SSL Termination at Web Dispatcher to ECC ABAP only

[Former Member]

I am trying to setup a web dispatcher to allow access from the Internet to our ECC ABAP system through a Web Dispatcher in our client's DMZ.

We have opened port 843 (we will change to 443 later but can't use it now at ITS to our 4.6C system is currently usiong it) on the outer firewall and port 8000 on the inner firewall.

The server in the DMZ is server "candmz01" and the ECC server is "canqas". Both have been entered into the HOSTS file and both short and long names.

SMICM on the ECC server is showing port 8000 as the icm/server_port_0.

We've installed WebDispatcher and setup the profile as follows...

SAPSYSTEM = 80

DIR_EXECUTABLE = .

DIR_INSTANCE = .

rdisp/mshost = canqas.mycompany.ca

ms/http_port = 8000

wdisp/auto_refresh = 25

wdisp/max_servers = 100

wdisp/shm_attach_mode = 6

icm/max_conn = 100

icm/max_sockets = 1024

icm/req_queue_len = 300

icm/min_threads = 5

icm/max_threads = 15

mpi/total_size_MB = 20

wdisp/HTTP/max_pooled_con = 100

wdisp/HTTPS/max_pooled_con = 100

1. SAP Web Dispatcher Ports

icm/server_port_0 = PROT = HTTPS,PORT=843, TIMEOUT=900

icm/server_port_1 = PROT = HTTP,PORT=0

#SSL

wdisp/ssl_encrypt = 0

wdisp/add_client_protocol_header = true

icm/HTTPS/verify_client = 0

ssl/ssl_lib=C:\sap\webdist\sapcrypto.dll

ssl/server_pse=c:\sap\webdist\sec\SAPSSL.pse

1. SAP Web Dispatcher Web Administration

icm/HTTP/admin_0 = PREFIX=/sap/wdisp/admin,DOCROOT=./admin,AUTHFILE=icmauth.txt

When we run the URL ("https://candmz01:843/sap/bc/gui/sap/its/webgui/!") on the server in the DMZ (candmz01) we end up with the following error message...

Error: -26

Version: 7011

Component: HTTP_ROUTE

Date/Time: Tue Mar 30 12:29:52 2010

Module: http_route.c

Line: 3226

Server: candmz01__80

Error Tag:

Detail: no valid destination server available for '!ALL' rc=13

We're only running an ABAP stack on the ECC server - no JAVA.

Any idea what we are doing wrong and how to diagnose the problem at all?

Thanks in advance.

[Former Member · Accepted solution]

Hi,

I think that the error is here : ms/http_port = 8000

I have understood that 8000 is the http port of the ICM. It means that the sysnr is 00.

Most probably, the http port used by the message server will be 8100.

You should open the firewall for port 8100 and modify the sapwebdisp profile with ms/http_port = 8100

I hope this helps.

Olivier

[Former Member]

Hi,

Check the instance profile with command:

sappfpar check pf=./<instance profile>

and clean any error in the output.

let me know the result.

[michael_mulvey]

Hi,

The first thing you should check is the configuration of the webdisp with the following command:-

sapwebdisp pf=<Profile of webdisp> -checkconfig

This will tell you if the webdisp is correctly configured.

Please attach the output of this command to this thread and I will check if for you.

Michael

[Former Member]

Thanks. I think the ms/http_port may be the problem as well. We're testing a few things now and will update the thread with the solution -- or more questions -- when we have more info.

Thanks again for the quick responses.

[nelis]

Some recommendations:

Add parameter is/HTTP/default_root_hdl = abap ...to your web dispatcher profile to indicate an abap only system. Also ensure the following services are active in SICF of your abap system:

/public/icman

/public/icf_info ...and all services below this node.

Run sapwebdisp pf=<profile> -checkconfig ...make sure no errors. And use the FQDN when connecting to your abap system which is setup using parameter icm/host_name_full in instance profile.

Nelis