Error calling SAP backend system: MOPZ problem

[manoj_nayak2]

Hi all,

MOpz is configured & also it was worked fine but this tme when u am trying to approve my support package i am getting error

Error calling SAP backend system: Error when opening an RFC connectionSAP-OSS via RFC destination

When i checked SM59--> SAP-OSS i am getting error

Connection Error

Error when opening an RFC connection

ERROR: partner '<Ipaddress>:sapdp99' not reached

LOCATION: SAP-Server <HOSTNAME>_SOL_00 on host <HOSTNAME> (wp 2)

DETAIL: NiPConnect2

CALL: connect

COMPONENT: NI (network interface)

COUNTER: 47

ERROR NUMBER: 10061

ERROR TEXT: WSAECONNREFUSED: Connection refused

MODULE: nixxi.cpp

LINE: 2823

RETURN CODE: -10

SUBRC: 0

RELEASE: 700

TIME: Mon Sep 27 12:23:44 2010

VERSION: 38

Note : I assigned s-userid in AIS user

Any idea?

Regards

[Former Member · Accepted solution]

Hi Manoj,

Earlier we have the same problem in SAPOSS connection,we raised this issue with SAP and they suggested to perform below steps

"Currently there is no VPN connection being established between your

VPN gateway (IP Address) and SAP (194.39.131.167).

Please do the following.

1. Enable debug for phase 1 + 2 (isakmp + ipsec) on your VPN gateway

(IP Address)

2. Initiate traffic from your SAProuter machine (IP Addres) to

sapserv1

saprouter1> ping 194.117.106.129

saprouter1> niping -c -O -S 3299 -H 194.117.106.129

saprouter1> tracert 194.117.106.129 # Windows

saprouter1> traceroute 194.117.106.129 # UNIX

3. Check the logfile of your VPN gateway for any error messages

reported

Regards

Uday

[manoj_nayak2 · Accepted solution]

Hi Uday,

Thanks for input.

Also SAPOSS RFC is giving error. As i know SAP-OSS is copied from SAPOSS, so we need correct SAPOSS first.

if i am worng plz correct me.

Regards

[sunny_pahuja2 · Accepted solution]

Hi,

Check whether SAP Router is running or not because SAPOSS RFC used SAP Router to connect.

Thanks

Sunny

[manoj_nayak2 · Accepted solution]

Hello Sunny,

I restarted services of SAPROUTER but same error iam getting in SM59

Connection Error

Error when opening an RFC connection

ERROR: SNC processing failed: SncProcessOutput

LOCATION: SAProuter 38.10 on 'IBGSOL'

DETAIL: NiSncIInitHdlSecurity: sncrc=-4;00000000002AE440

COMPONENT: NI (network interface)

COUNTER: 10

MODULE: nisnc.c

LINE: 1096

RETURN CODE: -104

SUBRC: 0

RELEASE: 700

TIME: Mon Sep 27 15:20:23 2010

VERSION: 38

Any idea?

Thanks

[manoj_nayak2 · Accepted solution]

Hello,

Plz find the log of DEV_rout

-

---

trc file: "dev_rout", trc level: 1, release: "700"

-

---

Mon Sep 27 15:19:07 2010

SAP Network Interface Router, Version 38.10

command line arg 0: F:\usr\sap\saprouter\saprouter.exe

command line arg 1: -r

command line arg 2: -W

command line arg 3: 60000

command line arg 4: -R

command line arg 5: F:\usr\sap\saprouter\saprouttab

command line arg 6: -K

command line arg 7: p:CN=<HOSTNAME>,OU=0000857626,OU=SAProuter,O=SAP,C=DE

SncInit(): Initializing Secure Network Communication (SNC)

PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 16/64/64)

SncInit(): Trying environment variable SNC_LIB as a

gssapi library name: "F:\usr\sap\saprouter\nt-x86_64\sapcrypto.dll".

File "F:\usr\sap\saprouter\nt-x86_64\sapcrypto.dll" dynamically loaded as GSS-API v2 library.

