Subject: RE: SAP connectivity across TIS

From: "Lidgate, Chris A" <[email-masked]>
Date: Tue, 18 Jan 2000 07:39:56 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

I'm sorry I've been away on holiday so couldn't reply to this
sooner.

We needed to do something similar, and I spent a few days 
digging to get it working.

Our set up was a follows

                                     << Public network DMZ >>
                                     << 101.102.103.x / 24 >>
    <<   Private network    >>
    <<   10.200.200.x / 24  >>

     +---------+                           +---------+
     |         |                           |         |
     |  SAP-1  |                           | APP-SER |
     |         |                           |         |
     +----+----+              +-----+      +----+----+
          | 10                |  F  |           | 2
          |                1  |  W  | 1         |
    ------+--------+----------+  T  +-----------+-------------
                   |          |  K  |
                   | 11       |     |
              +----+----+     +-----+
              |         |
              |  SAP-2  |
              |         |
              +---------+

ie app-ser.foo.com = 101.102.103.2
   fwtk.foo.com = 101.102.103.1 & 10.200.200.1
   sap-1.foo.com = 10.200.200.10
   sap-2.foo.com = 10.200.200.11

Our requirement was to run a web application on app-ser, that would
use some SAP BAPI COM object library to talk to a BAPI process on 
the SAP server SAP-1 inside our firewall, however for testing purposes
I put the entire SAP front end onto app-ser, and ran the entire SAP
applications suite for a time through the firewall.

The problem is that when setting up a SAP session to run on app-ser,
the SAP initialization passes the ip address of the client (in this 
case app-ser - 101.102.103.2) to the SAP server, then the SAP server 
tries to open up a port to this ip address. With a proxy firewall, 
this has to fail, as the ip address 101.102.103.2 is invalid on the
private network (well, there should be 'not route to host' anyway).

The only way we were able to get the SAP front end to work from our
external machine was to use a SAProuter process on another internal 
SAP server (in this case sap-2). Our SAP db admin set this up, and 
gave me the 'magic' connection string to use. The setup for fwtk 
was then something like ...

in services

    ...
    #
    sapdp99         3299/tcp                # sap router 
    #

in inetd.conf

    ...
    #
    sapdp99 stream tcp   nowait  root  /usr/local/etc/plug-gw plug-gw
sapdp99
    #

in netperm-table

    #
    sapdp99:      timeout 1000
    sapdp99:      port sapdp99 101.102.103.2 -plug-to 10.200.200.11 -port
sapdp99
    #

I seem to remember it was important to keep the timeout value large ish
as this was an interactive session, and otherwise the session could drop 
between screen re-freshes.

For our use of the BAPI COM object library, we did not need to use 
SAP router, as the connection object used by this library did not
require it. If anybody is interested in this, we could probably best 
continue the discussion by email, as I don't know much about the
library in question, and I would need to 'rope in' the application 
programmer who worked on the problem for us.

Chris Lidgate.

> ----------
> From: 	[email-masked][SMTP:[email-masked]]
> Sent: 	14 January 2000 19:38
> To: 	[email-masked]
> Subject: 	SAP connectivity across TIS
> 
> [To be removed from this list send the message "unsubscribe fwtk-users" in
> the
> BODY of a mail message to [email-masked].]
> 
> Hi -
> 
> We are contemplating to use SAP software over TIS - FWTK 2.0 which is
> running on Linux platform. That is one of our network (in the intranet) is
> protected using TIS firewall toolkit software. We had allowed various
> other
> network services  across TIS software. Now we would like to allow SAP
> service. Is there any sap-gw available with TIS... Any pointers in this
> regard will be highly appreciated. 
> 
> TIA
> 
> 
> 
> 
> 
> 
>