SAP Solution Manager VAR Remote Connection

CHANNEL PARTNER (VAR)Technical Support NetworkSAP Global Service & SupportMarch 2011

© 2011 SAP AG. All rights reserved. 2

Agenda

Advantage of Network Connections

Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary



Technical communication between three parties – customer, partner, SAP – allows effective End-to-End-Support throughout the whole life cycle. SAP standards for best security requirements for data transfer are proven since decades.

SAP offers its customers access to remote support and to a large number of support services delivered remotely in the customer system. Error analysis and services delivered remotely have one major advantage: they are available straight away.

Customer, Channel Partner (VAR), and SAP are a perfect team in collaboration.To deliver Enterprise Support to customers a technical connection between three pillars of successful support is basic.

For different ranges of use a network connection is necessary:1. Incident management, Maintenance Optimizer –

easy message processing and support for updates2. Remote access – secured logon to customer system3. EarlyWatch Alert – early identifying of issues


SAP End-to-End Support Network

Customer Partner(VAR)

SAP

Channel Partners are the link between customers and SAP. At all time customers are expecting reliable support services. This proven collaboration between three parties is founded on a technical collaboration. Secure network connections allow and control processes quickly, automatically, and transparently.

SAP Global Service Backbone


Agenda


Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary


Remote Connectivity and Access Process Overview

Customer Partner(VAR)

SAP


Customer’s SAP Solution

Incident/EWA/MOPZ

Data Transfer

Data Exchange

Remote Access2

3

4 1

In order to completely use all offered options several network connections are necessary to provide End-to-End support:

Prerequisite: partners use RFC connection for data exchange between SAP Solution Manager and SAP

Partners have access to their customer‘s system landscape via remote access

Customers have access to partner‘s Service Desk for incident management, Maintenance Optimizer (MOPZ)*,EarlyWatch Alert (EWA) report

Customers can transfer data to partner‘s Solution Manager (e.g. for EWA data)*SAP Business All-in-One only

1

2

3

4


Agreement Basis

To leverage SAP Support Network partner must ensure that the communication connection partner SAP as well as end users SAP, are operable at all times and allow satisfactory response times. The connections are necessary for remote support to be provided efficiently,.

This also covers the required communication connections to a third party involved. A partner must bear the connection costs resulting from remote support. SAP recommends that partner uses the technologies for remote support specified on SAP Service Marketplace(http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044806&_SCENARIO=01100035870000000202& and SAP Note 35010).

In case SAP Solution Manager as a collaboration and support platform is also installed for end user usage, partner will use this SAP Solution Manager to remotely access the software within End Users’ SAP environment for Incident Remedy subject to prior consent from End Users.


Agenda


Process Overview

Basic Connection to SAP Backbone

Incident Management

Remote Access

EarlyWatch Alert

Glossary


Basic Connection to SAP Backbone Overview

VAR SAP

= Firewall

= RFC to SAP

* = additional VPN hardware (switch/gateway)

RFC

DMZINTRANET INTRANETDMZ

SAProuter SAProuter

VPN (with IPsec) (add. Hardware*) (- ISDN ) (leased line or dial-up)

= Demilitarized ZoneDMZ


VPN Switch

VPN Switch

static IP address

(sapserv1)


Basic Connection to SAP BackboneDescription

To provide message processing for customers in standard scenario an Remote Function Call (RFC) connection between your SAP Solution Manager and SAP Backbone is necessary for 1. Synchronization of necessary customer data (master data)2. Synchronization of messages

SAProuter is an SAP program that acts as an controlling gateway (proxy) in a network connection between SAP systems, or between SAP systems. SAProuter controls the access to your network using static IP addresses, and, as such, is a useful enhancement to an existing firewall system (port filter). More details…

a) For a network connection via internet two methods are possible: 1. SNC (Secure Network Communication): SNC connections are established between two SAProuters using software-level

encryption based on SNC standard. They require no additional hardware, but additional software has to be installed.

SAP is recommending a VPN connection to SAP to use all offered options (incl. remote access to customer systems).2. VPN (Virtual Private Network): VPN connection provides hardware-level encryption based on IPSec standard. A VPN switch is

required at the partner site and at second party site. SAProuters at both parties are recommended. More information on technical specifications…

Both options are using three types of security measures to protect your systems and data from unauthorized access:State-of-the-art encryption Server authentication Access-control technology

b) The network connection to SAP basically can also be established with a dial-up connection or with a leased line. But ISDN and Frame Relay are getting less important in times of growing internet distribution.


