CHANNEL PARTNER (VAR)TECHNICAL SUPPORT NETWORK

Global Service & SupportAugust 2009

© SAP 2009 / Page 2

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 3

Advantage of Technical Network Connections

Technical communication between three parties – customer, partner, SAP – allowseffective End-to-End-Support throughout the whole life cycle. SAP standards for bestsecurity requirements for data transfer are proven since decades.

SAP offers its customers access to remote support and to a large number of supportservices delivered remotely in the customer system.Error analysis and services delivered remotely have one major advantage: they are availablestraight away.

Customer, Channel Partner (VAR), and SAP are a perfect team in collaboration.To deliver Enterprise Support to customers a technical connection between threepillars of successful support is basic.

For different ranges of use a network connection is necessary:1. Incident management, Maintenance Optimizer –

easy message processing and support for updates2. Remote access – secured logon to customer system3. EarlyWatch Alert – early identifying of issues

© SAP 2009 / Page 4

Customer Partner(VAR)

SAP End-to-End Support Network

SAP

Channel Partners are the link between SAP Business All-In-One customers and SAP. Atall time customers are expecting reliable support services. This proven collaborationbetween the three parties is founded on a technical collaboration. Secure networkconnections allow and control processes quick, automatically, and transparent.

SAP GlobalService Backbone

© SAP 2009 / Page 5

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 6

Customer Partner(VAR)

Remote Connectivity and AccessProcess Overview

SAP

SAP GlobalService Backbone

Customer’sSAP Solution

Incident/EWA/MOPZ

DataTransfer

DataExchange

Remote Access2

3

4 1

In order to completely use all offered options several network connections are necessary to provide End-to-End support:

Prerequisite: partners use RFC connection for data exchange between SAP Solution Manager and SAP

Partners have access to their customer‘s system landscape via remote access

Customers have access to partner‘s Service Desk for incident management, Maintenance Optimizer (MOPZ),EarlyWatch Alert (EWA) report

Customers can transfer data to partner‘s Solution Manager (e.g. for EWA data)

1

2

3

4

© SAP 2009 / Page 7

Agreement Basis

To leverage SAP Support Network partner must ensure that the communications connectionsbetween Partner and SAP as well as between End Users and SAP, which are necessary forremote support to be provided efficiently, are operable at all times and allow satisfactoryresponse times.

This also covers the required communications connections to any third parties involved.Partner must bear the connection costs resulting from remote support. SAP recommends thatpartner uses the technologies for remote support specified on SAP Service Marketplace(http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044806&_SCENARIO=01100035870000000202&and SAP Note 35010).

In case SAP Solution Manager Enterprise Edition as a collaboration and support platform isalso installed for End User usage, partner will use this SAP Solution Manager EnterpriseEdition to remotely access the Software within End Users’ SAP environment for IncidentRemedy subject to prior consent from End Users.

© SAP 2009 / Page 8

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 9

Basic ConnectionOverview

VAR SAP

= Firewall

= RFC to SAP

* = additional VPN hardware (switch/gateway)

RFC

DMZINTRANET INTRANETDMZ

SAProuter SAProuter

VPN (with IPsec) (add. Hardware*)(- ISDN ) (leased line or dial-up)

= Demilitarized ZoneDMZ

SAP GlobalService

Backbone

© SAP 2009 / Page 10

Basic ConnectionDescription

To provide message processing for customers in standard scenario an Remote Function Call (RFC)connection between SAP Solution Manager and SAP is necessary for1. Synchronization of necessary customer data2. Synchronization of messages

The network connection to SAP basically can be established with a leased line or with a dial-upconnection. ISDN and Frame Relay are getting less important in times of growing internet distribution.

For an internet connection two methods are possible:Secure Network Communication (SNC): SNC connections are established between two SAProuters.They require no additional hardware, but additional software has to be installed.

Virtual Private Network (VPN): VPN connection provides hardware-level encryption. A VPN switch isrequired at the partner site and at second party site. More information on the technical requirements andthe differences in Technical Specifications .

SAP recommends an VPN connection to SAP to use all offered options (incl. Remote Access).

Both options use three types of security measures to protect your systems and data from unauthorizedaccess:

State-of-the-art encryptionServer authenticationAccess-control technology

© SAP 2009 / Page 11

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 12

SAP GlobalService

Backbone

Incident ManagementOverview

VARCUSTOMER SAP

= Firewall= RFC to SAP

* = additional VPN hardware (switch/gateway)= Incident (HTTPS access to Work Center at partner‘s Service Desk)

RFC

DMZINTRANET DMZINTRANETDMZ

INTRANETDMZ

HTTPS

SAP WebDispatcher

SAProuter SAProuter

VPN (with IPsec) (add. Hardware*)(- ISDN ) (leased line or dial-up)

= Demilitarized ZoneDMZ

© SAP 2009 / Page 13

Incident ManagementDescription

Customer Partner SAP(3 level

support)(1 & 2 level

support)

Message process:Incident Management with SAP Solution ManagerService Desk is an essential task for channelpartners.Usually customers are having access to theirpartner’s Service Desk via Internet. Customer usercreate and process messages in a Work Center inpartner’s Solution Manager instead of SAP ServiceMarketplace.To provide secure access of the customers to WorkCenters in partner’s Solution Manager with HTTPSSAP is recommending the use of SAP WebDispatcher.

