Certification Guide Network Connectivity for SAP on Premise and Cloud Solutions Integration

Transcription

1 Network Connectivity for SAP on Premise and Cloud Solutions Integration

2 TABLE OF CONTENTS INTRODUCTION... 3 NETWORK PRODUCTS IN SCOPE... 4 CERTIFICATION OVERVIEW... 5 Scenarios... 5 Test Cases... 5 THE CERTIFICATION ENVIRONMENT... 6 Branch Offices... 8 Testing... 8 NEED SOME LAB TIME?... 8 GENERIC LIST OF REQUIREMENTS FOR APPLICATION DELIVERY CONTROLLERS (ADC)

3 INTRODUCTION SAP customers can innovate on top and around their years of investments into On Premise (OP) SAP application landscapes for core enterprise business functions by adding new capabilities delivered by SAP at a rapid pace. Their IT can add value to their business units through the introduction of Cloud, Mobile, new Analytics and Data and Platform technologies without disrupting their on-going business operations. Figure 1: SAP Product Strategy SAP s Software as a Service (SaaS) offerings can be ramped-up without lead time on a subscription basis and increasingly integrations of SaaS or On Demand (OD) applications with existing On Premise applications for overarching hybrid application and business scenarios are offered. All types of end-users: employees, business partners and customers might be offered mobile applications, which can be developed at rapid pace and integrate with the On Premise SAP backend systems. New SAP Hana in-memory processing capability can offer users insights for making business decisions in real time as never was thought possible before by bringing transactional and analytics processing capabilities together. Figure 2: Connectivity, Access, Integration for SAP Solutions SAP is global market leader for business applications sold to a wide spectrum of large to small and medium enterprises. Small to Large companies alike run their own business increasingly globally and globally 3

4 connected through Business Networks with their trading partners, suppliers and customers. Such Business Networks need a strong network infrastructure to function. Concretely this means that traditional customers datacenters have to be connected to: The end users of SAP applications. Thereby end users are distributes around the world. They work from branch offices, from home and hotels when traveling or through mobile devices from anywhere anytime. To SAP Cloud Software and Platform as a Service (SaaS/PaaS) offerings of SAP for the realization of so called hybrid On-Premise/On-Demand business scenario based on application integrations across datacenters. To objects of the Internet of Things like vending machines, smart meters, printers and many more machinery examples, which increasingly produce business relevant data which needs to be processed by SAP business applications. Such connectivity over the Internet or company intranets is part of the overall deployment of business software solutions. As such solutions or mission critical for SAP s customers, technical connectivity through networks becomes a mission critical component itself. To support the business needs and application requirements of SAP s Customers, networks need to be: Reliable Secure Performant Due to this high importance of networks for SAP solutions SAP is offering a Network certification test service to network technology companies. This paper outlines details of Version 2.0 of this certification service. The certified solutions are listed in our SAP Application Development partner directory. To find a list of currently certified partners please use this search Current Network Certifications. Also you may find the previous certifications using this link esoa-aw certifications. These certifications are from the previous generation network certification. Please note that a certification is valid for three years from the certification date. NETWORK PRODUCTS IN SCOPE The prime target of SAP s network certification service offering are network products which sit in the traffic path between applications and their clients or other applications with which they are integrated. The exact definition of network product categories covered by SAP s network certification is sometimes difficult. General guidelines for applicability of a network product to the SAP network certification are: If a network products would fail or not function during the run-time execution of business scenarios running on top of an application-network landscape might be harmed or disrupted. The test scenarios for SAP s network certifications are a good fit for testing a network products features. If no good test scenario for a certain network product is part of the standard certification offering a certification might still be done if the product vendor can provide tools and other help to build a meaningful test scenario. Network products which are typically in scope are: Application Delivery Controllers WAN Optimization Controllers Content Delivery Network services (NEW coverage with Version 2.0 network certification) VPN solutions 4