Agenda


Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary


Incident Management Overview


VARCUSTOMER SAP

= Firewall= RFC to SAP


= Incident (HTTPS access to Work Center at partner‘s Service Desk)

RFC

DMZINTRANET DMZINTRANETDMZ

INTRANETDMZ

HTTPS

SAP Web Dispatcher

SAProuter SAProuter

VPN (with IPsec) (add. Hardware*) (- ISDN ) (leased line or dial-up)


(sapserv1)


Incident Management Description

Customer Partner SAP(3 level support)

(1 & 2 level support)

Message process:Incident Management with SAP Solution Manager Service Desk is an essential task for channel partners.Usually customers are having access to their partner’s Service Desk via Internet. Customer user create and process messages in a Work Center in partner’s Solution Manager instead of SAP Service Marketplace.To provide secure access of the customers to Work Centers in partner’s Solution Manager with HTTPS SAP is recommending the use of SAP Web Dispatcher.

Message process:A customer creates a message in the web basedWork Center of his channel partner. One of the support employees of the partner is processing a new customer message and sends back a solution proposal. If this is not solving customer’s issue then the message is set back for processing by partner. Sometimes further expertise by an SAP specialist is necessary. Therefore this message is forwarded to SAP and send back to partner who automatically or manually forwards the solution proposal to customer. If now the customer is satisfied the message is confirmed a partner and at SAP.


Incident Management Links to Documentation

Overview of Incident management:http://service.sap.com/~sapidb/011000358700000248452008

Information SAP Web Dispatcher:http://help.sap.com/saphelp_erp60_sp/helpdata/en/42/5cfd3b0e59774ee10000000a114084/frameset.htm

Setup SAP Web Dispatcher:http://service.sap.com/~sapidb/011000358700000121752008

Configuring the SAP Web Dispatcher to Support SSL:http://help.sap.com/saphelp_nw70/helpdata/DE/39/09a63d7af20450e10000000a114084/frameset.htm


Agenda


Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary


Remote Access Overview

VARCUSTOMER SAP

= Firewall

= RFC to SAP


= Remote Access via SAP to customer system


INTRANETDMZ

SAProuter

SAProuter SAProuter

SAProuter

VPN (with IPsec) (add. hardware*) (- ISDN ) (leased line or dial-up)

SNC (with SSL certificates)(add. software) orVPN (with IPsec) (add. hardware) (- ISDN, Frame Relay) (leased line or dial-up)



(sapserv1)


Remote Access Description

For the solution of a customer message a look into the customer‘s system often is helpful. The customer can leave logon data in Secure Area at SAP when creating a message. So a message processor can start remote logon at customer in a customer message. SAP Solution Manager (Customer Connection SAP Service Backbone) of the partner will call an application in SAP Service Marketplace which guaranties secure logon at customer systems.

Currently two ways of remote access are provided:SAProuter-SAProuter-connection: direct logon at customer systemNetviewer: especially for the needs of SAP adjusted tool for desktop sharing

Access to this application at SAP side is not supported via an SNC connection. You can either use ISDN connected SAProuters, or set up an IPSec VPN tunnel instead of (or in addition to) the SNC connection. For information about IPsec VPN connections please see http://service.sap.com/internetconnection

To use an ISDN SAProuter might not be very cost effective since you have to pay for the ISDN long distance calls, so it might be better to set up an IPSec VPN tunnel.

How to set-up Remote Connection for Partners:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000722611&_OBJECT=011000358700000547222009ESchedule VPN connection to SAP network: https://service.sap.com/sap/support/notes/486688Note on connection with customers:http://service.sap.com/sap/support/notes/1124718Netviewer usage:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000725685&_OBJECT=011000358700001192462009EDescription of Netviewer:(http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000688675&_SCENARIO=01100035870000000202&)


Remote Access Links to Documentation

How to set up a Remote Network Connection to SAP:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044806&_SCENARIO=01100035870000000202&

Differences VPN/SNC and Technical Specificationshttp://service.sap.com/~sapidb/011000358700004675142006

Secure Network Communications (SNC):http://help.sap.com/saphelp_nw70/helpdata/en/e6/56f466e99a11d1a5b00000e835363f/frameset.htm

How to configure the SAProuter:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044248&_SCENARIO=01100035870000000202&

Installing the sapcrypto library and starting the SAProuter:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000234692&_SCENARIO=01100035870000000202&_OBJECT=011000358700004675142006E


