SAProuter error: SNC processing failed: SncInit

[Former Member]

While starting the SAProuter I am getting following error.

SAP Network Interface Router, Version 38.10

command line arg 0: saprouter

command line arg 1: -r

command line arg 2: -S

command line arg 3: 3299

command line arg 4: -K

command line arg 5: p:CN=Host name,OU=Cust ID,OU=SAProuter,O=SAP,C=DE

SncInit(): Initializing Secure Network Communication (SNC)

PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 8/32/32)

SncInit(): Trying environment variable SNC_LIB as a

gssapi library name: "C:\usr\sap\saprouter\crypto\".

• ERROR => DlLoadLib: LoadLibrary(C:\usr\sap\saprouter\crypto\) Error 126 [dlnt.c 237]

Error 126 = "The specified module could not be found."

• ERROR => SncPDLInit(): DlLoadLib("C:\usr\sap\saprouter\crypto\")=DLENOACCESS

[sncxxdl.0340]*** ERROR => SncPDLInit()==SNCERR_INIT, Adapter (#0) C:\usr\sap\saprouter\crypto\ not loaded

[sncxxdl.0604]<<- SncInit()==SNCERR_INIT

sec_avail = "false"

• ERROR => NiSncInit: SncInit failed (rc=-1) [nisnc.c 647]

• ERROR => main: NiSncInit failed (rc=-17) [nirout.cpp 1219]

*****************************************************************************

*

• ERROR SNC processing failed:

• SncInit

*

• TIME Wed Oct 08 11:56:59 2008

• RELEASE 700

• COMPONENT NI (network interface)

• VERSION 38

• RC -17

• MODULE nisnc.c

• LINE 646

• DETAIL NiSncInit: sncrc=-1

• COUNTER 3

*

*****************************************************************************

<<- ERROR: SncDone()==SNCERR_INIT_FIRST

Please sugget.

Thanks in advance.

Regards,

Suresh Kumar

[Former Member]

Hi,

Did you download the cryptographic library from www.service.sap.com/tcs ?

if no then download that and in Window NT environment variable setup

following

SECUDIR -> C:\usr\sap\saprouter

SNC_LIB -> path for sapcrypto.dll

regards,

kaushal

[Former Member]

Hi kaushal,

SAP router already configured in one server.

again cryptographic library from www.service.sap.com/tcs downloded required ?

Window NT environment variable setup -

SECUDIR -> C:\usr\sap\saprouter

SNC_LIB -> path for sapcrypto.dll

Regards,

Suresh Kumar

[Former Member]

Hi,

You can not start SNC saprouter without cryptographic library

so if library is missing you need to download it.

and after downloading it you need to perform Window NT environment variable setup as described above.

regards,

kaushal

[Former Member]

Hi Kaushal,

Thanks for ur quick reply..

Already cryptographic library file in the location C:\usr\sap\saprouter\crypto\ntintel -- sapcrypto.dll and sapgenpse.exe

Window NT environment variable setup -

SECUDIR -> C:\usr\sap\saprouter

SNC_LIB -> path for sapcrypto.dll

Please suggest.

Regards,

Suresh Kumar

Edited by: suresh k on Oct 8, 2008 4:07 PM

[Former Member]

Hi,

use following as system varaible.

SECUDIR -> C:\usr\sap\saprouter

SNC_LIB -> C:\usr\sap\saprouter\crypto\ntintel\sapcrypto.dll

regards,

kaushal

[Former Member]

Hi,

i have change the Windows environment variables.

now im getting below error..

ERROR: sapserv2a: route permission denied (77.233.248.72 to oss001, sapmsOSS)

LOCATION: SAProuter 39.2 (SP4) on 'sapserv2a'

COMPONENT: NI (network interface)

COUNTER: 4

MODULE:

LINE:

RETURN CODE: -93

SUBRC: 0

RELEASE: 710

TIME: Wed Oct 8 12:55:38 2008

VERSION: 39

Please advice.