Message process:A customer creates a message in the web basedWork Center of his channel partner. One of the support employees of the partner is processing a new customer messageand sends back a solution proposal.If this is not solving customer’s issue then the message is set back for processing by partner. Sometimes further expertiseby an SAP specialist is necessary. Therefore this message is forwarded to SAP and send back to partner who automaticallyor manually forwards the solution proposal to customer.If now the customer is satisfied the message is confirmed a partner and at SAP.

© SAP 2009 / Page 14

Incident ManagementLinks to Documentation

Overview of Incident management:http://service.sap.com/~sapidb/011000358700000248452008

Information SAP Web Dispatcher:http://help.sap.com/saphelp_erp60_sp/helpdata/en/42/5cfd3b0e59774ee10000000a114084/frameset.htm

Setup SAP Web Dispatcher:http://service.sap.com/~sapidb/011000358700000121752008

Configuring the SAP Web Dispatcher to Support SSL:http://help.sap.com/saphelp_nw70/helpdata/DE/39/09a63d7af20450e10000000a114084/frameset.htm

© SAP 2009 / Page 15

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 16

Remote AccessOverview

VARCUSTOMER SAP

= Firewall

= RFC to SAP

* = additional VPN hardware (switch/gateway)

= Remote Access via SAP to customer system

DMZINTRANET DMZINTRANETDMZ

INTRANETDMZ

SAProuter

SAProuter SAProuter

SAProuter

VPN (with IPsec) (add. hardware*)(- ISDN ) (leased line or dial-up)

SNC (with SSL certificates)(add. software) orVPN (with IPsec) (add. hardware)(- ISDN, Frame Relay)(leased line or dial-up)

= Demilitarized ZoneDMZ

SAP GlobalService

Backbone

© SAP 2009 / Page 17

Remote AccessDescription

For the solution of a customer message a logon at the customer‘s system often is helpful. The customer can leave logon datain Secure Area when creating a message.So a message processor can start remote logon at customer in a customer message. SAP Solution Manager of the partnerwill call an application in SAP Service Marketplace which guaranties secure logon at customer systems.

Currently two ways of remote access are provided:SAProuter-SAProuter-connection: direct logon at customer systemNetviewer: especially for the needs of SAP adjusted tool for desktop sharing

Access to this application at SAP side to is not supported via an SNC SAProuter connection.You can either use ISDN connected SAProuters, or if you want to use internet you would need to set up an IPSec VPNtunnel instead of (or in addition to) the SNC connection. For information about IPsec VPN connections please seehttp://service.sap.com/internetconnection

To use an ISDN SAProuter might not be very cost effective since you have to pay for the ISDN long distance calls, so itmight be better to set up an IPSec VPN tunnel.

In order to use the remote logon via SAP the S-users of the partner‘s support employees need to have a special authorizationhttp://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000722612&_OBJECT=011000358700000547222009E.

How to set-up Remote Connection for Partners:http://intranet.sap.com/~form/sapnet?_SHORTKEY=01100035870000722611&_OBJECT=011000358700000547222009ENote on connection with customers:http://service.sap.com//sap/support/notes/1124718Description of Netviewer:(http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000688675&_SCENARIO=01100035870000000202&).

© SAP 2009 / Page 18

Incident ManagementLinks to Documentation

How to set up a Remote Network Connection to SAP:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044806&_SCENARIO=01100035870000000202&

Differences VPN/SNC and Technical Specificationshttp://service.sap.com/~sapidb/011000358700004675142006

Secure Network Communications (SNC):http://help.sap.com/saphelp_nw70/helpdata/en/e6/56f466e99a11d1a5b00000e835363f/frameset.htm

How to configure the SAProuter:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000044248&_SCENARIO=01100035870000000202&

Installing the sapcrypto library and starting the SAProuter:http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000234692&_SCENARIO=01100035870000000202&_OBJECT=011000358700004675142006E

© SAP 2009 / Page 19

Service Connection TypesLinks to Documentation

Service Connection Type Description SAP Note

SAP GUI based connection

R/3 Support enables remote access to an SAPsystem via SAP GUI 812732

Connection types providing application sharing methods or access on OS-level (operating system)

Netviewerenables collaboration and

application sharing access viaNetviewer

1124718 (for VARs)