Service Connection Types Links to Documentation

Service Connection Type Description SAP Note

SAP GUI based connection

R/3 Support enables remote access to an SAP system via SAP GUI 812732

Connection types providing application sharing methods or access on OS-level (operating system)

Netviewerenables collaboration and

application sharing access via Netviewer

1124718 (for VARs)


Agenda


Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary


EarlyWatch Alert Data Transfer Overview

VARCUSTOMER SAP

= Service Connection (back destination: EWA, …) = Firewall

= RFC to SAP

RFC

RFC


INTRANETDMZ

SAProuter SAProuter

SAProuter SAProuter




back

= Red alert - very critical/error

(sapserv1)


EarlyWatch Alert Description

SAP EarlyWatch Alert (EWA) is necessary for SAP Enterprise Support. In a customer system EWA gathers performance data using a data-collecting mechanism that runs as a background job. This data is sent from the customer’s system to partner’s central SAP Solution Manager for processing and evaluation. Partner can send an HTML report automatically via email to end customer or provide the report in a separate Work Center. Depending on the criticality of the EWA report, the necessary action is taken by VAR. If the overall rating of the report is Red: Very critical/error, VAR contacts SAP Partner Support Advisory Center andsubsequently open a message to SAP (SV-ES-SAC) with attached SAP EarlyWatch Alert report within 24 hours. SAP Partner Support Advisory Center will analyze the situation based on the report and decide if a Technical Quality Check (TQC) is required. SAP Partner Support Advisory Center will inform partners on the analysis result and, if required, schedule service delivery of relevant Technical Quality Check session jointly with partner and end customer.

For details, see SAP Note 1162164(Channel Partner Support Advisory for SAP Enterprise Support).

If red rating

forward to SAP

SAPSolution Manager

SAP

Contact Customer

31

Send EWA Data

Customer Partner

Collect DataProcess EWA Data Check red rated EWA Report

Deliver Services

(for example Early Watch)

45

Implement

recommendations

Check EWA Report

2

Implement

recommendations

Contact Customer and create Service Plan


EWA Data Transfer Links to Documentation

For setup EarlyWatch Alert see

SAP Solution Manager IMG with Transaction SPRO

Online learning maps in SAP Service Marketplace http://service.sap.com/~iron/fm/011000358700004587872005E/011000358700006436682006WRK2?TMP=1241458520143#bkm_show1_08_00qq

Best Practice for Value Added Resellers (VARs) - Activating SAP EarlyWatch Alert in End Customer’s Systemhttp://service.sap.com/~sapidb/011000358700000567342009E

Online documentation http://help.sap.com/saphelp_smehp1/helpdata/en/2f/de3316e1fc425080f83c718bec41de/frameset.htm


Agenda


Process Overview

Basic Connection

Incident Management

Remote Access

EarlyWatch Alert

Glossary


Channel Partners Remote ConnectionsSummary

VARCUSTOMER SAP

= Service Connection (back destination: EWA, …) = Firewall

= WebDispatcher: application gateway / reverse proxy

= RFC to SAP

* = additional VPN hardware (switch/gateway)= Incident (HTTPS access to Work Center at partner‘s Service Desk)

= Remote Access via SAP to customer system

RFC

RFCback


INTRANETDMZ

HTTPS

SAP Web Dispatcher

SAProuter SAProuter

SAProuter SAProuter

SAProuter

VPN (with IPsec) (add. hardware*) (- ISDN ) (leased line or dial-up)




(sapserv1)


Remote Function Call (RFC) Types

You can create the following RFC connections to navigate between systems:- READ RFC connection (for Monitoring managed systems)- BACK RFC connection (can only be used in programs called from remote sources) SAP EarlyWatch Alert The BACK RFC connection (SM_<SID>CLNT<Client>_BACK) from a managed system to the Solution Manager system is required for the following scenarios:- Service Desk, to send Service Desk messages- Solution Monitoring, to send SDCCN data- Implementation, to check for changes to locked Customizing objects in the Customizing Distribution

functionChange Management, to ensure the integration of Service Desk and Change Request Management( When a function module establishes an RFC call using the destination BACK, the return connection is automatically protected with SNC if the original connection was SNC-protected. The system does not set up a new connection for the BACK destination; it uses the original connection for the return connection.)-http://help.sap.com/saphelp_nw70/helpdata/EN/6c/ef1865f0494d0083300f87174177d9/content.htm-TRUSTED RFC connection (A calling system can be defined in the called system as a 'trusted system', using transaction SMT1. AS ABAP can log on to another AS ABAP without a password. This kind of trusting relationship between AS ABAPs has the following advantages: Single sign-on, no passwords are transferred across the network ,timeout mechanisms for logon data prevent misuse , user-specific logon data for the trusted system is checked.) or - LOGIN RFC connectionFor detailed information about creating RFCs with the Solution Manager System Landscape, see the online documentation of the Solution Manager System Landscape (Transaction SMSY -> Help -> Application Help -> System Landscape Management).