Regards,

Suresh Kumar

Edited by: suresh k on Oct 8, 2008 4:26 PM

[Former Member]

Hi,

Problem with saprouttab file configuration

create/change saprouttab file with following entry (example only in your case value may be differs)

   # SNC-connection to SAP

KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *

   # SNC-connection from SAP to local R/3-System for Support

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <R/3-Server> <R/3-Instance>

   # SNC-connection from SAP to local R/3-System for pcANYWHERE, if it is needed

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <R/3-Server> 5631

 #  SNC-connection from SAP to local R/3-System for NetMeeting, if it is needed

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <R/3-Server> 1503

 #  SNC-connection from SAP to local R/3-System for saptelnet, if it is needed

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <R/3-Server> 23

 # Access from the local Network to SAPNet - R/3 Frontend (OSS)

P <IP-addess of a local PC> 194.39.131.34 3299

# deny all other connections

D * * *

if you are trying to login with OSS1 then it is not working, just perform test connection for SAPOSS RFC detination in SM59

regards,

kaushal

[Former Member]

Hi,

This is our server saprouttab file.

1. SNC-connection from and to SAP

KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *

1. SNC-connection from SAP to local R/3-System for Support

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.180.10 3200

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.181.24 3210

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.182.10 3211

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.182.11 3221

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.182.17 3231

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.183.10 3215

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.183.11 3235

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 10.201.182.14 3252

1. SNC-connection from SAP to local R/3-System for Windows Terminal Server

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 192.168.200.23 3389

1. SNC-connection from SAP to local R/3-System for HTTP

#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <IP> 80XX

1. SNC-connection from SAP to local R/3-System for NetMeeting:

#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <IP> 1503

1. SNC-connection from SAP to local R/3-System for PCanywhere:

#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <IP> 5631

1. SNC-connection from SAP to local R/3-System for saptelnet, if it is needed

#KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <R/3-Server> 23

1. Access from the local Network to SAPNet - R/3 Frontend (OSS)

P 192.168.200.23 194.39.131.34 3299

P 10.201.. 194.39.131.34 3299

P 10.201.. 194.39.131.34 3298

P 10.201.. 10.201.. *

P 192.168.200.* 10.201.. *

P 10.201.. 192.168.200.* *

P 10.201.. 77.233.248.* *

P 77.233.248.72 194.39.131.34 3299

1. deny all other connections

D * * *

1. Original entry

#P * * *

Please suggest.

Regards,

Suresh Kumar

[Former Member]

Hi,

P 77.233.248.72 194.39.131.34 3299

should be

P 77.233.248.72 194.39.131.34 * in saprouttab.

regards,

kaushal

[Former Member]

Hi,

I have change the P 77.233.248.72 194.39.131.34 3299 to P 77.233.248.72 194.39.131.34 * in saprouttab.

still im getting same error like

ERROR: sapserv2a: route permission denied (77.233.248.72 to oss001, sapmsOSS)

LOCATION: SAProuter 39.2 (SP4) on 'sapserv2a'

COMPONENT: NI (network interface)

COUNTER: 4

MODULE:

LINE:

RETURN CODE: -93

SUBRC: 0

RELEASE: 710

TIME: Wed Oct 8 12:55:38 2008

VERSION: 39

Regards,

Suresh Kumar

Edited by: suresh k on Oct 8, 2008 4:52 PM

Edited by: suresh k on Oct 8, 2008 4:54 PM

[Former Member]

Hi,

I already told you that if you are trying to login through OSS1 tcode to service.sap.com then it's not working it's always gives you route permission route permission denied error.

Please check if you are able to access RFC connection via t/c:sm59 -->

R3 support /ABAP --> SAPOSS --> RFC connection

if connection working is fine then your configuration is OK

If you are able to access the above, you can ignore the route permissionerror because, as of April 3rd, 2006 the SAPNet R/3 Frontend was not available for support applications. It was substituted by both support platforms, SAP Support Portal and SAP Solution Manager.

regards,

kaushal

[Former Member]

Hi kaushal,

i'm not able to access RFC connection via t/c:sm59 -->

R3 support /ABAP --> SAPOSS --> connectiontest

Error is

ERROR: sapserv2a: route permission denied (77.233.248.72 to oss001, sapmsOSS)

LOCATION: SAProuter 39.2 (SP4) on 'sapserv2a'

COMPONENT: NI (network interface)

COUNTER: 4

MODULE:

LINE:

RETURN CODE: -93

SUBRC: 0

RELEASE: 710

TIME: Wed Oct 8 12:55:38 2008

VERSION: 39

and while *Downloading files* -- Change Management -->Maintenance Optimizer -->Confirm files in Download Basket --> Error message is Error during call of SAP back end system (see long text)

I have alreay read the notes Use note 320991 to analyze RFC error codes.

