SAP Secure Support. Key SAP Solution Manager Functions in a High Security Infrastructure with Separate Network. SAP AG, Walldorf/Rot, December 2013

Transcription

1 SAP Secure Support Key SAP Solution Manager Functions in a High Security Infrastructure with Separate Network SAP AG, Walldorf/Rot, December 2013 SAP AG 2013 Page 1 of 23

2 Contents 1 Introduction Fundamentals of Network and Communication Security Network Topology for the SAP Solution Manager Communication Channels Communication Destinations Infrastructure Changes Increase Security Alternative Solution for Key SAP Solution Manager Functions Enabling Key SAP Solution Manager Functions Synchronization of Data to run Maintenance Optimizer Retrieval of SAP Notes SAP Note Download SAP Note Upload Use SAP Solution Manager as the Central tool Update SAP Solution Manager Software Components and Service Definitions Sending EarlyWatch Alert Information to SAP Delivery of SAP Active Global Support Remote Services...18 Prerequisite Service report generation for SAP Active Global Support onsite services Appendix/Download Manager Downloading SAP Notes with Download Manager First Installation of Download Manager...23 SAP AG 2013 Page 2 of 23

3 1 Introduction Target group: Customers that operate the SAP solution landscape in a high security infrastructure with a separate network that requires alternative solutions to enable key SAP Solution Manager functions. To use key SAP Solution Manager functions in regular infrastructures, customers use the SAP remote connection 1 to connect and exchange data with the SAP service infrastructure. However, outgoing connections such as SAP remote connection are prohibited when SAP Solution Manager operates in a separate network (from customer s systems to SAP and from SAP to customer s systems. This document describes the alternative setup recommended for running those key SAP Solution Manager functions affected by the absence of the regular SAP remote connection (both sides). The section describing the SAP Solution Manager infrastructure connectivity is taken from Security Guide: SAP Solution Manager 7.0, which is available in the SAP Service Marketplace. It is valid for Solution Manager 7.0 EHP1 and Solution Manager 7.1 These alternatives ensure that customers still benefit from an optimized setup within the constraints of the high security regulations. Important notice: Paragraph 4.1, 4.2, 4.3 are targeted and valid for all SAP customers. Paragraph 4.4, 4.5, 4.6 are targeted and valid for SAP Advanced Secure Support* and MaxSecure customers only (clarification: MaxSecure is a country version (USA) of SAP Secure Support). *SAP Secure Support and MaxSecure are accepted by a separate contract. MaxSecure is a country version (USA) of SAP Advanced Secure Support SAP AG 2013 Page 3 of 23

4 2 Fundamentals of Network and Communication Security 2.1 Network Topology for the SAP Solution Manager Your network infrastructure is extremely important in protecting your system. It needs to support the necessary communication for your business and your needs, while preventing unauthorized access. A well defined network topology can eliminate many security threats or network attacks, such as eavesdropping. If it is impossible for users to log on to your application or database servers at the operating system or database layer, intruders cannot compromise the machines and gain access to databases or files on the backend system. And if users cannot connect to the server LAN (local area network), they cannot exploit wellknown bugs and security holes in network services on the server machines. The network topology of SAP Solution Manager is based on the topology of the SAP NetWeaver platform, so the guidelines and recommendations in the SAP NetWeaver security guide also apply to SAP Solution Manager. 2.2 Communication Channels The table below shows the communication channels used by SAP Solution Manager, the protocol used for the connection and the type of data transferred: 2.3 Communication Destinations The figure below shows an overview of the SAP Solution Manager communication destinations. These destinations include managed systems, third-party products and systems of the SAP Service and Support infrastructure. SAP AG 2013 Page 4 of 23

5 The table below shows an overview of the SAP Solution Manager communication destinations via RFC connections: RFC Connections from SAP Solution Manager to SAP: RFC Destination Name SAPOSS (ABAP connection) SAP-OSS (ABAP connection) S-User (Customerspecific) SAP-OSS- LIST-O01 (ABAP connection) Target Host Name /H/SAPROUTER/ S//sapserv/H/oss0 001 /H/SAPROUTER/ S//sapserv/H/oss0 001 /H/SAPROUTER/ S//sapserv/H/oss0 001 System Number Logon Client Logon user (Password) OSS_RFC (CPIC) S-User (Customerspecific) Use (Scenario) Notes Assistant Exchange problem messages with SAP (function: Service Desk), synchronize system data with Support Portal and send data about managed systems; transfer of solution, issue data; transfer feedback to SAP Service Connection, product data download Retrieve information about which messages have been changed at SAP How Created Maintain technical settings in transaction OSS1 Auto-matically created via transaction SOLMAN_SE TUP (view: managed systems) Created in transaction SM59 SAP AG 2013 Page 5 of 23