5 This certification is primarily targeted toward OSI model layer 4-7 network technologies which impact the network traffic flow from SAP application servers to their clients. The ICC Network Connectivity for SAP on Premise and Cloud Solutions Integration certification needs passing of a series of network tests. Your product should be deployable on Amazon Web Services (or AWS) prior to certification.. CERTIFICATION OVERVIEW For a certification to be achieved you must understand its test categories and scenarios. Scenarios There are 4 certification scenarios in all you can be awarded a certification in each scenario that you wish to apply for. : Network Performance Optimization (NETWK-PERF 2.0) Network Security (NETWK-SECURE 2.0) Performance Network Reliability and Availability (NETWK-AVAIL 2.0 Network Tools (NETWK-TOOLS 2.0) Test Cases There are also 5 test cases. These are individual tests and can apply to one or more of the above scenarios: SAP Portal web user interface traffic Hana/BOE Cluster web user interface traffic to be load balanced CRM/SAP Cloud authenticated web services integration CRM web user interface traffic (Load Balanced) CRM SAPGUI traffic (optional upon vendor s request) To achieve a certification the following must fulfilled* 1. ALL test cases for scenarios need to be one of Pass, Enhanced or N/A. Not Applicable is an exception case and not all scenarios can be marked as such. 2. For at least one test case in each scenario there is an enhancement. A Pass is defined as: 1. Functional Correctness. All test case scenarios are working functionally correct with the partner solution in place. Error rates are equal or lower to reference error rates of measurements through SAP Web Dispatcher, (within statistical margins of deviations) 2. All Traffic over the Internet is required to be encrypted. 3. Performance should not be degraded for any test case for any test location. Limits are not more than 2 seconds higher response times for steps lasting up to 20 seconds and not more than 10% response time increase for steps lasting more than 20 seconds. An Enhancement is defined as follows: Reliability: Provide reverse proxy, load balancing or other special feature which helps to enhance reliability end-to-end across the traffic path of SAP solutions and their clients Security: Provide advanced network security capabilities, such as SAP specific x.509 client certificate authentication support or any other advanced network security feature (except for instance simple SSL offloading). Security features need to be demonstrated during testing and a suitable test scenario must exist or be provided by the partner. (Details to be discussed on a case by case basis with ICC). 5

6 Performance: Provide one of the following: a) A 30% or better response time reduction for test locations which are remote to Virginia b) A 30% or better bandwidth reduction of traffic over the Internet. * Subject to change at any time at SAP's discretion. THE CERTIFICATION ENVIRONMENT The AWS US-EAST datacenter located in North Virginia is used as an on premise like datacenter for hosting the SAP components as well as the vendor s datacenter components. All SAP and Partner s system can be integrated within a local area network using the AWS VPC service. Below is a simplified diagram of the environment. There are also Branch Office networks that contain a test client automation tool These Branch Offices are physically located around the world. Requests from the branch offices are transported via the internet. Please See Figure1 6

7 Client Side / DMZ / CRM SAP Webdispatcher CRM Dialog Load Balanced Load Balanced Partner Solution Hana Business Objects Explorer Cluster HP Loadrunner Controller Internet Portal Admin Hub (for administration of all systems) DMZ Partner Solution (optional) LAN Admin Hub Loadrunner Generator As noted in the diagram the LAN side SAP applications are hosted in the /24 subnet and the network services are typically hosted in a DMZ which is the /24 subnet. Inside the LAN side there is an Admin Hub, which is used as host for the RDP connection via VPN. Once connected there are a different tools like browsers, putty, winscp and more available for connecting to and configuring your product. If you wish you may also open your configuration to the internet (however this not recommended). A third /24 network can be used as admin network if required by your product. All subnets are interconnected by an internal router. Connectivity to the internet can be configured upon request. 7

