GS1 Trade Sync Connectivity guide

Transcription

1 GS1 Trade Sync Connectivity guide Date: Version: v1.8

2 Page: 2/17

3 Revision history Version Date Description Author Initial version Fernando Pereira Added FTP and SFTP Fernando Pereira Add link to download digital certificates Added explicitly port numbers; Added outgoing IP Address to preproduction environment Added supported encryptions and hashing algorithms Corrected AS2 URLs to all environments Added Outgoing IP address Corrected preprod https url Fernando Pereira Fernando Pereira Fernando Pereira Fernando Pereira Fernando Pereira Fernando Pereira New digital certificate Diogo Malheiro Page: 3/17

4 Content GS1 Trade Sync - Connectivity guide 1 Overview Contacts Connectivity Information AS Definition Configuration: Production Environment Configuration: Pre-Production Environment Recommendations Information needed from the partner File Transfer Protocol (FTP) Definition Configuration Recommendations Information needed from the partner Secure File Transfer Protocol (SFTP) Definition Configuration Recommendations Information needed from the partner Outgoing IP Addresses Pre-Production Environment Production Environment Digital certificates Connectivity Test Procedure Connectivity to GS1Trade Sync Setup Acknowledge for the setup in GS1Trade Sync Connectivity tests Confirmation Page: 4/17

5 1 Overview The aim of this document is to describe and document the methods in which GS1 Trade Sync users may exchange information with the system, guiding the user through the setup and testing process used to connect to GS1 Trade Sync. This documents starts by providing the adequate contact information for both connectivity and non-connectivity support issues. Chapter 3 provides all GS1 Trade Sync connectivity details for the supported protocols. Chapter 4 describes the process a partner has to follow in order to test and establish a connection with GS1 Trade Sync. Page: 5/17

6 2 Contacts For any maintenance, support question or other issues regarding GS1 Trade Sync, use the following contact information: Tel: Fax: For any GS1 Trade Sync connectivity tests, technical questions regarding the communication to and from GS1 Trade Sync, use the following contact information: Tel: Fax: URL: Address: Rua Víriato, nº 13, 6º Andar Lisboa Portugal Page: 6/17

7 3 Connectivity Information GS1 Trade Sync supports 3 different connection types, which users and third party systems can choose from. Depending on the connection type chosen, the URL/Address used to send data are slightly different, and a digital certificate may be required. You will use the same connection for both sending and receiving information. Next table summarizes the information of each one of the connection type, for both the Pre-Production and the Production environments. Protocol Environment Addresses/URLs Signed Encrypted Compressed MDN AS2 over HTTP Prod Pre Prod AS2 over HTTPS Prod Pre Prod Table 1: Connectivity information summary The following subsections describe the specific characteristics of each one of the above protocols. 3.1 AS Definition Applicability Statement 2 (AS2) is an Electronic Data Interchange over the Internet (EDIINT) specification that uses a well-known standard using HTTP, or HTTPS, to transport data. EDIINT is a working group of the Internet Engineering Task Force (IETF) that develops secure and reliable business communications standards. The AS2 specification supports EDI or any other data transmittals over the internet using HTTP or HTTPS. AS2 is a specification about how to transport data, not how to validate or process data. AS2 specifies the means to connect, deliver, validate and reply to (receipt) data in a secure and reliable way. The data is then dispatched to the appropriate processor based upon its content-type. AS2 makes no specification about how that dispatch or subsequent processing is accomplished. Security is achieved by the digital signature and/or encryption of the message, for which the usage of digital certificates is mandatory. Additionally it can be done over HTTPS which add an additional encryption layer. Reliability is achieved by the exchange of Message Delivery Notifications (MDN), combined with re-try and re-send mechanisms, allowing the full control of the interchanges performed or in error. Users can send messages to GS1 Trade Sync using any AS2 compliant tool. For information on AS2 compliant tools refer to: Page: 7/17

8 3.1.2 Configuration: Production Environment URL for HTTP: Port: 80 URL for HTTPS: Port: 443 AS2 Identifier: MDNs: Supported both synchronous and asynchronous MDNS. Asynchronous MDNS are sent in 5 minutes time intervals; see 3.2 File Transfer Protocol (FTP) Definition File Transfer Protocol (FTP) is a standard network protocol used to transfer files over TCP-based networks. FTP is built on client-server architecture and uses separate control and data connections between the client and the server. FTP users may authenticate themselves using a clear-text signin protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it Configuration This is a case by case configuration. User has to provide access to an FTP server, with an appropriate account, where the system can retrieve and place information. Outgoing IP Addresses: Recommendations The usage of this protocol should be avoided, since it is not a secure protocol and it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a FTP connection we need the following information from the partner: Company Name; Server address; Port number; Mode: passive or active; Port range; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; Page: 8/17

