

Regards

[周建华]

Do you solved？

[周建华]

Do you solved？

[former_member291008]

Yes, using the link above, I was able to (ab)use the SAProuter as a gateway for connections other than SAP standard.

[Former Member]

Do you like to share the information about how you accomplished this (especially how to specify a route string on clients other than SAP GUI)?

[former_member291008]

You setup the Route strings on the SAProuters.

From your front-end computer you request the http page with one important exception: You do not request it from the endpoint -the server hosting it- but from the Client-SAProuter which will forward the request to the Server-SAProuter which in turn will forward it to the Server.

This is the principle of port-forwarding, ask your network specialist about it if you do not understand.

Read the article linked above and the linked pages and you do not have to be a Network Guru to get it working.

Cheers!

[former_member291531]

Hi Martin,

but the thing is, we never start the SAPRouter at our side using -i (Reverse Invoke), if I remember correctly.

Yet, SAP is still able to connect HTTP or Telnet into our system.

So there could be another trick used by SAP. They are not using this port forwarding feature in SAP Remote Support connection.

Thanks, by the way, for the link.

It's awesome.

[Former Member]

Hello,

From my understanding, the saprouter routes HTTP only for SAP OSS connection.

I never found a way to use it for HTTP except for this specific use.

This is not a real reverse proxy and how would you specify the saprouter chain in a web browser ?

For dual sapgui and BSP use over a wan link, we put both a saprouter and a reverse proxy (Apache or SAP Web dispatcher) in the DMZ.

Regards,

Olivier

[JK]

ok

i just thought when sap can access over oss we might be able to use this(how can they?)

regards

joerg

[Former Member]

>(how can they?)

That seems to be their (well kept) secret !

Olivier

[Former Member]

some solution known?

can we connect our EP over SAPROUTER???

regards

Chris

[Former Member]

This has been discussed here with saprouter and telnet:

I bet the same applies for http.

Cheers Michael

[markus_doehr2]

> I bet the same applies for http.

yes.

If the SAP support clicks on an HTTP connection some local scripts on their PCs will act as a proxy, so basically the connect "locally" and internal programs/proxies forward that through the saprouter connections.

To make an HTTP access from outside the network possible you can install an apache webserver and configure it as a reverse proxy.

Markus

[Former Member]

I guess not anymore:) I somehow cracked the hidden features of saprouter.

All info are publicly available anyway, so I was just piecing them in together.

See my article