6 SDCC_OSS (ABAP connection) See SAP Note Used by the Service Data Control Center to communicate with the SAP Support Portal frontend system; update Service Definitions (functions: System Monitoring for EWA and Service Plan) User is a copy of the SAPOSS connection to SDCC_OSS; usersdcc_n EW with default password: download Note If SDCCN is used locally, that is Solution Manager is not Master System, SDCC_OSS is created automatically in the managed system; SAPNET_R FC (ABAP connection) SAPNET_RFC (ABAP connection) /H/SAPROUTER/ S//sapserv/H/oss Send EarlyWatch Alerts (functions: System Monitoring for EWA and Service Plan) A copy of the SAPOSS connection to SAPNET_RFC SAPNET_R TCC (ABAP connection) /H/SAPROUTER/ S//sapserv/H/oss OSS_RFC (CPIC) Service Preparation Check (RTCCTOOL) Created automatically by RTCCTOOL, copy of SAPOSS SAP AG 2013 Page 6 of 23

7 RFC Connections from SAP Solution Manager to satellite systems and from satellite systems to SAP Solution Manager: SAP AG 2013 Page 7 of 23

8 3 Infrastructure Changes A network that provides a high security infrastructure has the following requirements: 1. Remove components or services which do not meet the required security standards. 2. Implement additional components or services compliant with the required security standards to provide alternative solutions for removed components and services. 3.1 Increase Security Figure 1 shows standard key destinations set up by customers for communication with SAP. Figure 1: Standard Customer SAP Connections In a high security infrastructure with a separate network for remote connection to/from SAP purposes, connections 1,2,3 as shown in the picture above are firstly removed. Usually, a further protective demilitarized zone (DMZ) is created around this network for applications that require a lower security level and for applications with outgoing connections. Main Usage of Standard Connections: Line 1: Download maintenance objects: Support Packages (SP) and Enhancement Packages (EHP), SAP Notes, etc. Line 2: Standard remote connection for problem solving, remote service delivery, service report download. Line 3: Synchronization of Maintenance Optimizer data and Maintenance Certificate, retrieving SAP Notes, updating SAP Solution Manager software components and service definitions, sending SAP EarlyWatch Alert data to SAP, remote service delivery via SAP Solution Manager. Line 4: Solution Monitoring / System Monitoring / Diagnostics, Change Management. SAP AG 2013 Page 8 of 23

9 3.2 Alternative Solution for Key SAP Solution Manager Functions After customers have removed all remote connections from their SAP Solution Manager system to the SAP service infrastructure, SAP proposes an alternative technical support infrastructure for remote service and support delivery, as illustrated in Figure 2a. In addition to the existing SAP Solution Manager system, customers install a second SAP Solution Manager system in the DMZ. SAP provides a Download Manager to download SAP Notes without using the SAP remote connection. See chapter 5 for more information on Download Manager, including how to obtain and install it. Customers can distribute the Download Manager to any employee who requires it, or limit the number of installations to centralize these activities for greater control. Figure 2a: Proposed alternative technical support infrastructure Not included in Figure 2a is a special secure connection at an enclosed location within SAP s Support facilities in Germany, France and in the USA. This connection is entirely maintained by customer, whereas SAP provides a secure room * with restricted access and a secure locker for customer devices (e.g. laptops, routers). The secure room gives SAP experts remote access to the customer s high security infrastructure, via a separate network, for their services. Figure 2.b shows how the special secure connection fits into the picture. (*): The secure room provides the highest level of security that secure support services offer for remote support. The room has a shield absorbability. It is protected with access control system, impact sound detector and automatic fire and intrusion detection systems. In this room remote system access to the target system is operated using a connection that is physically isolated from the SAP internal network. SAP AG 2013 Page 9 of 23

