SAProuter: Invalid Client version

[former_member449168]

I'm trying to connect to SAP via SAProuter.

My niping test is successful.
But when trying to connect viathe SAP GUI, I get an error of "invalid client version".

The dev_rout shows:

*** WARNING => NiSncIProcIn: handshake status of hdl 16 unexpected [nisnc.c 1108] *** ERROR => NiBufIProcMsg: hdl 16 received rc=-96 (NIEROUT_VERSION) from peer [nibuf.cpp 2042]

The SAProuter string in the SAP GUI I'm using is:

/H/[MyIP]/S/3299/H/[PublicSAProuterIP/S/3299/H/[InternalSAPSystemIP]/S/3220/H/

What can I check?

[isaias_freitas]

Hello Patricio,

Since the SAP system would be the final host, you would have an extra "/H/" at the end of your saprouter string.

Have you tried to remove the last "/H/" from the saprouter string?

If that was a typo, or if the issue persisted after removing it:

• In the saprouter string, "MyIP" is the IP address of a saprouter running at your internal network?
• And what would be "PublicSAProuterIP"? Is it a saprouter at a remote location, that you are reaching over the internet or a VPN?

Regards,

Isaías

[former_member449168]

Many thanks for the reply.

• Yes, I have tried removing the last "/H/" but the SAP GUI just adds it back.
• Yes, MyIP is the public IP of a server running SAProuter on our internal network.
• [PublicSAProuterIP] is the SAProuter on the client side (remote location) to which we are trying to connect to. They have a SAProuter server running that can connect to their SAP server (internally). I can also mention that this is a NATted IP.
• Trying to reach that over the internet. Not VPN.

[isaias_freitas]

Hello Patricio,
OK, then, at your SAP GUI, change the router string to just the following:

/H/[MyIP]/S/3299/H/[PublicSAProuterIP/S/3299

The SAP GUI adds the rest automatically, at runtime ;-).

Regards,

Isaías

[former_member449168]

Thanks. Really appreciate your effort to help me.

Changing the route as per your suggestion gives me an error that "hostname 'NiHLGetNodeAddr unknown".
I have the SAP internal IP in the GUI at the Application Server field.

dev_rout gives me:

*** WARNING => NiSncIProcIn: handshake status of hdl 13 unexpected [nisnc.c 1108]

*** ERROR => NiBufIProcMsg: hdl 13 received rc=-90 (NIEROUT_HOST_UNKNOWN) from peer [nibuf.cpp 2042]

[isaias_freitas]

You are welcome! 🐵

If that error is from the saprouter at your end (at the "[MyIP]"), then it would seem that the error is being returned by the remote saprouter ("[PublicSAProuterIP]").

Can you provide a level 2 trace (dev_rout)? You can switch the trace level by running "saprouter -t" (without having to stop the running saprouter). Running it again decreased the trace level back to 1.

Notice that there will be IP addresses/hostnames inside the file. If you want to replace them, please do it in a consistent way (like, replace all occurrences of the IP address "192.168.0.1" by "MySaprouterIP", or by a "fake" IP).

Regards,

Isaías

[former_member449168]

Once again THANKS!! Really appreciate.
I was not aware of this trace and it is very low level (to me).
For security, I did replace the IP's.

[MySAProuterIP] is our internal SAProuter server.
[RemoteSAProuterServer] is the remote SAProuter public IP
[SAPserverIP] is the internal IP of the SAP box itself.
[ClientCertificateName] is the name of the certificate that we have received and imported on our side.

SAProuter string I tried:
/H/[MySAProuterIP]/S/3299/H/[RemoteSAProuterServer]/S/3299/H/

The trace is too long to paste here, so I will try and attach it as a text file.
Download from tracelog.txt

[isaias_freitas]

Hello Patricio,

Indeed, the "NIEROUT_HOST_UNKNOWN" error is being returned by the saprouter at the remote end ("RemoteSAProuterServer").

Since you are using an IP address to specify the target SAP server, instead of a hostname, the issue is likely related to reverse name resolution on the "RemoteSAProuterServer".

In other words, the remote saprouter is trying to identify the hostname associated to the IP address "SAPserverIP", and it fails.

There would be two options:

• OPTION 1: the ideal solution
  Fix the reverse DNS issue at the remote saprouter.
  
• OPTION 2: "workaround"
  If option 1 is not possible, the remote saprouter must be started with the option "-D", which disables the reverse DNS lookup.
  If this option is to be applied, keep in mind the SAP Note 2514309 (S-user required).

Regards,

Isaías

[former_member449168]

Thanks. We tried option 2 did not work. Same error.

Option 1 seems to be an issue as well as no-one seems to know how to fix it or how to check what is wrong.

The SAProuter server has a NAT address. Do you think that causes some of the issues?

[isaias_freitas]

Hello Patricio,

As far as I know, and based on the quick test that I just performed, the fact that the RemoteSAProuter is behind a "NAT" would be transparent to the saprouter.

Can you collect and provide a level 2 trace from the remote saprouter?

Regards,

Isaías

[former_member449168]

Hi

Apologies for the slow response. I managed to get the trace level 2 from the client. File attached.

What is strange is that the trace seems to write an entry every 5 seconds. That does not look correct? Or is that normal from a client side?dev-rout2.txt

Once again, thanks for the assistance.

