Subject: SAP connectivity across TIS

From: [email-masked] (Pazhamalai Jayaraman)
Date: Sat, 15 Jan 2000 01:08:36 +0530

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi -

We are contemplating to use SAP software over TIS - FWTK 2.0 which is
running on Linux platform. That is one of our network (in the intranet) is
protected using TIS firewall toolkit software. We had allowed various other
network services  across TIS software. Now we would like to allow SAP
service. Is there any sap-gw available with TIS... Any pointers in this
regard will be highly appreciated. 

TIA

---

From: Rick Murphy <[email-masked]>
Date: Fri, 14 Jan 2000 16:53:18 -0500

>regard will be highly appreciated.

SAP has a proprietary protocol that they (at least when I worked for TIS) 
refused to share. They have a program they call the "SAP Router" that 
proxies SAP. Only works on a few UNIX platforms. I'm sure they'll be happy 
to sell you a copy :-)
         -Rick

---

From: Martin Machacek <[email-masked]>
Date: Mon, 17 Jan 2000 10:03:46 +0100 (MET)

On 14-Jan-00 Rick Murphy wrote:
> [To be removed from this list send the message "unsubscribe fwtk-users" in

You do not need to use SAP Router. Both access from your site to SAP OSS and
from SAP OSS to your site can be easily proxied using plug-gw. All
communication is over simple TCP connections on well-known ports. Somewhere
in my deep folders I have complete list of all ports that could be use by I
cannot find it righ now. Nevertheless, I've found out that for access
to and from SAP OSS single plug-gw on port 3299 is sufficient. So you should put
something like this into you netperm-table:

# SAP Proxy
#----------
sap-gw: port 3299 <your internal address> -plug-to <SAP OSS address> -port 3299

(you can eventually add reverse line to allow connection from SAP OSS to you
site, like this:

sap-gw: port 3299 <SAP OSS address> -plug-to <your internal address> -port 3299)

and something like this into your startup script:

plug-gw -as sap-gw -daemon 3299 3299

or something like this into you inetd.conf (if you're starting proxies through
inetd):

sap stream tcp nowait nobody  /usr/local/libexec/plug-gw plug-gw -as sap-gw 3299

and for the inetd setup to work you will have to add line for sap into your
/etc/services, something like this:

sap  3299/tcp

It works fine for me and for couple of our clients, however the above
configuration was taken from Gauntlet and to say true I've never tried it with
FWTK but I don't see any reason why it should not work. It's just a simple plug.
You should ask SAP for the address that you should use to access SAP OSS. In
our case it was 147.204.2.5.

        Martin 

---
[PGP KeyID F3F409C4]

------------- End Forwarded Message -------------