© SAP 2009 / Page 20

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 21

EarlyWatch Alert Data TransferOverview

VARCUSTOMER SAP

= Service Connection (back destination: EWA, …) = Firewall

= RFC to SAP

RFC

RFC

DMZINTRANET DMZINTRANETDMZ

INTRANETDMZ

SAProuter SAProuter

SAProuter SAProuter

= Demilitarized ZoneDMZ

SAP GlobalService

Backbone

SNC (with SSL certificates)(add. software) orVPN (with IPsec) (add. hardware)(- ISDN, Frame Relay)(leased line or dial-up)

back

= Red alert - very critical/error

© SAP 2009 / Page 22

EarlyWatch AlertDescription

SAP EarlyWatch Alert (EWA) is necessary for SAP Enterprise Support. In a customer system EWA gathers performance datausing a data-collecting mechanism that runs as a background job. This data is sent from the customer’s system to partner’scentral SAP Solution Manager for processing and evaluation. Partner can send an HTML report automatically via email to endcustomer or provide the report in a separate Work Center. Depending on the criticality of the EWA report, the necessary actionis taken by VAR.If the overall rating of the report is Red: Very critical/error, VAR contacts SAP Partner Support Advisory Center and

If red rating

automated forward toSAP*

SAPSolution Manager

SAP

Contact Customer

31Send EWA Data

Customer Partner

Collect DataProcess EWA Data Check red rated EWA Report

Deliver Services

(for example Early Watch)

45

Implement

recommendations

Check EWA Report

2

Implement

recommendations

Contact Customer and createService Plan

subsequently open a message toSAP (SV-ES-SAC) with attachedSAP EarlyWatch Alert report within24 hours.SAP Partner Support AdvisoryCenter will analyze the situationbased on the report and decide if aTechnical Quality Check (TQC) isrequired. SAP Partner SupportAdvisory Center will inform partnerson the analysis result and, ifrequired, schedule service delivery ofrelevant Technical Quality Checksession jointly with partner and endcustomer.

For details, see SAP Note 1162164(Channel Partner Support Advisoryfor SAP Enterprise Support).

© SAP 2009 / Page 23

EWA Data TransferLinks to Documentation

For setup EarlyWatch Alert see

• SAP Solution Manager IMG with Transaction SPRO

• Online learning maps in SAP Service Marketplacehttp://service.sap.com/~iron/fm/011000358700004587872005E/011000358700006436682006WRK2?TMP=1241458520143#bkm_show1_10_00qq

• Best Practice for Value Added Resellers (VARs) - Activating SAP EarlyWatch Alert in End Customer’sSystemhttp://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000722612&_OBJECT=011000358700000567342009E

• Online documentationhttp://help.sap.com/saphelp_smehp1/helpdata/en/2f/de3316e1fc425080f83c718bec41de/content.htm

© SAP 2009 / Page 24

Agenda

1. Advantage of Network Connections

2. Process Overview

3. Basic Connection

4. Incident Management

5. Remote Access

6. EarlyWatch Alert

7. Glossary

© SAP 2009 / Page 25

Channel Partners Remote ConnectionsSummary

VARCUSTOMER SAP

= Service Connection (back destination: EWA, …) = Firewall

= WebDispatcher: application gateway / reverse proxy

= RFC to SAP

* = additional VPN hardware (switch/gateway)= Incident (HTTPS access to Work Center at partner‘s Service Desk)

= Remote Access via SAP to customer system

RFC

RFCback

DMZINTRANET DMZINTRANETDMZ

INTRANETDMZ

HTTPS

SAP WebDispatcher

SAProuter SAProuter

SAProuter SAProuter

SAProuter

VPN (with IPsec) (add. hardware*)(- ISDN ) (leased line or dial-up)

SNC (with SSL certificates)(add. software) orVPN (with IPsec) (add. hardware)(- ISDN, Frame Relay)(leased line or dial-up)

= Demilitarized ZoneDMZ

SAP GlobalService

Backbone

© SAP 2009 / Page 26

RFC Types

You need RFCs to navigate between systems, to use the functions in the following scenarios:- Implementation (optional)- Solution Monitoring/Administration (optional)- Business Process Monitoring and Job Scheduling Management (optional)- Service Desk- Change Request Management (optional)

