FTPS receiver side - Connection problem:connection timed out: connect

[Former Member]

Hi experts,

I must connect to an external server to send files with FTPS.

I have created receiver CC with connection security: FTPS for control and data connection

Command order: TLS, USER, PASS, PBSZ, PROT

Connect mode: per file transfer

port : 990 (given by third part)

data connection: passive (suggested by third part)

My problem is that communication channel raise a connection timed out error, see below for log.

I've already followed the steps suggested by this thread:

but no luck.

Thanks

Fabio Boni

2011-05-18 12:21:01 Success Connecting to FTP server "ftps.xxx.xxx.it"

2011-05-18 12:21:02 Success Write to FTP server "ftps.xxx.xxx.it", directory "/in", -> file "Delivery20110518-122102-155.xml"

2011-05-18 12:21:02 Success Transfer: "BIN" mode, size 1760 bytes, character encoding -

2011-05-18 12:21:23 Error Attempt to process file failed with java.net.ConnectException: Connection timed out: connect

2011-05-18 12:21:23 Error Exception caught by adapter framework: Connection timed out: connect

2011-05-18 12:21:23 Error MP: Exception caught with cause com.sap.aii.af.ra.ms.api.RecoverableException: Connection timed out: connect: java.net.ConnectException: Connection timed out: connect

2011-05-18 12:21:23 Error Delivery of the message to the application using connection File_http://sap.com/xi/XI/System failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: Connection timed out: connect: java.net.ConnectException: Connection timed out: connect.

[Former Member]

You may have to check with the third party if you can access any other port.

According to SAP note 1554886 - Implicit FTPS is not supported by the XI/PI FTP Adapter:

Using implicit FTPS (i.e., specifying 990 for the control port in the channel configuration) which is an old standard - not

included in the RFC 4217 specification - that is not supported by the XI/PI FTP Adapter.

[maciej_jarecki]

Hi

try this blog

/people/rajasekhar.reddy14/blog/2010/04/13/how-to-configure-ftps-in-file-adapter

It seems that PI do not have access to FTP using ssl. Run file zilla ftp clint on PI server and try to connect to FTPS. Also ask network team, do they see any traffic

BR

MAciej

[Former Member]

As Fabio said, the file adapter log return this log:

2011-05-18 12:21:01 Success Connecting to FTP server "ftps.xxx.xxx.it" 
2011-05-18 12:21:02 Success Write to FTP server "ftps.xxx.xxx.it", directory "/in", -> file "Delivery20110518-122102-155.xml" 
2011-05-18 12:21:02 Success Transfer: "BIN" mode, size 1760 bytes, character encoding - 
2011-05-18 12:21:23 Error Attempt to process file failed with java.net.ConnectException: Connection timed out: connect

Seem that FTP access into server is executed successfully and adapter write file, but raise timeout exception.

[Former Member]

Hi,

I've tried with ftp.timeout but no luck.

From Filezilla I'm able to reach FTP server and to write/delete files.

When I first connect with Filezilla it ask me something about a certificate, I click on yes and it goes.

I've asked Basis, ports are open.

About this blog:

/people/rajasekhar.reddy14/blog/2010/04/13/how-to-configure-ftps-in-file-adapter

I don't know anything about SSL certificate, I have to do something about it?

As Spantaleoni said, XI seems to access correctly the server, and then raise an error.

Thanks

Fabio

[maciej_jarecki]

Hi

You have to import public certificate to NWA to TrustedCA view and set in receiving CC conectivity security form none to rather seconde option. And PI should select your certificate from key storage

BR

MAciej

[Former Member]

Hi,

is a basis matter? I have to ask them about it?

I don't know what NWA and TrustedCA are.

Thanks

[Former Member]

Hi Fabio,

For certificate, you have to import server certificate to trust 3rd party server. But i don't believe that this is the error cause (otherwise, destination server couldn't accept initial connection..).

There are other ftp integration scenario that work fine into your PI system?

[maciej_jarecki]

Hi

More information about FTPS and PI

http://help.sap.com/saphelp_nwpi711/helpdata/en/14/ef2940cbf2195de10000000a1550b0/frameset.htm

Remember that PI dosen't support implicity connection mode

BR

MAciej

[Former Member]

Hi,

there are many FTP scenarios, but this is the first FTPS scenario that we try to set up.

Fabio

[Former Member]

Hi,

we have installed certificates and, referencing to note RFC 4217, we have setup port 21 for FTPS, and opened all ports for FTPS access (as XI generate a random port for data connection).

Problem is still the same, XI log correctly to external server using port 21, and then doesn't open the random port in the external server, we have logged it, there are no connection from XI with random port.

Error is still "Connection timed out" in writing file.

Any solution?

thanks

Fabio

[Former Member]

Hi,

we have checked with basis team using utility TCPDump: with FileZilla using passive mode the connection correctly open ports into destination party server.

With XI using passive mode with option "Control and Data Connection" we have monitored that XI is not able to open the data connection ports in the destination party server. Xi only opens port 21 and than doesn't even try to open random data connections ports.

Is it possible that this is an XI bug?

Thanks

Fabio

[Former Member]

I don't believe that is a bug Fabio.

Destination system required an implicit FTPS connection?

[Former Member]

Hi!

No, destination server needs an explicite FTPS.

Tracing firewalls log we see that:

1) With filezilla (from XI server) the connection opens (first in our firewall and then in destination firewall) port 21 for control connection and then random ports with range 40000 for data connection.

2) Xi communication channel only opens port 21, it doesn't open random ports, neither in our firewall nor in destination firewall.

In our firewall there is no error log, XI doesn't even try to open random ports. I don't know why.

In message monitoring message is still the same (connection timed out - see above).

Thanks

Fabio

[Former Member]

Have you restart Sap Instance after server certificate importing/installation?

[Former Member]

No,

do you think is useful?

Fabio

[former_member472138]

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c059d583-a551-2c10-e095-eb5d95e03...

Useful [LINK|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c059d583-a551-2c10-e095-eb5d95e03747?quicklink=index&overridelayout=true]

Regards

Pothana

[Former Member]

If you don't restart instance, imported certificate isn't loaded

[Former Member]

Hi Fabio,

Is the connectivity properly configured between PI system and the FTPS server?

Please check if you can access the ftp server from your PI system Applicaiton server. If not contact your basis of infrastructure guys to open the port for accessing the system.

If the connectivity exists, then check if the folder provided by the 3rd party is having write access. The channel might not be able to write the data into the location.

Cheers,

Souvik

[Former Member]

Ciao Fabio,

Try to set in Receiver FTP Adapter CC, this value "ftp.timeout"=timeoutSecs in Advanced Mode