INSTALLATION PROCEDURE
Pre-requisite :
Host Name : SAPROUT
Internal IP : 192.100.1.153
Public IP : 219.65.73.134
User Account : Administrator
Password : HiddenP@$$2017
User Account : SAPDemo
Password : HiddenPA$$2017
PIN : 123456789
Router String : /H/219.65.73.134/S/3299/H/
192.100.1.153
SAPROUT\SAPDemo
saprouter
Create SAP Router :
https://support.sap.com/remote-support/help/installing-saprouter.html
Step 1 : Download the SAPROUTER, SAPCAR and SAPCRYPTOLIB files from market place.
Step 2 : Create following directory structure : <SID>
D:\saprouter\ —> Here copy saprouter and cryptolib files along with sapcar.
Step 3 : Now Install the Sap-Router
D:\saprouter>SAPCAR -xvf saprouter_34-70000855.sar
SAPCAR: processing archive saprouter_34-70000855.sar
x niping.exe
x patches.mf
x saprouter.exe
SAPCAR: 3 file(s) extracted
D:\saprouter>saprouter.exe version
SAP Network Interface Router, Version 40.4
Compiled Jan 26 2016 19:05:11
start router : saprouter.exe -r
stop router : saprouter.exe -s
soft shutdown: saprouter.exe -p
router info : saprouter.exe -l (-L)
new routtab : saprouter.exe -n
toggle trace : saprouter.exe -t
cancel route : saprouter.exe -c id
dump buffers : saprouter.exe -d
flush " : saprouter.exe -f
hide errInfo : saprouter.exe -z
start router with third-party library: saprouter.exe -a library
generate encrypted password : saprouter.exe -h password_to_encrypt
additional options
-R routtab : name of route-permission-file (default ./saprouttab)
-G logfile : name of log file (default no logging)
-T tracefile : name of trace file (default dev_rout)
-V tracelev : trace level to run with (default 1)
-H hostname : of running SAProuter (default localhost)
-S service : service-name / number (default 3299)
-P infopass : password for info requests
-C clients : maximum no of clients (default 800)
-Y servers : maximum no of servers to start (default 1)
-K [myname] : activate SNC; if given, use 'myname' as own sec-id
-A initstring: initialization options for third-party library
-D : switch DNS reverse lookup off
-E : append log- and trace-files to existing
-J filesize : maximum log file size in byte (default off)
-6 : IPv6 enabled
-Z : hide connect error information for clients
expert options
-B quelength : max. no. of queued packets per client (default 1)
-Q queuesize : max. total size for all queues (default 20000000 bytes)
-W waittime : timeout for blocking net-calls (default 5000 millisec)
-M min.max : portrange for outgoing connects, like -M 1.1023
-I address : address for outgoing connects, like -I 155.56.76.6
--sock_buf_size=bufsize : socket send/receive buffer size in bytes
(only set if larger than OS defaults)
default: 32768
valid range: 32768 - 10000000 (0 = OS defaults)
# this is a sample routtab : -----------------------------------------
D host1 host2 serviceX
D host3
P * * serviceX
P 155.56.*.* 155.56
P 155.57.1011xxxx.*
P host4 host5 * xxx
P host6 localhost 3299
P host7 host8 telnet
S host9
P0,* host10
KP sncname1 * *
KS * host11 *
KD "sncname "abc" * *
KT sncname3 host11 *
# deny routes from host1 to host2 serviceX
# deny all routes from host3
# permit routes from anywhere to any host using serviceX
# permit all routes from/to addresses matching 155.56
# permit ... with 3rd byte matching 1011xxxx
# permit routes from host4 to host5 if password xxx supplied
# permit information requests from host6
# permit native-protocol-routes to non-SAP-server telnet
# permit ... excluding native-protocol-routes (SAP-servers only)
# permit ... if number of preceding/succeeding hops (SAProuters) <= 0/*
# permit SNC-connection with partnerid = 'sncname1' to any host
# permit all SAP-SAP SNC-connections to host11
# deny all SNC-connections with partnerid = 'sncname "abc'
# open connects to host11 with SNC enabled and partnerid = 'sncname3'
# first match [host/sncname host service] is used
# permission is denied if no entry matches
# service wildcard (*) does not apply to native-protocol-routes
# --------------------------------------------------------------------
D:\saprouter>
Step 4 : Set the Environmental Variable
Right Click My Computer in Start Menu -> Properties -> Advanced Settings -> Advance Tab ->
Environmental Variables.
Add the below mentioned entries.
Variable name Variable value
SECUDIR D:\saprouter
SNC_LIB D:\saprouter\sapcrypto.dll
Step 5 : Run following command to generate Certificate.
sapgenpse get_pse -v -r D:\usr\sap\saprouter\certreq -p D:\usr\sap\saprouter\local.pse
“<Distinguished name>”
sapgenpse get_pse -v -r D:\saprouter\certreq -p D:\saprouter\local.pse "CN=SAPROUT,
OU=0001184582, OU=SAProuter, O=SAP, C=DE"
CN=SAPROUT, OU=0001184582, OU=SAProuter, O=SAP, C=DE
You will be prompted for a PIN. Please give some pin and remember for future.