The internal Adapter for the loaded GSS-API mechanism identifies as:

Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2

Mon Sep 27 15:19:08 2010

main: pid = 2564, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)

reading routtab: 'F:\usr\sap\saprouter\saprouttab'

Mon Sep 27 15:19:39 2010

• ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE'

[sncxxall3374]*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3340]

GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

• ERROR => ErrISetSys: error info too large [err.c 944]

Mon Sep 27 15:19:39 2010

LOCATION SAProuter 38.10 on '<HOSTNAME>'

ERROR GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

TIME Mon Sep 27 15:19:39 2010

RELEASE 700

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxall.c

LINE 3340

DETAIL SncPEstablishContext

SYSTEM CALL gss_init_sec_context

ERRNO

ERRNO TEXT

DESCR MSG NO

DESCR VARGS GSS-API(maj): The referenced credentials have expired;;;;

;;;;GSS-API(min): Validity date of certificate is invalid;;;;

;;;;target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

DETAIL MSG N

DETAIL VARGS

COUNTER 3

<<- ERROR: SncProcessOutput()==SNCERR_GSSAPI

• ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (rc=-4;00000000002AE440) [nisnc.c 1098]

• ERROR => NiSnc2Connect C1/-1, 194.39.131.34 (rc=-17) [nirout.cpp 2816]

• ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 '<HOSTNAME>' failed (rc=-17) [nirout.cpp 2243]

Mon Sep 27 15:19:45 2010

• ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE'

[sncxxall3374]*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3340]

GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

• ERROR => ErrISetSys: error info too large [err.c 944]

Mon Sep 27 15:19:45 2010

LOCATION SAProuter 38.10 on '<HOSTNAME>'

ERROR GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

TIME Mon Sep 27 15:19:45 2010

RELEASE 700

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxall.c

LINE 3340

DETAIL SncPEstablishContext

SYSTEM CALL gss_init_sec_context

ERRNO

ERRNO TEXT

DESCR MSG NO

DESCR VARGS GSS-API(maj): The referenced credentials have expired;;;;

;;;;GSS-API(min): Validity date of certificate is invalid;;;;

;;;;target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

DETAIL MSG N

DETAIL VARGS

COUNTER 6

<<- ERROR: SncProcessOutput()==SNCERR_GSSAPI

• ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (rc=-4;00000000002AE440) [nisnc.c 1098]

• ERROR => NiSnc2Connect C1/-1, 194.39.131.34 (rc=-17) [nirout.cpp 2816]

• ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 '<HOSTNAME>' failed (rc=-17) [nirout.cpp 2243]

Mon Sep 27 15:20:23 2010

• ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE'

[sncxxall3374]*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3340]

GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

• ERROR => ErrISetSys: error info too large [err.c 944]

Mon Sep 27 15:20:23 2010

LOCATION SAProuter 38.10 on '<HOSTNAME>'

ERROR GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

TIME Mon Sep 27 15:20:23 2010

RELEASE 700

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxall.c

LINE 3340

DETAIL SncPEstablishContext

SYSTEM CALL gss_init_sec_context

ERRNO

ERRNO TEXT

DESCR MSG NO

DESCR VARGS GSS-API(maj): The referenced credentials have expired;;;;

;;;;GSS-API(min): Validity date of certificate is invalid;;;;

;;;;target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

DETAIL MSG N

DETAIL VARGS

COUNTER 9

<<- ERROR: SncProcessOutput()==SNCERR_GSSAPI

• ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (rc=-4;00000000002AE440) [nisnc.c 1098]

• ERROR => NiSnc2Connect C1/-1, 194.39.131.34 (rc=-17) [nirout.cpp 2816]

• ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 '<HOSTNAME>' failed (rc=-17) [nirout.cpp 2243]

Mon Sep 27 15:41:18 2010

• ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE'

[sncxxall3374]*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3340]

GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

• ERROR => ErrISetSys: error info too large [err.c 944]

Mon Sep 27 15:41:18 2010

LOCATION SAProuter 38.10 on '<HOSTNAME>'

