HTTPS Configuration 'PROT=ROUTER' and URL Destination

[Former Member]

I am setting up HTTPS on an ABAP system which has an F5 server in front of it for load balancing purposes.

The F5 server address should be https://myf5address.com - this is also the address that the HTTPS certificate has been paired with.

When I run the ping (default_host\sap\bc\ping) service from transaction SICF, IE opens the URL https://mysapserver.com/sap/bc/ping?sap-client=100

i.e. the ping test opens the URL based on the hostname of the server and I want it to use the DNS 'myf5address.com'

Secondly, http://help.sap.com/erp2005_ehp_04/helpdata/EN/48/99c388d7c46bb9e10000000a42189d/frameset.htm states that for end-to-end SSL, you need to replace PORT=HTTPS with PORT=ROUTER. I have tried this but it didn't work. Instead it cleared the entry altogether from 'transaction SMICM | Services' and when I tested the ping service again, it gave a message saying that it could not find a hostname or port number. I also called the ping service via the f5 address, but that returned a similar error, saying that it could not find the ping service.

How can I resolve these issues?

Thanks.

[Former Member · Accepted solution]

Hi Paul,

You question is not clear because you did not describe your architecture.

Do you use a SAP Web dispatcher between the F5 server and the ABAP system ?

If no, why do you speak about PORT=ROUTER ?

When I run the ping (default_host\sap\bc\ping) service from transaction SICF, IE opens the URL https://mysapserver.com/sap/bc/ping?sap-client=100

This is perfectly logical. how do you want SICF to guess about the F5 server existence ?

If you really want it to know, you have to add entries in the HTTPURLLOC table.

Please, explain better what you try to achieve because it is not clear at all...

Regards,

Olivier

[Former Member · Accepted solution]

Hi Oliver,

The architecture is:

- User accesses an F5 server using an HTTPS address

- The F5 server will load balance the HTTPS request onto one of the SAP ABAP instances (we have a HA cluster - one CI and 5 DI instances)

We are using the F5 BIG-IP server instead of the SAP Web Dispatcher solution.

The online help says that PROT-ROUTER should be used in an SSL end-to-end environment, which is what this is. The only difference is that we are using a hardware based solution (F5 BIG-IP) instead of the software solution (Web Dispatcher).

It looks like the HTTPURLLOC table is the correct resolution. More info here http://help.sap.com/saphelp_nw70/helpdata/EN/42/d547ab30b6473ce10000000a114e5d/frameset.htm

Thanks for the help

[Former Member · Accepted solution]

Paul,

You misunderstood the help : PROT-ROUTER is to be configured on the SAP WEB dispatcher when you want to use end-to-end SSL.

As you don't use the web dispatcher, PROT-ROUTER is of no use for you...

Regards,

Olivier