PIN : 123456789
Certreq file will be generated in the specified path.
Copy the certreq file content.
Now goto below link in Service Market place
https://support.sap.com/remote-support/saprouter/saprouter-certificates.html
SAProuter Target (on SAP-
Distinguished Name (Parameter for SAPGENPSE)
Name side)
SAPROUT CN=SAPROUT, OU=0001184582, OU=SAProuter, sapserv9
O=SAP, C=DE
Go to SAP Router system :
-----BEGIN CERTIFICATE REQUEST-----
MIICmzCCAYMCAQAwVjELMAkGA1UEBhMCREUxDDAKBgNVBAoTA1NBUDESMBAGA1UE
CxMJU0FQcm91dGVyMRMwEQYDVQQLEwowMDAxMTg0NTgyMRAwDgYDVQQDEwdTQVBS
T1VUMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3iS1kKJALOJ4TL+B
hfSTPajJ1YUfN6t4lIYBgk7XFIOMrWD2N4ALrBT2VecYGqW0JkOSE0Zp1kZrR9Vq
eW0i0fF2UeNcoABNI3aiWg1cpXxb8xnknoVTMMFC12JyA+0Y0t2/vM0euaZ+9G71
AU8oLQpv+XJC6jfrMMSGI+IBgarddUEEQ+bCtV+LSzanaGuDmySA/jbcFwHq7ki2
c2dZ/IIBwoanWXcMNP7bc98eXNGQf6xUv7PmYlyLbKV2IoCvHFXA6x9wT0ZZLtc+
yp/IN63Ii85Vpwd1Zi8HiPJRRjfaFiZEDcnEJ3vmNb737fP01YDjYi5rqz6kh47Q
sqlU5QIDAQABoAAwDQYJKoZIhvcNAQELBQADggEBANewsMMwtVP3HK4tWdyTdrg8
lD0MkUzO11qy08r4MRI59ckob2lVqGmEN+KEqNyKc9pEdGm3Q5vcl5dA0B2B+HqJ
IWDfSL2yWVfCpq3MktwafR0i4rV7UhOmi/kgp1+RR7SOt9OpZOFVPNKrbmEEshwO
d2UFGMobLJMmuBhCMDopEbeq49MOurNIrS53krebsKQphPy1osNB3jxv4FIfZLQs
sVu69AsNOfMgDGvfZDCzvFaLvMZVF9ZrCpT+9XuXFq6Aet2hBwWy0W7mBmSBstRQ
4qpfYMGg7wW3ybfYwLET9os+y5VWdZTvGxAJSOfSOnsFZTCPmBQBQSy/VFdr8Jg=
-----END CERTIFICATE REQUEST-----
STEP 7: This will generate a certificate details: then copy the contents and create a file srcert (without
any extension) in C:\Saprouter and copy the certificate details and paste it in this file.
STEP 8: Run the command -
sapgenpse import_own_cert -c C:\saprouter\srcert -p C:\saprouter\local.pse
sapgenpse import_own_cert -c D:\saprouter\srcert -p D:\saprouter\local.pse
D:\saprouter>sapgenpse import_own_cert -c D:\saprouter\srcert -p D:\saprouter\local.pse
Please enter PSE PIN/Passphrase: *********
CA-Response successfully imported into PSE "D:\saprouter\local.pse"
D:\saprouter>
(This will create files dev_rout etc. In C:\saprouter folder then create a file saprouttab (Without any
extension and copy the following contents the file.
STEP 9: To generate credentials for the user that's running the SAProuter service, run command:
sapgenpse seclogin -p C:\saprouter\local.pse -O administrator
sapgenpse seclogin -p D:\saprouter\local.pse -O SAPDemo
SAPROUT\SAPDemo
(this will create the file "cred_v2" in C:\saprouter folder )
STEP 10: Check the configuration by running command:
sapgenpse get_my_name -v -n Issuer
(This should always give the answer "CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE")
sapgenpse get_my_name (to find the validity of license)
STEP 11: Create SAProuter service on Windows with the command :(download ntscmgr from Sap note
618053) and run the command -
ntscmgr install SAProuter -b C:\saprouter\saprouter.exe -p
"service -r -R C:\saprouter\saprouttab -W 60000 -K ^p:<Distinguished Name>^"
STEP 12: Edit the Windows Registry key as below: (regedit)
MyComputer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SAProuter\
ImagePath --> Change both the (^) to (")
RECOMMENDED TO RESTART
STEP 13: Start the SAProuter service (there maintain logon user details as administrator and password.)
STEP 14: Enter the below parameters in OSS1 -> Menu - Technical Settings
a). Click on Change -
Saprouter at Customer Site:
Name:
IP Address:
Instance no:
Saprouter at SAP:
Name:
IP Address:
Instance no:
Save the settings.
Now you can log on to SAPNet by clicking on Logon to SAPNet.
Use your OSS ID and password.
Controls:
Start router : saprouter -r
Stop router : saprouter -s
Soft shutdown: saprouter -p
Router info : saprouter -l (-L)
new routtab : saprouter -n
toggle trace : saprouter -t
cancel route : saprouter -c id
dump buffers : saprouter -d
flush " : saprouter -f
