SAP Router is not working

[Former Member]

Dear Team

While Starting saprouter a message showing and the saprouter service is not starting pls help me to solve this issue the error message is

I had ceckd the dev_rout and saprouttab those also attaching with this

DEV_ROUT

trc file: "dev_rout", trc level: 1, release: "720"
---------------------------------------------------

Thu Sep 19 15:22:56 2013
SAP Network Interface Router, Version 40.4

command line arg 0: saprouter
command line arg 1: -r
command line arg 2: -K
command line arg 3: p:CN=mheplrouter, OU=0000453422, OU=SAProuter, O=SAP, C=DE
SncInit(): Initializing Secure Network Communication (SNC)
      PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 16/64/64)
SncInit(): Trying environment variable SNC_LIB as a
      gssapi library name: "D:\new\sapcrypto.dll".
  File "D:\new\sapcrypto.dll" dynamically loaded as GSS-API v2 library.
  The internal Adapter for the loaded GSS-API mechanism identifies as:
  Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2
main: pid = 2672, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)
reading routtab: './saprouttab'

SAPROUTTAB

# SNC connection to and from SAP
KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *

# SNC connection to local system for R/3-Support
# R/3 Server: 192.168.1.1
# R/3 Instance: 00
#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.1.1 3200
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 3200
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 3201
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 3202

# SNC connection to local WINDOWS system for WTS, if applicable
# Windows server: 192.168.1.2
# Default WTS port: 3389
#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.1.2 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 3389
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* *

# SNC connection to local UNIX system for SAPtelnet, if applicable
# UNIX server: 192.168.1.3
# Default Telnet port: 23
#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.1.3 23

# SNC connection to local Portal system for URL access, if applicable
# Portal server: 192.168.1.4
# Port number: 50003
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 50000
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 50100
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 50200
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.* 8000
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.126 50000
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.126 8000
KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 172.16.242.143 50200

# Access from the local Network to SAP
P 172.16.242.*  194.39.131.34 3299

# deny all other connections
D * * *

The result of "sapgenpse get_my_name -v -n Issuer " is also attaching

Opening PSE "D:\new\local.pse"...
PSE (v2) open ok.
Retrieving my certificate... ok.
Getting requested information... ok.
SSO for USER "sncadm"
with PSE file "D:\new\local.pse"

Issuer : CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE

Please help to resolve this issue

[Former Member]

Thanks to all the issue resolved

[Former Member]

Hi Basis 007,

Finally, how did you resolve the issue. Please can you update the solution.

Regards

Sudhir Sadhu

[Former Member]

Hi sudhir

Applied note 525751 and after that the router service started..

Once again thanks for  support

[Former Member]

Hi,

Could you please attach the result of the following niping command from your

SAProuter?

example: niping -c -O -S 3201 -H (Your SAP Server's IP)

example: niping -c -O -S 3200 -H 194.39.131.34

Regards,

Subhash

[Former Member]

Dear Subhash

the out put are the following

D:\new>niping -c -O -S 3200 -H 194.39.131.34

Mon Sep 23 17:50:55 2013
***LOG Q0I=> NiPConnect2: 194.39.131.34:3200: connect (10060: WSAETIMEDOUT: Conn
ection timed out) [nixxi.cpp 3286]
*** ERROR => NiPConnect2: SiPeekPendConn failed for hdl 1/sock 308
    (SI_ECONN_REFUSE/10060; I4; ST; 194.39.131.34:3200) [nixxi.cpp    3286]
*** ERROR => NiTClientLoop: NiHandle (rc=-10) [nixxtst.cpp  2590]

*****************************************************************************
*
*  ERROR       partner '194.39.131.34:3200' not reached
*
*  TIME        Mon Sep 23 17:50:55 2013
*  RELEASE     720
*  COMPONENT   NI (network interface)
*  VERSION     40
*  RC          -10
*  MODULE      nixxi.cpp
*  LINE        3286
*  DETAIL      NiPConnect2: 194.39.131.34:3200
*  SYSTEM CALL connect
*  ERRNO       10060
*  ERRNO TEXT  WSAETIMEDOUT: Connection timed out
*  COUNTER     1
*
*****************************************************************************

[Former Member]

Dear Subhash

By giving the command

D:\new>niping -c -O -S 3299 -H 194.39.131.34 getting output as

"

Mon Sep 23 18:01:52 2013
connect to server o.k.
send 10 messages (len 1000)

------- times -----
avg     0.008 ms
max     0.035 ms
min     0.002 ms
tr  122070.313 kB/s
excluding max and min:
av2     0.005 ms
tr2 181686.047 kB/s

[Former Member]

Hi,

Please try below & revert.

niping -c -O -S 3299 -H 194.39.131.34

Also go to OSS1==>> Parameter==>>Technical Settings & maintain below

Name          sapserv2                                Name          oss001

IP Address    194.39.134.35                      DB Name       O01

Instance no.  99                                         Instance no.  01

After This go to SAPOSS RFC & check below is correct.

/H/your saprouter ip/S/sapdp99/H/194.39.131.34/S/sapdp99/H/oss001

[Former Member]

Dear Subhash,

Out put of niping -c -O -S 3299 -H 194.39.131.34 is

Tue Sep 24 11:23:49 2013
connect to server o.k.
send 10 messages (len 1000)

------- times -----
avg     0.008 ms
max     0.034 ms
min     0.002 ms
tr  123615.506 kB/s
excluding max and min:
av2     0.005 ms
tr2 181686.047 kB/s

-----------------------------------------------------------------------------------

The techinical settings are same and the OSS RFC also same

[Former Member]

Hello,

Please review sap note "Note 33135 - Guidelines for
OSS1"

[Former Member]

Hi,

did you check that the certs are still valid.

sapgenpse get_my_name -n validity

Thanks

Rishi abrol

[Former Member]

Thank you for all the replyz

Yea the certificate is valid till jan14'. In service .mce the saprouter service is not stared and i cant start it manually showing as access denied

and while trying to connect through OSS1 the error showing as

[sunny_pahuja2]

Please check SAPOSS RFC connection. Also, make sure that you have maintained correct settings under Technical settings in OSS1.

