SAP Router implementention

[Former Member]

Hello there, I am very new to SAP Basis, but my company told me to implement a SAP Solution Manager.

To use the SolMan as it is used to, we need a connection to SAP via a SAP Router.

So I installed the SolMan on a vm "A" and the SAP Router on a vm "B". Both are Windows Server 2008 x64. We use SAP SNC for our connection. After the installations, i followed this guide to connect to the sap network http://sapbasistechnical.blogspot.co.at/2013/11/saprouter-installation-step-by-step.html.

The test via niping worked so far.

10.140.4.136 is the internal ip of the SAP Router (B)

10.140.4.56 is the internal ip of the SolMan(A)

If i try to test the connection via SM59, i get in the dev_rout this error:

Mon Sep 07 13:22:37 2015

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [D:/depot/b 3386]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [D:/depot/bas/74 3352]

      GSS-API(maj): No credentials were supplied

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessOutput()==SNCERR_GSSAPI

*** ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (sncrc=-4;0000000003355960) [nisnc.c      1195]

*** ERROR => NiSncHandleForAddr C10/-1, 194.39.131.34 (rc=-17) [nirout.cpp  4101]

*** ERROR => NiRClientHandle: NiRExRouteCon for C10/-1 'dce.xxxxx.net' failed (rc=-17) [nirout.cpp  3468]

So i dont really have any idea to solve this.

Maybe someone of you could help me.

This wuold be fantastic Thanks in advance!

[mamartins · Accepted solution]

Hi there,

SAPROUTER function is to create a tunnel between our internal SAP landscape and SAP facilities, or between our landscape and another SAP landscape. Usually we don't connect to it directly.

SAPROUTER should have an public IP address or sit on a DMZ behind a firewall. Also, that IP address and VM name should be declared to SAP on an specific form created for that purpose.

Please check these links: https://service.sap.com/internetconnection, https://service.sap.com/saprouter-sncadd

Regards,

MM

[Former Member · Accepted solution]

Thank you for your reply. The SAP Router is in the companys DMZ and has also an public IP. Forgot to mention it.

[mamartins · Accepted solution]

What's the content of your " saprouttab" file?

Did you gave permission to that SAP system communicate through SAPROUTER?

Sorry, I re-checked your error and found it...

You need to put user credentials on your SAPOSS RFC. Please check note http://service.sap.com/sap/support/notes/182308

[Former Member · Accepted solution]

I checked the node, the login data like in the node. Still no solution. My saprouttab looks like this: # SNC connection to and from SAP KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 * # SNC-connection from SAP to local system for R/3-Support KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.140.4.56 3299 # Access from your local Network to SAP P 10.140.4.56 194.39.131.34 3299 What exactly do you mean with permission to communicate trough SAP Router? Thank you for your help!

[mamartins · Accepted solution]

So, your SOLMAN VM have the IP address 10.140.4.56, correct? If so, your SAPROUTTAB is correct.

Also, did you registered your SAPROUTER on the SAP SUPPORT PORTAL?

Post here the result of the command "sapgenpse get_my_name" (please blind your company private  information).

Regards,

MM

[mario_faustner1 · Accepted solution]

Yes the ip of the SolMan VM is 10.140.4.56.

I registred the connection via remote data sheet

There is the output of "sapgenpse get_my_name"

Thank you for your help

[mamartins · Accepted solution]

What are the user credentials used by the SAPROUTER service?

Did you run the "seclogin" option of the "sapgenpse" command for that particular user?

I'm running out of ideas, so maybe you should create a ticket for SAP SUPPORT.

[mario_faustner1 · Accepted solution]

yes i did the seclogin command " sapgenpse seclogin -p local.pse"

Which credentials do you mean?

the ones in the RFC SAPOSS?

Thank you for your help

[mamartins · Accepted solution]

No that ones.

The SAPROUTER is running as a Windows service, right? And probably you created an user named "sncadm"? If you installed the SAPROUTER using another account than the one running the service, then you should run the "seclogin" command .

[mario_faustner1 · Accepted solution]

yes the saprouter is running as a windows server.

I only worked with the Windows Administrator user all time.

[isaias_freitas · Accepted solution]

Hello,

The blog you mentioned at the opening of this thread is somewhat old (from 2013, it seems).

Maybe the SAP note 2131531 can help?

Regards,

Isaías

[former_member199290 · Accepted solution]

Hi Mario:

So you installed your saprouter using Administrator credentials. Can you please check the Windows Service SAPRouter is running using the credentials Administrator?(Windows Services -> SAPRouter->Login Tab-> Log On as -> Should be Administrator)

Also please start your saprouter with higher trace level. Execute SM59 connection test and share the output.

Thanks.

[Former Member · Accepted solution]

I checked the service and it was as "local service". I changed this to Administrator and restarted everything. No the connection test works. thank you all ! 🙂