You can create the following RFC connections:- READ RFC connection (for Monitoring)- BACK RFC connection (can only be used in programs called from remote sources)The BACK RFC connection (SM_<SID>CLNT<Client>_BACK) from a satellite system to the Solution Manager system isrequired for the following scenarios:- Service Desk, to send Service Desk messages- Solution Monitoring, to send SDCCN data- Implementation, to check for changes to locked Customizing objects in the Customizing Distribution functionChange Management, to ensure the integration of Service Desk and Change Request Management( When a function module establishes an RFC call using the destination BACK, the return connection is automatically protected with SNC if theoriginal connection was SNC-protected. The system does not set up a new connection for the BACK destination; it uses the original connection for thereturn connection.)-http://help.sap.com/saphelp_nw70/helpdata/EN/6c/ef1865f0494d0083300f87174177d9/content.htm-TRUSTED RFC connection (A calling system can be defined in the called system as a 'trusted system', using transactionSMT1. AS ABAP can log on to another AS ABAP without a password. This kind of trusting relationship between AS ABAPs hasthe following advantages: Single sign-on, no passwords are transferred across the network ,timeout mechanisms for logon dataprevent misuse , user-specific logon data for the trusted system is checked.) or- LOGIN RFC connectionFor detailed information about creating RFCs with the Solution Manager System Landscape, see the online documentation of the Solution ManagerSystem Landscape (Transaction SMSY -> Help -> Application Help -> System Landscape Management).

© SAP 2009 / Page 27

Connection TypesAdditional Details – Internet connections

Internet connections

Secure network communication (SNC) via SAProuter software to deliver software encryptionVirtual private networks (VPN), which provide hardware-level encryptionBoth options use three types of security measures to protect your systems and data from unauthorized access:- State-of-the-art encryption- Server authentication-Access-control technology

VPN (Virtual Private Network) is a network that uses tunneling technique to transmit encrypted data from point to point overthe public internet. A VPN provides hard data encryption at hardware level. For the VPN approach a VPN switch (VPNgateway) is required at both connected sites (partner / customer / SAP) in front of a SAProuter.

SNC (Secure network communication) connections are established between two SAProuter. No additional hardware isrequired at either end of the connection. The technology of SNC makes the connection over the internet secure, using state-of-the-art encryption. They require no additional hardware, but additional software has to be installed. You can downloadthis software directly from SAP Service Marketplace.

HTTP connections can be secured by using SSL (HTTPS) and RFC connections can be secured by using SNC.

© SAP 2009 / Page 28

Connection TypesAdditional Details – More Connections

Phone Connections

Frame RelayFrame Relay networks are currently offered primarily in North America. They are also packet switching networks, but havehigher protocol levels that handle data security, enabling the network to work with significantly less administrative information.SAP recommends the following parameters for a Frame Relay connection: Port speed of 56 or 64 kbits/second .Recommended CIR (Committed Information Rate) of 4 or 8 kbits/second. This data speed is sufficient for connecting to theSAP Service Network. Higher CIRs are more expensive, and are therefore not recommended. The CIR is the minimum transferspeed that is always guaranteed by the network provider, but higher transmission rates are possible, provided the network loadis not too high.We recommend using routers for the connection to a Frame Relay network, as the connection via routers is safer and moreflexible. Make sure that the routers used are suitable for Frame Relay.

ISDNISDN (Integrated Services Digital Network) will most likely replace the current analog telephone lines. In ISDN, communicationtakes place in different channels. Communication companies offer ISDN with different configurations. To connect to the SAPService Network you need a basis, or S0, connection. This connection contains two B channels and one D channel. An ISDNconnection is set up by switching a B channel connection.In theory, it is also possible to transport X.25 data packets in addition to the control information on the D channel (9600 baud)and to transfer these to X.25 networks (X.31). This functionality must be explicitly supported by both the connection side andthe hardware and represents a normal X.25 connection to SAP.The PPP protocol and CHAP authentication procedure are used by SAP for data transfer on the B channel. Customerstherefore need to find out if their systems support these if they want to establish an ISDN connection to SAP. Please contactyour consulting partner or SAP directly for more information.

Please note that connection fees for ISDN connections are dependent on time and distance. With long distances and/or longconnection times you should consider using Frame Relay or a network provider as an alternative. Also note that ISDNconnection is not possible everywhere. Please ask your local phone company or PTT.

© SAP 2009 / Page 29© SAP AG 2009. All rights reserved. / Page 29

The End

© SAP 2009 / Page 30

Copyright 2009 SAP AGAll Rights Reserved

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained hereinmay be changed without prior notice.

Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.

Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.

IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iSeries, pSeries, xSeries, zSeries,eServer, z/VM, z/OS, i5/OS, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+,POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex,MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation.

Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.

Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or othercountries.

Oracle is a registered trademark of Oracle Corporation.

UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.

Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc.

HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C®, World Wide Web Consortium, Massachusetts Institute of Technology.

Java is a registered trademark of Sun Microsystems, Inc.

JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein as well as their respective logosare trademarks or registered trademarks of SAP AG in Germany and other countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products andservices mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects S.A. in the United States and in other countries.Business Objects is an SAP company.

All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only.National product specifications may vary.

These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only,without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Groupproducts and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construedas constituting an additional warrant.