10 Figure 2.b: Secure connection via separated network SAP AG 2013 Page 10 of 23

11 4 Enabling Key SAP Solution Manager Functions Summary of workarounds that enable key SAP Solution Manager functions in this type of secure infrastructure, with remote connection via a separate network: 4.1 Maintenance Objects Synchronization in a high security infrastructure can be completely manually performed (verification of secure content download: SAP provides checksum tool (SAP Note )) or performed with the secure export/import of Maintenance Optimizer data Retrieving SAP Notes Upload SAP Notes via SAP Service Marketplace. 4.3 Updating SAP Solution Manager software components and service definitions (SDCC) File upload from SapservX (see SAP Notes and ). 4.4 Sending SAP EarlyWatch Alert data to SAP Export report manually as a document from Microsoft Office Word 2003 or higher and send to SAP for analysis if required. 4.5 Remote service delivery via disconnected SAP Solution Manager system Create self-service (see SAP Note ). 4.6 Generating service report Service report is generated on client/frontend in Microsoft Office Word 2003 or higher and manually sent to SAP. 4.1 Synchronization of Data to run Maintenance Optimizer Maintenance Optimizer requires information from both the customer s solution landscape and service infrastructure. As both environments are isolated from each other in a high security infrastructure with a separate network, an alternative solution is recommended. SAP recommends installing a second SAP Solution Manager system in the DMZ (SOLMAN II). The existing SAP Solution Manager (SOLMAN I) continues to fulfill the in-house tasks within the high security environment, while SOLMAN II takes over the external tasks in this context. Prerequisite: SAP Solution Manager minimum release: SAP Solution Manager 7.0 EHP1 (ST 400 SP 23) or SAP Solution Manager 7.1. Exchange of Maintenance Optimizer relevant data: The data exchange is realized through the simulation mode in Maintenance Optimizer Transaction (possible as of ST 400 SP 23): SAP AG 2013 Page 11 of 23

12 1. Create a Maintenance Optimizer Transaction in SOLMAN I 2. Perform step 1 Plan Maintenance 3. Choose Select File in step 2, select Save Simulation Data and save the initial system constellation as a XML file SAP AG 2013 Page 12 of 23

13 Example of an extract of a XML file: If required, the simulation XML can be made anonymous by replacing installation number, server name, system ID, etc. with placeholders. In the stack XML the placeholders have to be changed back to the original values. 4. Create a Maintenance Optimizer Transaction in the SOLMAN II 5. Import the XML file 6. Finish the maintenance transaction 7. Get the required stack XML file For messages on these topics please use the following component: SV-SMG-MAI for Maintenance Optimizer Maintenance Optimizer data: The Maintenance Optimizer tool will be required for all software correction packages, including Support Packages (Stacks), for SAP NetWeaver 2004s and subsequent versions, as well as all applications based on this software (including SAP Business Suite 2005), SAP AG 2013 Page 13 of 23

14 released after April 2nd, These packages will be available only through the Maintenance Optimizer in SAP Solution Manager. SAP Solution Manager release needed: SAP Solution Manager 7.0 Note: Alternatively, you can select the software correction packages you need in SAP Service Marketplace, and create a customer message on component SV-SMG-MAI- APR on the SAP Service Marketplace to have the selected files released (approved) manually by SAP support, for your S-user. Then apply the files manually to your target systems. 4.2 Retrieval of SAP Notes SAP Notes can be loaded into your system by three procedures: using an RFC connection (SAP Note download) by file transfer (SAP Note upload) using SAP Solution Manager as a central tool Customers operating a high security infrastructure with a separate network and without SAP remote connection will not have an RFC connection. The SAP Note download method is then not available, and we recommend SAP Note upload for your landscape or the usage of the SAP Solution Manager II in DMZ SAP Note Download Prerequisites: You have established a RFC connection (see activating Note Assistant) SAP Note download has the following advantages: Note When you download an SAP Note, you can use Note Assistant to directly load it into your system by an RFC connection to SAP. If other SAP Notes are prerequisites prior to the requested SAP Note, Note Assistant automatically downloads them during implementation (Implementing Correction Instructions). You can download updated versions of SAP Notes at the press of a button (Updating an SAP Note). After importing a Support Package, the SPAU calculates the new status of the SAP Notes (obsolete, re-implementation...) To download a SAP Note, the managed system needs a RFC connection to SAP SAP AG 2013 Page 14 of 23

