XI and Network Security Guide

[Former Member]

Hi Guys,

Taking the recommendations of the SAP XI Security Guide - Network Zones we are planning to implement XI in its own zone separated from other SAP Back-office applications via a firewall.

http://help.sap.com/saphelp_nw04/helpdata/en/d9/ef2940cbf2195de10000000a1550b0/content.htm

This is fine for communication between third parties and the internet, however using XI for communication between SAP Components such as SRM, CRM and the backoffice applications what are our options.

I would prefer not to have to go through the firewall and back in again to integrate these systems.

Would a separate XI instance positioned behind the firewall and within the same zone as the application systems be preferable (if possible). Or am I worrying about nothing and taking the out and back in again approach the recommended solution.

All comments gratefully received.

Thanks

Nigel

[Former Member · Accepted solution]

Nigel,

It all depends on the real need how XI is used. Assume SRM (CCM) and XI. In this scenario, XI is used in upload functionality. For this reason, there is no need to pass through firewall and back again to SRM machine just for a content conversion. I even heared that CCM installation on same machine where XI is installed, will improve performance. Hence, if XI is used only to integrate internal sap business systems, I would prefer and recommend having XI without passing through firewall.

Best regards,

Felix

[Former Member · Accepted solution]

Thanks for the input Felix. In our case however we are not only using XI for internal SAP communication but also for integration with third parties and the internet and consequently it is deemed prudent to segregate XI from the backend applications.

Does anyone know if it is possible to operate XI as a multi instance, one either side of a firewall and if so does how does this impact the SLD, monitoring etc.

Thanks

Nigel

[Former Member · Accepted solution]

Anyone else out there have any comments....

Greatly appreciate any advice.

Thanks

Nigel