8 Branch Offices Each branch office has a DMZ and an application subnet. The DMZ in each branch is where the partner can install their product if required. There are three branch offices located in North California, Sao Paulo and Singapore. Users are simulated using HP Loadrunner Generator in the branch locations. Each branch office has an Admin Hub for configuration purposes as well. Connection information for each of the branches is as follows: North California Singapore Sao Paulo DMZ IP / / / LAN IP / / / Testing We will set up a meeting to prepare for certification at least a week in advance. The goal for this is to make sure we can setup the environment in AWS and be sure the system is ready for configuration on the day. One of three known situations currently applies: 1. You have an AWS-AMI and share it with ICC s AWS account so that it can be instantiated into the SAP ICC test landscape 2. Your product is in the AWS store so that it can be launched into the ICC test landscape 3. Provide installation tools for upload into the ICC landscape. The vendor s engineer would then conduct the installation of their software. The following should also be prepared: sizing of the AMI (see Licensing of your solution for at least the duration of the certification. Performance testing is run across the Internet using HP Loadrunner. Since the Internet quality is variable and inherently uncontrollable reference data is gathered at the same time as result data. This ensures the conditions of the test are identical for both SAP baseline and Partner result data. SAP s baseline is measured while connecting through SAP Web Dispatcher as a reverse proxy and load balancer while the partner s result is measured thorough the partner s solution. HP Loadrunner provides all performance test data in both cases. Also manual testing is performed during configuration time, for debugging as needed and for verification of functional correctness, see pass criteria. NEED SOME LAB TIME? The AWS environment can be made available for your testing or demonstration events prior to or after certification. This can be used to prepare for certification or to run a Proof of Concept while connecting to SAP software or even to write configuration documentation for your products. An SAP ICC engineer would assist you running the SAP application components and administrating the AWS landscape. Please contact ICC ([email protected]) for fees and scheduling. GENERIC LIST OF REQUIREMENTS FOR APPLICATION DELIVERY CONTROLLERS (ADC) While this list is not exhaustive or complete because SAP s software requirements can vary from one configuration to the next the following is a generic list of requirements an ADC should have to be able to communicate with SAP Software. o Session sticky load balancing. SAP applications are stateful. State is marked with an SAP Session cookie. It is also ok for the ADC to add its own session cookies. 8

9 o SSL Termination, SSL re-encryption of requests forwarding to the SAP System o Support for http keep-alive timeout. Timeout is typically set to 60 seconds. o We flag static http content as cacheable in a browser with a set expiration date. For performance testing we assume that what can be cached (typically 90% of http request) is already cached in the browser. This is a main reason why it is hard for ADCs to produce additional performance gains. o SAP apps use quite good compression. The ADC should not replace that with a lesser effective compression, which could lead to performance degradations. o Ability to request and handle client certificates as basis for SAML based SSO support and authentication of web service requests. o Additionally the ADC should be able to copy client certificates into an http header of the request forwarded to the SAP server. o The ADC should be able to authenticate itself as a trusted intermediary through sending its own client certificate on an https connection to the SAP server. o Most standard http headers should NOT be altered. It is ok to add custom http header fields. o ADCs should be able to re-write absolute URL references in the http body of a response o ADCs should be tolerant on wrong http header hostnames. o ADCs might use some performance enhancement features like TCP/IP flow control, TCP/IP connection multiplexing. Not all requirements are needed for a reliability certification. Security certification needs the client certificate features and/or some attractive complementary security feature like DDoS defense. In the end you show that: - No errors introduced to SAP application functionality through the use of your ADC - No performance degradations - Support of SSL encrypted traffic - Plus some value proposition of what feature isn t in the application and is added by the ADC. The most basic ones for the reliability certification is reverse proxy and load balancing. 9

10 SAP AG. All rights reserved. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, SAP HANA, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company. Sybase and Adaptive Server, ianywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase Inc. Sybase is an SAP company. Crossgate, EDDY, B2B 360, and B2B 360 Services are registered trademarks of Crossgate AG in Germany and other countries. Crossgate is an SAP company. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.