15 SAP Note Upload Prerequisites: You have installed the Download Manager 2 which enables you to load SAP Notes from the SAP Service Marketplace. The Download Manager is in SAP Service Marketplace, under and the menu: Get Download Manager. Procedure for SAP Note upload: 1. Select the SAP Note in the SAP Service Marketplace under 2. Choose Download. 3. The SAP Note is added to your download basket. You can repeat this action for as many SAP Notes as you require. 4. To save the SAP Notes locally on your PC, start the Download Manager and choose Download. 5. The SAP Notes are loaded as files into the directory you have specified. 6. Transfer the files to the high security network, according to customer-specific security regulations. 7. Use the upload function in Note Assistant (Go to Upload SAP Note) to load the SAP Note files into your system. Note Alternatively, in the Download basket you can directly download each SAP Note individually as a zip-file. Choose the description to start the download SAP Note upload and pre-requisite SAP Notes: SAP Notes need to be manually selected in the SAP Service Marketplace. This includes manual selection of pre-requisite SAP Notes. Pre-requisite SAP Notes may have their own prerequisite SAP Notes in turn, making SAP note selection difficult and time-consuming. SAP Note upload and transaction SPAU (Modification Browser): SPAU only considers the SAP Note versions in the system, so the status of these SAP Notes is based on these versions. In order to complete the SPAU based on the current SAP Note version you have to manually check for new versions of these SAP Notes and upload them into your system. Result: After you have downloaded or uploaded a SAP Note that was not previously in your system, implementing it using transaction SNOTE changes its processing status in the SAP Note overview to New. 2 See appendix chapter 5 for more information on the Download Manager SAP AG 2013 Page 15 of 23

16 4.2.3 Use SAP Solution Manager II in DMZ as the Central tool Use SAP Solution Manager as the central tool to download SAP Notes and distribute them to managed systems Advantage: Get the latest versions for all SAP Notes by Download Latest Version of SAP Notes Prerequisite: SAP Solution Manager II in DMZ with a remote connection to SAP Global Support Backbone Procedure in SAP Solution Manager II in DMZ: 1. Run SNOTE and choose Goto -> Download SAP Note 2. Enter SAP Note number and choose Execute 3. Identify dependent SAP Notes and download them too (see steps 1 & 2) 4. Execute report SCWN_TRANSPORT_NOTES with transaction SA38 to export correction instructions into a transport 5. Download the transports (co-file, data-file) Procedure in Managed System (ie Target System): 1. Copy transport files into the relevant directory of the target system 2. Import transports into target system using transaction STMS 3. Execute SNOTE 4. Choose refresh display to refresh status information 5. Start implementation of corrections Note: The implementation status of the SAP Note in SAP Solution Manager II in DMZ is transferred into the target system. Perform a refresh in the target system to consider the local system. 4.3 Update SAP Solution Manager Software Components and Service Definitions SAP Solution Manager components must be regularly updated, independently of the customer security standards or infrastructure. To ensure that the automatic SAP EarlyWatch Alert sessions for your SAP landscape use the latest SAP service definitions, you need to regularly update the following components: ST, ST-SER, ST-PI and ST/A-PI. There are usually 2 releases of ST-SER per year. The naming is 700_<year>_1 or 700_<year>_2. This component requires an upgrade to get the latest version. All components are also supplied with Support Packages, which should be implemented. The service tools ST-PI and ST/A-PI need to be implemented and updated on the SAP Solution Manager and on the managed systems. They contain the download functions needed for service delivery in SAP Solution Manager. Note See SAP Notes and for further information regarding updating Service Definitions (SDCC/SDCCN). Note : If the customer does not have a connection to SapservX, to get the latest service definition file (SERVDEF.CAR), open a message on component SV-SMG-SDD to SAP AG 2013 Page 16 of 23

