Exposing SAP ECC over internet security concerns

[Former Member]

Dear All,

We are on SAP ECC 6.0 EHP7 (NW 7.4). We have developed some of the ODATA services in ECC which we need to provide to external mobile application. For this, we need to expose ECC on internet. We have SAP web dispatcher 7.4 available in DMZ zone. Please suggest

1. Routing access from internet(mobile app) via web dispatcher to ECC

2. Allow only Odata services via webdispatcher url filter

Is this safe way or there is any other safer mechanism.

Thank you

[IanSegobio]

Hello Pankaj,

The safest way would be to implement web dispatcher with SSL re-encryption and configuring the permitted request paths through the relevant profile parameter, like mentioned at the following WIKI document:

Configuring the Web Dispatcher for Multiple Systems - Clarifications and Examples - Application Serv...

Cheers,

Ian Segóbio.

[isaias_freitas]

Hello Pankaj,

The Web Dispatcher as a URL filter - Application Server Infrastructure - SCN Wiki can assist you with the URL filter (e.g., to allow only the OData URLs).

Cheers!

Isaías

[Johan_sapbasis]

Hi,

What you should do is use the filtering option suggested by isaias as well as the ssl re-encryption from Ian.

This basically means when the https traffic enters the webdispatcher it destructed and re-encrypted before being send onto the ECC backend server. The reverse also holds true when returning traffic hits webdispatcher is is destructed and re-encrypted before being send back out on the web.

The notes you need to look at is:

538405 - SAP Web Dispatcher: composite note

510007 - Setting up SSL on Application Server ABAP

Kind Regards,

[Former Member]

What I would suggest since Webdispatcher is in the DMZ is to configure HTTPS access to web dispatcher and from web dispatcher to ECC