9 3.2 Secure File Transfer Protocol (SFTP) Definition The Secure File Transfer Protocol (known also as SSH File Transfer Protocol) is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols. The IETF Internet Draft states that even though this protocol is described in the context of the SSH-2 protocol, it could be used in a number of different applications, such as secure file transfer over Transport Layer Security (TLS) and transfer of management information in VPN applications. This protocol assumes that it is run over a secure channel, such as SSH, that the server has already authenticated the client, and that the identity of the client user is available to the protocol Configuration This is a case by case configuration. User has to provide access to an SFTP server, with an appropriate account, where the system can retrieve and place information Recommendations The usage of this protocol should be avoided, since it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a SFTP connection we need the following information from the partner: Company Name; Server address; Port number; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; Outgoing IP Addresses Page: 9/17

10 Retries: Resends: Hashing and Encryption methods 1 attempt per hour during 3 hours (when no successful http connection made, meaning no HTTP 200 code received); 1 attempts per hour during 3 hours (when the document was successfully posted, meaning successful HTTP connection and 200 code received, but no MDN received); SHA1 and Triple DES Configuration: Pre-Production Environment URL for HTTP: Port: 80 URL for HTTPS: Port: 443 AS2 Identifier: MDNs: Supported both synchronous and asynchronous MDNS. Asynchronous MDNS are sent in 5 minutes time intervals; see 3.3 File Transfer Protocol (FTP) Definition File Transfer Protocol (FTP) is a standard network protocol used to transfer files over TCP-based networks. FTP is built on client-server architecture and uses separate control and data connections between the client and the server. FTP users may authenticate themselves using a clear-text signin protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it. Outgoing IP Addresses: Configuration This is a case by case configuration. User has to provide access to an FTP server, with an appropriate account, where the system can retrieve and place information Recommendations The usage of this protocol should be avoided, since it is not a secure protocol and it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a FTP connection we need the following information from the partner: Company Name; Page: 10/17

11 Server address; Port number; Mode: passive or active; Port range; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; 3.3 Secure File Transfer Protocol (SFTP) Definition The Secure File Transfer Protocol (known also as SSH File Transfer Protocol) is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols. The IETF Internet Draft states that even though this protocol is described in the context of the SSH-2 protocol, it could be used in a number of different applications, such as secure file transfer over Transport Layer Security (TLS) and transfer of management information in VPN applications. This protocol assumes that it is run over a secure channel, such as SSH, that the server has already authenticated the client, and that the identity of the client user is available to the protocol Configuration This is a case by case configuration. User has to provide access to an SFTP server, with an appropriate account, where the system can retrieve and place information Recommendations The usage of this protocol should be avoided, since it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a SFTP connection we need the following information from the partner: Page: 11/17

12 Company Name; Server address; Port number; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; Outgoing IP Addresses Retries: Resends: Hashing and Encryption methods 1 attempt per hour during 3 hours (when no successful http connection made, meaning no HTTP 200 code received); 1 attempt per hour during 3 hours (when the document was successfully posted, meaning successful HTTP connection and 200 code received, but no MDN received); SHA1 and Triple DES Recommendations Our recommendation is to use AS2 via HTTP protocol with message encryption and signature. This combination provides a secure and reliable connection without the overhead required by HTTPS Information needed from the partner In order to establish an AS2 connection we need the following information from the partner: Company Name AS2 Identification URL User id and password if applicable Outgoing IP addresses Digital certificate Administrative contact for connectivity issues; Page: 12/17

13 3.4 File Transfer Protocol (FTP) Definition File Transfer Protocol (FTP) is a standard network protocol used to transfer files over TCPbased networks. FTP is built on client-server architecture and uses separate control and data connections between the client and the server. FTP users may authenticate themselves using a cleartext sign-in protocol, normally in the form of a username and password, but can connect anonymously if the server is configured to allow it Configuration This is a case by case configuration. User has to provide access to an FTP server, with an appropriate account, where the system can retrieve and place information Recommendations The usage of this protocol should be avoided, since it is not a secure protocol and it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a FTP connection we need the following information from the partner: Company Name; Server address; Port number; Mode: passive or active; Port range; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; Page: 13/17