ERROR GSS-API(maj): The referenced credentials have expired

GSS-API(min): Validity date of certificate is invalid

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

TIME Mon Sep 27 15:41:18 2010

RELEASE 700

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxall.c

LINE 3340

DETAIL SncPEstablishContext

SYSTEM CALL gss_init_sec_context

ERRNO

ERRNO TEXT

DESCR MSG NO

DESCR VARGS GSS-API(maj): The referenced credentials have expired;;;;

;;;;GSS-API(min): Validity date of certificate is invalid;;;;

;;;;target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

DETAIL MSG N

DETAIL VARGS

COUNTER 12

<<- ERROR: SncProcessOutput()==SNCERR_GSSAPI

• ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (rc=-4;00000000002AE440) [nisnc.c 1098]

• ERROR => NiSnc2Connect C1/-1, 194.39.131.34 (rc=-17) [nirout.cpp 2816]

• ERROR => NiRClientHandle: NiRExRouteCon for C1/-1 '<HOSTNAME>' failed (rc=-17) [nirout.cpp 2243]

[Former Member · Accepted solution]

hi

chk ur router certificate expired or not,

if yes, regenerate by using this,

[https://websmp209.sap-ag.de/saprouter-sncadd|https://websmp209.sap-ag.de/saprouter-sncadd]

check and update

jansi

[sunny_pahuja2 · Accepted solution]

Hi,

> Mon Sep 27 15:19:39 2010

> *** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE'

> [sncxxall3374]*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [sncxxall.c 3340]

> GSS-API(maj): The referenced credentials have expired

> GSS-API(min): Validity date of certificate is invalid

> Unable to establish the security context

> target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

> *** ERROR => ErrISetSys: error info too large [err.c 944]

Clearly shows your router certificate is expired. Generate new one as suggested above.

Thanks

Sunny

[manoj_nayak2 · Accepted solution]

Hello All,

As per your inputs i genrated new certificate & import same into SAProuter. And this time my router is working fine.

But this time i want to access from outside of network so added this setting in my SAProutab as follow:

KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 *

KP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <Pblic ip>

P <Pblic ip> 194.39.131.34 3299

P <my router ip> 194.39.131.34 3299

P 172.16.. 194.39.131.34 3299

P 194.39.131.34 172.16..

P 194.39.131.34 <Pblic ip> 3299

S * <my SAP ip> 3200

P <Pblic ip> <my SAP ip> 3200

Note:

SAP System No: 00

DEV_Rout

-

---

trc file: "dev_rout", trc level: 1, release: "700"

-

---

Thu Sep 30 11:38:25 2010

SAP Network Interface Router, Version 38.10

command line arg 0: F:\usr\sap\saprouter\saprouter.exe

command line arg 1: -r

command line arg 2: -W

command line arg 3: 60000

command line arg 4: -R

command line arg 5: F:\usr\sap\saprouter\saprouttab

command line arg 6: -K

command line arg 7: p:CN=<HOSTNAME>,OU=0000*****,OU=SAProuter,O=SAP,C=DE

SncInit(): Initializing Secure Network Communication (SNC)

PC with Windows NT (mt,ascii,SAP_UC/size_t/void* = 16/64/64)

SncInit(): Trying environment variable SNC_LIB as a

gssapi library name: "F:\usr\sap\saprouter\nt-x86_64\sapcrypto.dll".

File "F:\usr\sap\saprouter\nt-x86_64\sapcrypto.dll" dynamically loaded as GSS-API v2 library.

The internal Adapter for the loaded GSS-API mechanism identifies as:

Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2

main: pid = 2028, ppid = 0, port = 3299, parent port = 0 (0 = parent is not a saprouter)

reading routtab: 'F:\usr\sap\saprouter\saprouttab'

I am not able to access my sap from outside of net work.

SAP Router String: /H/<PUBLIC IP>/S/3299/H

Any idea. Thnaks in advance

Regards.

[manoj_nayak2]

Thanks For input

MOPZ problem resolved.

Regards

[Former Member]

Hi,

I suspect problem with SAPROUTER,check the setting once

Regards

Uday