SAP Router Setup Issues

[Former Member]

Hi Experts,

We are setting up SAP Router in Windows Server 2008 R2 Enterprise, when we start SAP Router, am getting the below error

Followed all the steps in https://websmp108.sap-ag.de/saprouter-sncdoc

D:\USR\SAP\SapRouter>saprouter -r -K "p: CN=XXXXXX, OU=00000XXXX, OU=SAProuter, O=SAP, C=DE"

trcfile  dev_rout

*****************************************************************************
*
*  ERROR       SNC processing failed:
*              SncSetMyNameU
*
*  TIME        Thu Nov 20 02:47:03 2014
*  RELEASE     720
*  COMPONENT   NI (network interface)
*  VERSION     40
*  RC          -17
*  MODULE      nisnc.c
*  LINE        576
*  DETAIL      NiSncInit: sncrc=-4
*  COUNTER     3

*****************************************************************************

If i give the command as saprouter -r

D:\USR\SAP\SapRouter>saprouter.exe -r

trcfile  dev_rout
no logging active

WARNING: wildcard character used in route target]

TRC file shows DEV_ROUT

---------------------------------------------------
trc file: "dev_rout", trc level: 1, release: "720"
---------------------------------------------------

Thu Nov 20 02:47:03 2014
SAP Network Interface Router, Version 40.4

command line arg 0: saprouter
command line arg 1: -r
command line arg 2: -K
command line arg 3: p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”
SncInit(): Initializing Secure Network Communication (SNC)
      PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 8/64/64)
      GetUserName()="C945017"  NetWkstaUser="C945017"
SncInit(): Trying environment variable SNC_LIB as
    gssapi library name: "D:\USR\SAP\SapRouter\sapcrypto.dll".
  File "D:\USR\SAP\SapRouter\sapcrypto.dll" dynamically loaded as GSS-API v2 library.
  SECUDIR="D:\USR\SAP\SapRouter" (from $SECUDIR)
  The internal Adapter for the loaded GSS-API mechanism identifies as:
  Internal SNC-Adapter (Rev 1.1) to CommonCryptoLib
  Product Version = CommonCryptoLib (SAPCRYPTOLIB) Version 8.4.31 pl40 (Nov  6 2014) MT-safe
*** ERROR => SncPGSSImportName()==SNCERR_GSSAPI  [sncxxall.c 2699]
      GSS-API(maj): An invalid name was supplied
    Import of a name failed
    name="p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"
<<- SncSetMyName()==SNCERR_GSSAPI
     in: myname = "p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"
*** ERROR => NiSncInit: SncSetMyNameU failed (sncrc=-4;'p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”') [nisnc.c      578]
*** ERROR => main: NiSncInit failed (rc=-17) [nirout.cpp   1373]

*****************************************************************************
*
*  ERROR       SNC processing failed:
*              SncSetMyNameU
*
*  TIME        Thu Nov 20 02:47:03 2014
*  RELEASE     720
*  COMPONENT   NI (network interface)
*  VERSION     40
*  RC          -17
*  MODULE      nisnc.c
*  LINE        576
*  DETAIL      NiSncInit: sncrc=-4
*  COUNTER     3
*
*****************************************************************************

Please help me to check whether the configurations are correct and what else needs to be done post configuration.

Thanks in advance!!

Regards,

Preetha Balan

[Former Member · Accepted solution]

Hi Preetha,

What you are doing is in the right order.

1. Register your Saprouter hostname with SAP and get a distinguished name.

2. Install Saprouter as a Service on Windows.

3. Create Saprouttab file

4. Add certificate to register your saprouter service.

5. Start the service.

The service should start.

AC

[Former Member]

Hi Preetha,

Instead of using below path in caps use small letter (D:\usr\sap\saprouter) and check the same following the step by step document mentioned above.

Regards,

Shanaka.

[Former Member]

Hi,

the below document describes step-bystep installation of saprotuer

_http://help.sap.com/saphelp_nw70ehp3/helpdata/en/48/6ca72a6c0707dce10000000a42189d/content.htm?frame...

_http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c06c8846-c160-2d10-d18e-d9961e9c7...

Also please check if you have selected the correct windows version after extraction of CAR file

Regards,

Nikhil

[Former Member]

Hii All,

Can anyone give me step by step document to install a new saprouter in Windows environment(ours is Windows Server 2008 R2 Enterprise). I have checked few sap notes and docs and it is bit confusing as this is my first time in installing saprouter.

Kindly help.

Thanks,

Preetha Balan

[manelli]

Hi Preetha,

try these link:

SAProuter Installation Step by Step

or

Step by Step Procedure for SAP Router SNC Configuration

Regards

Moreno

[Former Member]

Hi Moreno,

Thank you for the links!!!

Followed SAProuter Installation Step by Step link but still am unable to start the saprouter service, am facing the attached error.

Thanks,

Preetha Balan

[ravi_kumar123]

-> Get saprouter certificate again with proper OU details.

->  Generate your PSE with correct admin user  which should have "admin privilege" or "domain admin privilege"(In case it is domain installation)

     #  sapgenpse seclogin -p E:\usr\sap\saprouter\local.pse -O Administrator

-> and import your certificates again..

-Regards,

Ravi Kumar.D

[Former Member]

Hi,

Is this the host name of the machine which is in use for SAProuter?

AC

[Former Member]

Hi Preetha,

Is it possible for you to remove the dash in CN and try to run the command.

