SAPROUTER: NIESNC_FAILURE

[Former Member]

Hallo, All!

I've installed saprouter and generated all necessary certificate.

At testing RFC-connection SAPOSS I received the next:

READ ROUTTAB ./saprouttab o.k.

CONNECT FROM C9/- host 192.168.32.143/47380 (sapsm1.local)

CONNECT TO   S9/-1 host 194.39.131.34/sapdp99 (194.39.131.34) (p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE)

CONNECT ERR  S9/-1 NIESNC_FAILURE

2013 DISCONNECT   C9/-1 host 192.168.32.143/47380 (sapsm1.itc-c.local)

I started with script:

export SECUDIR=/usr/sap/saprouter
export SNC_LIB=/usr/sap/saprouter/libsapcrypto.so

saprouter -r -S 3299 -V 3 -Grouter.log -K "p:CN=sapsm1.local, OU=0001blabla, OU=SAProuter, O=SAP, C=DE" &

My saprouttab file contains:

KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *  

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.32.143 3299

P *

*

*

I've read all information from google and can't find the resolving of my problem:

Note 63342 - List: NI error codes 

#define NIESNC_FAILURE -17 /* Error in the SNC shift */

                          /* in the saprouter ==>          */

Please tell me where I can to customize SNC settings?

[Former Member]

Hi Andrei,

the problem seems that in July 2015 SAP changed the CA:

2131531 - New Root Certification Authority for SAProuter certificates

I had the exact same problem today. You need to delete old local.pse and create a new one.

Click the link in the SAPNote for new instructions including new link for pasting the certreq.

I hope this helps.

Best regards,

Mark.

[Former Member]

Hi Andrei ,

Add this entry to the saprouttab

KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 3299 and restart the router.

Regards ,

Venkatesh

[Former Member]

Hi, Venkatesh!

Unfortunately, I have the same error.

Also, I have the next error in dev_rout file:

*** ERROR => NiSncHandleForAddr C10/-1, 194.39.131.34 (rc=-17) [nirout.cpp   3275]
*** ERROR => NiRClientHandle: NiRExRouteCon for C10/-1 'sapsm1' failed (rc=-17) [nirout.cpp   2653]

NiBufISendErr: send ni-error rc -104 to hdl 1

And

NiILocalCheck: 194.39.131.34 not found in local address list

NiLocalCheck: address 194.39.131.34 is not local

But, when I comment (#) the lines KP & KT in saprouttab, and test SM59=>SAPOSS I see the next error in log file:

CONNECT ERR  S9/17 NIEROUT_PERM_DENIED on 'SAProuter 40.4 on 'spwdfvml0575''

[Former Member]

Hi Andrei,

Please Do not comment those lines they are needed for the inbound and outbound connections.Add the following  entry  and delete the previously mentioned entry.Previously i mistakenly told you to add KT.This will definitely work.

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.32.143 3299

Regards,

Venkatesh Iyer