[isaias_freitas]

Hi,

No worries!

I could not find any occurrence of the "NIEROUT_HOST_UNKNOWN" error in this new saprouter trace.

But I found one occurrence of the original error:

*** ERROR => NiBufIProcMsg: hdl 17 received rc=-13 (NIEVERSION) from peer [nibuf.cpp  2023]

That network handle ("hdl 17") was the connection from the saprouter to the SAP server.

The network connection itself worked, meaning that the saprouter could connect and send the data to SAP.

What is curious is that it seems that an incorrect saprouter string was sent, as the SAP server was not the final target:

NiRRouteRepl: copying input to route and replacing name
C8/-1 has NI-layer-version 40
NiStrToAddrMask: local nodeAddrStr: [MySAProuterIP] len 12
NiStrToAddrMask: local nodeAddrStr: 158.89.2.146 len 12
NiBufIRouteToTable result from total 5 entries:
hostname  /service
[MySAProuterIP]  /
<ip address>     /3299
[SAPserverIP]   /3200  < next     <<<<<<<<<<<<< next saprouter hope/connection
<blank???>      /3299           <<<<<<<<<<<<<<<<<<<< why?
[SAPserverIP]   /3200           <<<<<<<<<<<<<<<<<<<< why?

Maybe those extra lines were added by the trace anonymization process?

In any case the NIEVERSION error came from the SAP system.

Is there anything logged at SAP when you try to connect? Like something at the system log (transaction SM21) or a shortdump (transaction ST22).

Regards,

Isaías

[former_member449168]

Thanks. I can't tell you why the routing came back like it did. I myself don't even know what is the expected output there :).

We get the error in the SAP GUI before the login screen comes up, so as far as my knowledge goes, nothing is logged in SAP at the point (as there is no user name entered yet). Since it login screen does not appear, it seems as if the SAP System cannot be found and thus nothing is logged (my assumption).

Would you say it's a network error at the client side?

Regards

[isaias_freitas]

Hi! 🙂

At that point, since that was the last saprouter on the router string, I would expect the route to be something like:

hostname  /service
[MySAProuterIP]/
<ip address>   /3299
[SAPserverIP]  /3200   <next

And that's it.

Anyway, based on the dev_rout file, the saprouter did connect to the SAP system. So, something might have been logged on the system log (transaction SM21) even though there was no user ID yet.

And if the extra lines are there in the original "dev_rout" (before you have anonymized it), I would say that the connection was already incorrect when it reached the remote saprouter.

I'm not sure of what would be causing that "strange" route information, though.

Regards,

Isaías

[former_member449168]

Tx. We'll take a look at SM21. The additional lines in the log were there before my anonymization.
PS: if you want to act as a temporary consultant (paid of course) and do some screensharing, you can let me know.

[isaias_freitas]

Hi,

If the extra lines were already there, then I'd say that the issue is likely at the SAP GUI and the suggestion would be to double check the saprouter string configured there, and maybe to update SAP GUI to the latest version.

The saprouter string should be only: /H/<your saprouter>/S/3299/H/<remote saprouter>/S/3299

PS: thanks for the offer, however I am not allowed to accept it 🙂

[former_member449168]

I understand. Thanks for the help. Although we are not successful yet, you have been very helpful and I learned a few things.
The SAP GUI will always add a /H/ at the end.

We are actually getting a different error now. HostName empty.
I feel guilty to ask you about this as well. Maybe I should open a new thread.

[isaias_freitas]

Hi,

You are welcome! 🙂

My SAP GUI does not add the /H/ at the end.

Maybe try updating the SAP GUI and see how it goes 😉

[former_member449168]

What version of the GUI do you have? I'm using 740.

[isaias_freitas]

The version I have here is 750 patch level 6. "File version" is "7500.2.6.1149".

[former_member449168]

And that solves is. After weeks of checking other stuff, upgrading the GUI did do the trick. Thanks again!!!! So simple at the end. At least I learned a lot during the troubleshooting.

[isaias_freitas]

You are welcome! 🐵

[oppancs]

Dear Patricio,

I would add something to Isaias's answer that would also probably be worth to check. This kind of issue might be caused by the following reasons:

1. Incompatibility between sapcryptolib - saprouter -SAP GUI - OS. For example a correct version of components should be like this:

Saprouter 7.42
-> Windows on x64 64bit

COMMONCRYPTOLIB 8
-> Windows on x64 64bit

2. Incorrect SNC certificate

3. Incorrect firewall rule settings especially if you use global IP address. For this to check the following SAP note can be useful: 48243 - Integrating the SAProuter software into a firewall environment

Best Regards,
Barnabás Paksi

[former_member449168]

Thanks for the advice. I can mention that:

• They have installed SAProuter that is the same version as ours. But they are running Linux and we are running Windows. We are running SAProuter version 40.4 on Windows Server 2012 64-bit.
• I'm fairly sure they have the correct certificate. Reason is that this was one of our previous stumbling blocks, so we have reimported and checked that a while ago.
• Firewall: If the firewall is an issue, would niping still work? Niping failed a while ago because of the firewall but after some recent changes, niping is working so I suspect the firewall is correct. Or is that not necessarily the case?