Connection Types Additional Details – Internet connections

Internet connections

Secure network communication (SNC) via SAProuter software to deliver software encryption Virtual private networks (VPN), which provide hardware-level encryption

VPN (Virtual Private Network) is a network that uses tunneling technique to transmit encrypted data from point to point over the public internet. A VPN provides hard data encryption at hardware level. For the VPN approach a VPN switch (VPN gateway) is required at both connected points (partner / customer / SAP) in front of a SAProuter.

SNC (Secure network communication) connections are established between two SAProuter. No additional hardware is required at either end of the connection. The technology of SNC makes the connection over the internet secure, using state-of-the-art encryption. They require no additional hardware, but additional software has to be installed. You can download this software directly from SAP Service Marketplace.

HTTP connections can be secured by using SSL (HTTPS) and RFC connections can be secured by using SNC.


Connection Types Additional Details – More Connections

Phone Connections

Frame RelayFrame Relay networks are currently offered primarily in North America. They are also packet switching networks, but have higher protocol levels that handle data security, enabling the network to work with significantly less administrative information.SAP recommends the following parameters for a Frame Relay connection: Port speed of 56 or 64 kbits/second .Recommended CIR (Committed Information Rate) of 4 or 8 kbits/second. This data speed is sufficient for connecting to the SAP Service Network. Higher CIRs are more expensive, and are therefore not recommended. The CIR is the minimum transfer speed that is alwaysguaranteed by the network provider, but higher transmission rates are possible, provided the network load is not too high. We recommend using routers for the connection to a Frame Relay network, as the connection via routers is safer and more flexible. Make sure that the routers used are suitable for Frame Relay.

ISDNISDN (Integrated Services Digital Network) will most likely replace the current analog telephone lines. In ISDN, communication takes place in different channels. Communication companies offer ISDN with different configurations. To connect to the SAP Service Network you need a basis, or S0, connection. This connection contains two B channels and one D channel. An ISDN connection is set up by switching a B channel connection.In theory, it is also possible to transport X.25 data packets in addition to the control information on the D channel (9600 baud) and to transfer these to X.25 networks (X.31). This functionality must be explicitly supported by both the connection side and the hardware and represents a normal X.25 connection to SAP.The PPP protocol and CHAP authentication procedure are used by SAP for data transfer on the B channel. Customers therefore need to find out if their systems support these if they want to establish an ISDN connection to SAP. Please contact your consulting partner or SAP directly for more information.

Please note that connection fees for ISDN connections are dependent on time and distance. With long distances and/or long connection times you should consider using Frame Relay or a network provider as an alternative. Also note that ISDN connection is not possible everywhere. Please ask your local phone company or PTT.

Thank You!


No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iSeries, pSeries, xSeries, zSeries, eServer, z/VM, z/OS, i5/OS, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries.Oracle is a registered trademark of Oracle Corporation.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc.HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Java is a registered trademark of Sun Microsystems, Inc.

JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.

© 2011 SAP AG. All rights reserved

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company.

Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase, Inc. Sybase is an SAP company.

All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.The information in this document is proprietary to SAP. No part of this document may be reproduced, copied, or transmitted in any form or for any purpose without the express prior written permission of SAP AG.

This document is a preliminary version and not subject to your license agreement or any other agreement with SAP. This document contains only intended strategies, developments, and functionalities of the SAP® product and is not intended to be binding upon SAP to any particular course of business, product strategy, and/or development. Please note that this document is subject to change and may be changed by SAP at any time without notice.

SAP assumes no responsibility for errors or omissions in this document. SAP does not warrant the accuracy or completeness of the information, text, graphics, links, or other items contained within this material. This document is provided without a warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, or non-infringement.SAP shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. This limitation shall not apply in cases of intent or gross negligence.

The statutory liability for personal injury and defective products is not affected. SAP has no control over the information that you may access through the use of hot links contained in these materials and does not endorse your use of third-party Web pages nor provide any warranty whatsoever relating to third-party Web pages.

SAP Solution Manager VAR Remote Connection

Documents

Transcript of SAP Solution Manager VAR Remote Connection