Thanks,

Sunny

[Former Member]

Dear Sunny

OSS1 Settings are maintained correctly .that also confirmed ..

[sunny_pahuja2]

What is the error in SAPOSS RFC?

Thanks,

Sunny

[Former Member]

[Former Member]

Hi,

Can you please run the below command using sncadm.

saprouter -r -K "p:CN=mheplrouter, OU=0000453422, OU=SAProuter, O=SAP, C=DE" -T saprout.trc -W 60000 &

Can you please past the saprout.trc.

was this working earlier? When did you find its not working.

Thanks

Rishi Abrol

[Former Member]

Hi rishi

The same error coming

"

trcfile  saprout.trc
no logging active

WARNING: wildcard character used in route target """

---------------------------------------------------------------------------------------------------------------------------------------

And the saprout.trc is

"

---------------------------------------------------
trc file: "saprout.trc", trc level: 1, release: "720"
---------------------------------------------------

Mon Sep 23 16:37:03 2013
SAP Network Interface Router, Version 40.4

command line arg 0: saprouter
command line arg 1: -r
command line arg 2: -K
command line arg 3: p:CN=mheplrouter, OU=0000453422, OU=SAProuter, O=SAP, C=DE
command line arg 4: -T
command line arg 5: saprout.trc
command line arg 6: -W
command line arg 7: 60000
SncInit(): Initializing Secure Network Communication (SNC)
      PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 16/64/64)
SncInit(): Trying environment variable SNC_LIB as a
      gssapi library name: "D:\new\sapcrypto.dll".
  File "D:\new\sapcrypto.dll" dynamically loaded as GSS-API v2 library.
  The internal Adapter for the loaded GSS-API mechanism identifies as:
  Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2
main: pid = 2320, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)
reading routtab: './saprouttab'  

---------------------------------------------------------------------------------------------------------------------------------------

I just joined this project before 2 months and now i notice that it is not working the former person saying that it was working properly before..

[Former Member]

Hi,

Please check the note: 33135.

Did you maintain the correct string in technical settings:

Ex: H/<router IP Address>/S/sapdp99/H/<SAP router IP address>/S/sapdp99/H/oss001

The below information is from note :33135

sapserv1 (194.117.106.129) connection via Internet VPN

sapserv2 (194.39.131.34)  connection via Internet SNC

sapserv3 (147.204.2.5)    for customers with connection to Germany

sapserv4 (204.79.199.2)    for customers in America

sapserv5 (194.39.138.2)    for customers with connection to Japan

sapserv7 (194.39.134.35)   for customers in Asia

sapserv9 (169.145.197.110) for customers in Asia.

You have to select the 2nd IP address(194.39.131.34) as you are trying for connectin via Internet SNC.

Also, check the Logon and Security tab:

Client : 001

User : OSS_RFC

Pass: CPIC

[Former Member]

Hi,

From the logs the saprouter looks perfectly ok.

So just wanted to confirm that 172.22.100.37 is the ip of the router.

Hope that there is not firewall between the current application and the saprouter.

Can you please do a telnet 172.22.100.37 3299 from the host where the sap application is running.

Please check that the sapdp99 is maintained in the sap server.

Please also paste the oss1 -> technical settings.

Thanks

Rishi Abrol

[Former Member]

Dear Rishi

172.22.100.37 is the system ip where the saprouter is installed.

i can ping to 194.39.131.34

which is the ip of sapsrv2 from the router installed machine 172.22.100.37

[Former Member]

Dear Rishi,

The IP mentioned in sm59 is

[Former Member]

Hi,

And what about these steps.

Can you please do a telnet 172.22.100.37 3299 from the host where the sap application is running.

Please check that the sapdp99 is maintained in the sap server.

Thanks

Rishi Abrol

[Former Member]

Dear rishi

The connection is not establishing

C:\>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

        Connection-specific DNS Suffix  . : mhb.manipal.net
        IP Address. . . . . . . . . . . . : 172.22.18.22
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 172.22.18.1

C:\>telnet 172.22.100.37 3299
Connecting To 172.22.100.37...Could not open connection to the host, on port 329
9: Connect failed

[Former Member]

Hi,

Can you please check that the services files on the sap router 172.22.100.37 is maintained with the below entry.

sapdp99 3299/tcp #saprouter

If firewall settings is active on the saprouter 172.22.100.37. Can you try to disable the firewall of windows server and see what happens.

Thanks

Rishi Abrol

[Former Member]

Hi,

Please check your sap router system time/date. if its ok. please reboot the system & check dev_rout file is updated or not.

Regards,

Subhash

[Former Member]

Hi rishi

The service is maintend with the entry mentioned above  and the firewall is disabled..

[Former Member]

Hi Subhash

Time and date are correct and the dev_rout is updated

[Former Member]

Hi,

The saprouter program is running fine.  Have you tested it from SAP by configuring transaction OSS1 and trying to connect?

regards,

Graham

Message was edited by: Graham Slater

[sunny_pahuja2]

Hello,

As per your screenshot, saprouter is working fine. You have used wild cards in the last of saproute table. That's why you are getting this warning.

Thanks

Sunny