Note 982045 contains information about repairing the RFC destination SAP-OSS.

Please suggest.

Regards,

Suresh Kumar

[Former Member]

Hi,

You are given wrong technical settings in OSS1.

Change the technical settings for transaction OSS1 accordingly note

33135.

regards,

kaushal

[Former Member]

Hi,

I have read the SAP Note no 33135 and checked the tcode OSS1 .

SAProuter ar Customer site

SAProuter1

Name albe0201

IP Address 192.168.200.23

Instance no. 99

SAProuter and SAP Net Message Server at SAP

SAProuter at SAP SAP Net Message Server

Name sapserv2 Name oss001

IP Address 194.39.131.34 DB Name O01

Instance no. 99 Instance no. 01

Note :- Two dats before RFC SAPOSS Connection is working fine.

Regards,

Suresh Kumar

[Former Member]

Hi,

Provide the technical settings for SAPOSS RFC connection from SM59.

regards,

kaushal

[Former Member]

Hi,

RFC Technical Settings in tcode SM59.

Target System OSS

Msg. Server /H/192.168.200.23/S/sapdp99/H/194.39.131.34/S/3299/H/oss001

Group EWA

Save to Database as

Save as IP Address /H/192.168.200.23/S/sapdp99/H/194.39.131.34/S/3299/H/oss001

Logon and Security

Logon

Language EN

Client 001

User S000XXXXX

PW Satus saved

One more doubt is how to install sap router certificate ?

Please suggest. Thanks in advance.

Regards,

Suresh Kumar

Edited by: suresh k on Oct 8, 2008 8:06 PM

[Former Member]

Hello All,

the exiration data of the SNC certificate is:

NotAfter: Fri Jan 01 01:00:01 2038 (380101000001Z)

Go to URL http://service.sap.com/saprouter-sncdoc and

start from step 10 (there is only 1 step 10 so you can't miss it) After you have done all the required steps, please re-test the connection.

Regards,

Suresh Kumar

[Former Member]

Hi Suresh,

Could please tell me how do you resolve the sap router issue?

We are also faing the same issue, can u help us this. Really appreciate your help

Regards,

Sree

[Former Member]

Hi Sreedhar,

Run the below commands in SAP ROUTER system.

result of the command: sapgenpse

-result of the command: sapgenpse seclogin -l

-result of the command: sapgenpse get_my_name -n all

-result of the command: sapgenpse get_my_name -v -n validity

Regards,

Suresh

[Former Member]

Info to SAP

Hi,

Please do the following:

o On your SAProuter, delete your existing PSE file and old certificate

file (local.pse, cred_v2)

o Go to the http://service.sap.com/saprouter-sncadd

o Click on "Apply Now!"

o Follow the steps detailed in the documentation

o More details can be found on the following page:

http://service.sap.com/saprouter-sncdoc

o Run the two commands:

sapgenpse get_pse -v -noreq -p local.pse "<Your Distinguished Name>"

sapgenpse get_pse -v -onlyreq -r certreq -p local.pse

Note: Replace "<Your Distinguished Name>" with

"CN=<name>, OU=000000000 OU=SAProuter, O=SAP, C=DE"

o Display the output file "certreq" and with copy&paste insert the

certificate request into the text area of the same form on the SAP

Service Marketplace from which you copied the Distinguished Name

o In response you will receive the certificate signed by the CA in the

Service Marketplace, cut&paste the text to a local file named srcert

o With this in turn you can install the certificate in your saprouter by calling

sapgenpse import_own_cert -c srcert -p local.pse

o Now you will have to create the credentials for the SAProuter with the same program (if you omit -O <user>, the credentials are created for

the logged in user account)

sapgenpse seclogin -p local.pse -O <user_for _saprouter>

o This will create a file called cred_v2 in the same directory.

o Check if the certificate has been imported correctly

sapgenpse get_my_name -v -n Issuer

The name of the Issuer should be:

CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE

Please also ensure to use the latest sapcrypto library (see also note

455033).

Regards,

Shankar

Edited by: shankara Bareddy on Aug 24, 2011 9:33 AM