saprouter - ideas for fault tolerance

[former_member263733]

We are running saprouter on a Windows server and are wondering if there is a way to set up this up with fault tolerance since our Windows server is subject to regular patching and maintenance. 

We have set up two instances of saprouter both using a single "tunnel" from the external firewall (different public IP's).  However, for right now all of our SAP systems are set to use the same single saprouter (OSS1 and saprouter entry on SAP's site). 

This is where we are "stuck" on how to approach the idea of setting up a fault tolerant configuration.  Right now we are just theorizing and are wondering if it would be feasible to do the following:

Take our existing arrangement ( one "tunnel", two saprouter) and insert a load balancer between the firewall and our saprouters.  This would be set up to point to a primary saprouter instance, but failover to a second instance as long as the primary was unavailable.

At a more detailed configuration level we it seems like we would also have two touch points for each sysetm.  In the ABAP stacks, we would point our saprouter in transaction OSS1 to the load balancer.  Then, we would also assign the load balancer to the saprouter entry on the SAP marketplace. 

If anyone has any thoughts, suggestions, or experience with the idea of a fault-tolerant saprouter that would be very helpful!

Thanks,

Jeff Henke

[americo_goncalvesqualho]

The implementation of SAPRouter in a HA environment is possible.

You have to take care that an IP Address (with a corresponding virtual hostname) is moving together with the SAPRouter.

I recommend the following:

- create a Resource Group for the SAPRouter

- add to this resource a virtual hostname and a virtual IP address

- in the hosts file add the corresponding entry (both nodes)

- create a 'Generic Service' for the SAPRouter as described in note #41054, just remember to use the -I option with the above virtual IP address for its value.

[Former Member]

Setup MSCS and bind the saprouter to the cluster IP address.

[bxiv]

If you have access to a hardware load balancer with your company, then what you explained should work, with one exception.

Exception, traffic from the SAP Router systems initiating traffic to SAP service market, it is going to use the real IPs on the servers; and won't help you with limiting the number of tunnels to SAP.

Solution - NAT the traffic to the same IP address so the VPN connection has the same source public IP address.

I would think the only issue after this would be if a SAP Router went offline while EWAs were being sent to SAP or if you have an open connection from SAP to your system; the load balancer would redirect everything to the other router, but all sessions would be dropped as stateful tables would have to be rebuilt from scracth, due to TCP behavior .