SAProuter SNC Connection Setup Guide
Uploaded by
paulineSAProuter SNC Connection Setup Guide
Uploaded by
paulineCommon questions
Powered by AIThe 'sapgenpse' command uses 'distinguished names' to generate a Personal Security Environment (PSE) for SAProuter. A distinguished name, which follows a structured format including identifiers like CN, OU, O, and C, is input when executing 'sapgenpse get_pse' to create a certificate request ('certreq' file). This name ensures the generated PSE is uniquely identified, corresponding to a specific SAProuter within the network .
The 'saprouttab' file serves as a route permission table for SAProuter, determining which connections are allowed or denied. It contains entries that define permitted Secure Network Communication (SNC) connections between the SAProuter and various SAP systems or services. Entries specify connection types, such as those to an SAP R/3-System for support or through specific ports. Deny entries ensure that all unspecified connections are blocked, enhancing network security .
To apply for an SAProuter certificate from the SAP Trust Center Service, first navigate to the service via the SAP marketplace. Begin the application by selecting 'SAP Trust Center Service in Detail' and then 'SAProuter Certificates.' Follow the guided steps, starting with 'Request Certificate for SAProuter -Step ½,' enter the 'distinguished name,' and use the 'sapgenpse get_pse' command to create a certificate request. Finally, submit the 'certreq' file content on the marketplace, which processes the application .
To ensure the correctness of a certificate imported into SAProuter, execute the 'sapgenpse get_my_name -v -n Issuer' command in the SAProuter directory to verify the certificate's issuer and ensure it matches expectations. This checks the certificate details and confirms successful importation. If issues arise, the user may need to restart the certificate importation process or seek assistance through SAP support channels .
The environment variable 'SNC_LIB' is set to specify the directory path where the SAProuter's cryptographic library, 'sapcrypto.dll,' is located. This variable allows SAProuter to use the cryptographic functions provided by the library, which are essential for secure communications. On Windows NT, it is set as a system environment variable to ensure that SAProuter, when executed, can automatically locate and load the necessary cryptographic component .
To download cryptographic software components from the SAP Service Marketplace, you need to first log in with your USERID assigned to your installation, navigate to Downloads under SAP Cryptographic Software, and ensure you have the necessary authorizations added by SAP after a positive statement from the 'Bundesausfuhramt.' Accept the EU regulations on the use and distribution of the cryptographic software components. The acceptance of the terms is logged with your USERID for reporting to the 'Bundesausfuhramt' .
Setting secure permissions for SAProuter directories on Windows NT is crucial to prevent unauthorized access to sensitive files that control SAProuter operations and secure communications. Permissions should be configured so that only the user account running SAProuter can access these directories and files, thus mitigating risks of data breaches or misuse of the SAProuter environment by other unauthorized users or processes .
The implications of downloading SAP software components under EU regulations include undergoing a vetting process whereby a positive statement from the 'Bundesausfuhramt' is required before SAP grants download authorization. Furthermore, users must comply with EU imposed regulations regarding usage and distribution, ensuring that they do not breach any legal constraints. Accepting the terms is also a requirement, and this compliance is recorded and reported for auditing purposes .
To ensure high security for the 'cred_v2' file generated by SAProuter on a Unix system, set file permissions to restrict access strictly to the user running the SAProuter. This typically involves modifying the file permissions to 600, allowing only the owner to read and write, or 400, allowing only reading access to the owner, thus preventing any group or other user access .
If the SAProuter electronic certificate is not correctly issued, check the current directory using the command 'sapgenpse get_my_name -v -n Issuer' to verify the certificate's importation. If the results are unsatisfactory, delete 'local.pse' and 'cred_v2,' then redo the process starting from step 4. If problems persist, seek assistance from the local SAP helpdesk or create an OSS message via component XX-SER-NET-OSS .