Using saprouter to connect Solution Manager to SAP servers

[Former Member]

In the case where a single production solution manager is used (with CHARM) to manage transports and monitoring of SAP servers in non-production environments, a lot of ports need to be opened on both the production and the non-production boundary firewalls.  The connectivity is 1-to-many.

Is it possible to use a saprouter in the non-production environment to act as a proxy for Solution Manager to connect to the individual SAP servers within that environment, without impacting the functionality (transports/monitoring/admin).  I am after any successful implementations or other comments you may have on this subject.  The purpose of the implementation would be to reduce the firewall rules from one-to-many to one-to-one and use saproutetab or other means to direct the traffic.

[TomCenens · Accepted solution]

Hi Ian

I guess this could/should work since you can configure RFC destinations to use a SAProuter connection string and you can connect diagnostics agents through SAProuter if wanted:

External diagnostic agent | SCN

Not sure if this is better than opening up firewalls though ... this also comes with additional configuration / maintenance whatever you like.

Best regards

Tom

[Former Member · Accepted solution]

Thank you for your reply Tom, much appreciated.  We have a non-functional test environment which is very isolated with a blanket policy of nothing in or out... for good reason. Of course this is impossible to maintain and an exemption process exists to connect to the management network.  However to avoid placing a SolMan instance inside that environment and using a fileshare to copy transports in (due to bastion approach etc), we are entertaining the solution you have confirmed may be possible.  I will post results.