CN=sapapp-bl1

remove the Dash in between and try to run the command again.

AC

[Former Member]

Hi Amit,

Sorry!!! this is not possible.

Regards,

Preetha Balan

[Former Member]

Hi Preetha,

What is the name you are giving? The log file clearly mentions this error.

*** ERROR => SncPGSSImportName()==SNCERR_GSSAPI  [sncxxall.c 2699]
      GSS-API(maj): An invalid name was supplied
    Import of a name failed
    name="p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"
<<- SncSetMyName()==SNCERR_GSSAPI
     in: myname = "p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"
*** ERROR => NiSncInit: SncSetMyNameU failed (sncrc=-4;'p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”') [nisnc.c      578]
*** ERROR => main: NiSncInit failed (rc=-17) [nirout.cpp   1373]

Either the name you are giving is wrong or the name contains some wild character in it.

if that is Okay, can you please let us know with which name you have registered your saprouter with sap.

AC

[Former Member]

Hi Amit,

p:CN=sapapp-bl1, OU=0000033333, OU=SAProuter, O=SAP, C=DE

Thanks,

Preetha

[manelli]

Hi Preetha,

use the command without the blank space after "p:".

D:\USR\SAP\SapRouter>saprouter -r -K "p:CN=XXXXXX, OU=00000XXXX, OU=SAProuter, O=SAP, C=DE"

Regards.

Moreno

[Former Member]

Hi Moreno,

Facing the same issue even if the blank space is not there.

Thanks,

[Reagan]

As you are on Windows you should register the SAPRouter with SNC as a service and start it from services.msc. Check the SAP note and 525751 - Installation of the SNC SAPRouter as NT Service configure it. If the service fails to start then provide the dev_rout trace file.

Reagan

[Former Member]

Hi RB,

Followed the SAP Note, right now we are facing the below in dev_rout:

DlLoadFunc successful GetProcAddress("gss_inquire_mechs_for_name") from "D:\USR\SAP\SapRouter\sapcrypto.dll"
DlLoadFunc successful GetProcAddress("gss_canonicalize_name") from "D:\USR\SAP\SapRouter\sapcrypto.dll"
DlLoadFunc successful GetProcAddress("gss_export_name") from "D:\USR\SAP\SapRouter\sapcrypto.dll"
  File "D:\USR\SAP\SapRouter\sapcrypto.dll" dynamically loaded as GSS-API v2 library.
DlLoadFunc successful GetProcAddress("sapcr_get_version") from "D:\USR\SAP\SapRouter\sapcrypto.dll"
DlLoadFunc successful GetProcAddress("sapcr_get_secudir") from "D:\USR\SAP\SapRouter\sapcrypto.dll"
  SECUDIR="D:\USR\SAP\SapRouter" (from $SECUDIR)
  The internal Adapter for the loaded GSS-API mechanism identifies as:
  Internal SNC-Adapter (Rev 1.1) to CommonCryptoLib
  Product Version = CommonCryptoLib (SAPCRYPTOLIB) Version 8.4.31 pl40 (Nov  6 2014) MT-safe
  <<- SncPDLInit()==SAP_O_K
<<- SncInit()==SAP_O_K
         sec_avail = "true"
->> SncSetMyName(snc_hdl=0000000000000000, myname="p:CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE"

*** ERROR => SncPGSSImportName()==SNCERR_GSSAPI  [sncxxall.c 2699]
      GSS-API(maj): An invalid name was supplied
    Import of a name failed
    name="p:CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE” &"
<<- SncSetMyName()==SNCERR_GSSAPI
     in: myname = "p:CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE"

*** ERROR => NiSncInit: SncSetMyNameU failed (sncrc=-4;p:CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE') [nisnc.c      578]
*** ERROR => main: NiSncInit failed (rc=-17) [nirout.cpp   1373]

*****************************************************************************
*
*  ERROR       SNC processing failed:
*              SncSetMyNameU
*
*  TIME        Thu Nov 20 07:01:34 2014
*  RELEASE     720
*  COMPONENT   NI (network interface)
*  VERSION     40
*  RC          -17
*  MODULE      nisnc.c
*  LINE        576
*  DETAIL      NiSncInit: sncrc=-4
*  COUNTER     3
*
*****************************************************************************

->> SncDone()
DlUnloadLib successful FreeLibrary("D:\USR\SAP\SapRouter\sapcrypto.dll") hdl 0
<<- SncDone()==SAP_O_K
NiIExit: free nitab 00000000023DFFA0

[Former Member]

Hi Preetha,

What is the output of the following command.

sapgenpse get_my_name -v -n Issuer

Thanks

Amit

[Former Member]

Hi Amit,

Please find the attached

Thanks,

Preetha Balan

[Former Member]

Hi Preetha,

Seems you did something wrong with the initial configuration. I think you should start again from command no. 1.

name="p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"

<<- SncSetMyName()==SNCERR_GSSAPI

     in: myname = "p: CN=XXXXXX, OU=00000XXXXX, OU=SAProuter, O=SAP, C=DE”"

the myname section should not show this p:

When you run the command

sapgenpse get_pse -v -r certreq -p local.pse "CN=example, OU=0000123456, OU=SAProuter, O=SAP, C=DE"

Do not use p: after local.pse

Delete cred_v2"and "local.pse" and start over  and start again.

Thanks

Amit