14 3.5 Secure File Transfer Protocol (SFTP) Definition The Secure File Transfer Protocol (known also as SSH File Transfer Protocol) is a network protocol that provides file access, file transfer, and file management functionalities over any reliable data stream. It was designed by the Internet Engineering Task Force (IETF) as an extension of the Secure Shell protocol (SSH) version 2.0 to provide secure file transfer capability, but is also intended to be usable with other protocols. The IETF Internet Draft states that even though this protocol is described in the context of the SSH-2 protocol, it could be used in a number of different applications, such as secure file transfer over Transport Layer Security (TLS) and transfer of management information in VPN applications. This protocol assumes that it is run over a secure channel, such as SSH, that the server has already authenticated the client, and that the identity of the client user is available to the protocol Configuration This is a case by case configuration. User has to provide access to an SFTP server, with an appropriate account, where the system can retrieve and place information Recommendations The usage of this protocol should be avoided, since it does not have acknowledgement mechanisms. Use only if not other possibility exists Information needed from the partner In order to establish a SFTP connection we need the following information from the partner: Company Name; Server address; Port number; User id ; Password; Path for GS1Trade Sync obtain the files to process; Path for GS1Trade Sync deliver files; Administrative contact for connectivity issues; 3.6 Outgoing IP Addresses Pre-Production Environment For HTTP based protocols we have the following outgoing IP Addresses: Page: 14/17

15 Production Environment For HTTP based protocols we have the following outgoing IP Addresses: Digital certificates Download digital certificates, for all GS1 Trade Sync environments, from here, or copy and paste the following URL into your browsers address bar: Credentials (case sensitive): User: saphsync-cert Pass: saphety.123! Download the file SaphetySyncCert.zip, which contains the digital certificate to use (saphetysyncas2_2017.cer) as well as the entire certification chain (the other two *.cer files). Page: 15/17

16 4 Connectivity Test Procedure In order to initiate exchange information with GS1Trade Sync production environment, it is necessary that you as a user perform a set of connectivity tests that will guarantee the correct setup between the systems. Premises: Partners connecting for the first time have to perform connectivity test with Pre- Production environment; Only after having successfully passed connectivity tests in Pre-Production, partner can initiate the document exchange in the Pre-Production environment. The process for the validating process is described in the GS1Trade Sync Setup Guide. After you have received acceptance from GS1 Denmark on the message validation you can begin connectivity tests to the Production environment. You are only allowed to exchange documents with production environment after having passed the connectivity tests, in both Pre-Production and Production, and after GS1 Denmark confirmation that are listed above. Page: 16/17

17 4.1 Connectivity to GS1Trade Sync Setup Configure your communication system with the information provided in chapter 3 - Connectivity Information. Check list for the setup: If using AS2: a. Digital certificates are installed and configured? In section 3.7 are all the certificates for all the environments. b. Network and firewalls configuration allow traffic from and to GS1Trade Sync servers? See the 3.5 section for GS1Trade Sync outgoing ip's, which should be enabled for inbound in your firewalls, if using AS2 protocol. For outbound you only need to allow the specific environment address, if using AS2 protocol. c. Configure digital signature and encryption; d. MDNs are required, so configure your system to request them. If using SFTP or FTP: o o o Accounts are created with correct data; Given paths are available; Privileges for the given folders are correct; Acknowledge for the setup in GS1Trade Sync Wait for acknowledge from Saphety that we have finished the setup on our side with the parameters supplied by you. This should be completed within 3 working days from the arrival of the filled in customer information document that is supplied at chapter 6 in the GS1Trade Sync Setup Guide Connectivity tests Sending to GS1Trade Sync: on the agreed test date perform the following steps a. Partner sends a meaningless file (not XML file); b. Partner check and guarantee that positive MDN has been received (AS2 only); c. Partner ask confirmation that it has been received by GS1Trade Sync (use contacts on chapter 2); d. In case of problems inform GS1 Denmark contact and schedule a new test. Receiving from GS1Trade Sync: on the agreed test date perform the following steps a. GS1Trade Sync sends a mean less file (not XML file). b. Partner is contacted by GS1Trade Sync in order to validate if the meaningless file has been received. In this contact GS1Trade Sync will indicate if MDN was received or not, only applicable for AS2. c. Partner must check and confirm the reception of the file and the delivery of the MDN back to GS1Trade Sync. d. In case of problems inform GS1Trade Sync contact and schedule a new test Confirmation Connectivity tests are considered successful when both partner and GS1 Denmark have confirmed that the communication is working correctly in both directions. GS1 Denmark will inform you when you have been confirmed finished with the communication tests and are ready to start the validating process. Page: 17/17