17 get the file from SAP via FTP transfer (the SERVDEF.CAR file is usually updated every 6 months). Use SDCCN instead of SDCC to benefit from enhanced functions. See SAP Note for further information. In SDCCN, make sure that the 'master' flag points to SAP Solution Manager. The service definitions will then be pulled from there, and SERVDEF.CAR only has to be applied in the SAP Solution Manager system. See SAP Note for further information on the master flag. 4.4 Sending EarlyWatch Alert Information to SAP It is not possible to forward SAP EarlyWatch Alert session data automatically in a high security infrastructure without the regular SAP remote connection. Figure 3: Regular SAP EarlyWatch Alert workflow: We first describe the regular process, to provide the context for our proposed alternative, and then describe the proposed alternative. Regular process steps: 1. The customer enables/activates SAP EarlyWatch Alert in their SAP Solution Manager. 2. SAP Solution Manager gathers system data from managed systems into SAP Solution Manager. 3. A new SAP EarlyWatch Alert session is regularly created and presented in the SAP EarlyWatch Alert monitor, usually scheduled automatically. SAP AG 2013 Page 17 of 23

18 4. SAP Solution Manager can be set up to distribute the SAP EarlyWatch Alert report internally for analysis and action, or one person can be assigned to manually assess the reports and to inform the relevant teams/persons about actions to be taken. 5. SAP EarlyWatch Alert reports with an overall red rating for a productive system, are automatically forwarded by SAP Solution Manager to SAP. SAP analyzes these reports and contacts the customer, if necessary. 6. The session data for productive systems for which no red SAP EarlyWatch Alert report rating has been forwarded, is forwarded to SAP every month, for information purpose only. Steps 1 to 4 are not affected by the absence of the regular SAP remote connection. Steps 5 and 6 are no longer possible, as the SAP remote connection for the communication is no longer opened. Our proposed alternative: 5. for step 5 is: a. SAP EarlyWatch Alert reports with an overall red rating for productive systems are manually generated by the customer (report created with Microsoft Office Word 2003 or higher) and sent by to sap_secure_support_services@sap.com with a cc. to the assigned Technical Quality Manager (TQM). Please ensure that each SAP EarlyWatch Alert report is only sent once to SAP. b. SAP will analyze the report and send feedback by Reply-to-All to the distribution list used by the customer in step a. To ensure that our feedback to the customer can be processed as soon as possible, include at least one customer employee in the cc. list. In this way, the customer controls who gets the SAP EarlyWatch Alert report, its content and our feedback. 6. for step 6 is the same as for step 5, leaving it to the customer s discretion: a. to actually send the latest SAP EarlyWatch Alert monthly, or b. only send the latest SAP EarlyWatch Alert if you need help to analyze or react. 4.5 Delivery of SAP Active Global Support Remote Services SAP Active Global Support delivers services through the customer s SAP Solution Manager. In order to deliver services, SAP creates service plans in SAP internal systems, which are copied into the customer s SAP Solution Manager, where service sessions are created for delivery of these services, using the SAP remote connection. To deliver the remote services, SAP service engineers use the SAP remote connection to log on to the customer s SAP Solution Manager, which is the central collector of relevant data from the systems receiving the remote service. In the absence of the SAP remote connection, the service plan is not replicated to the customer s SAP Solution Manager, so no service session is created. SAP AG 2013 Page 18 of 23

19 Instead, approved service engineers access the customer s SAP solution landscape using the secure connection from the secure room. After logging into the customer s SAP Solution Manager, the service engineers first create a self-service to replace the not remotely triggered service session. From there on, the remote services are delivered as usual, using the secure connection. On-site support services, remote support services and CQC services (as part of SAP Enterprise Support services) can be delivered in this way. There is no technical limitation to the number or type of services that can be delivered in this way. SAP remote services are completed by creation of an SAP service report. Upon completion of the remote service session, the initial service report is generated in the customer s SAP Solution Manager, running the SAP GUI and using Microsoft Office Word 2003 or higher with macros. Note Minimum prerequisite: Microsoft Office Word 2003 or higher with language English. Macro security settings set to low. The document is saved to a network drive in the customer s separate network. Customers provide a network drive where the SAP service engineer can temporarily store this document, and which can be accessed by customer s prime contact for the service. The report is finalized at SAP and will be provided to the customer in PDF format, so the document generated with Microsoft Office Word 2003 or higher has to be transferred to SAP. This can be done by download via a shared folder (FTP) or the report can be sent to SAP via by the prime contact. The final SAP service report is normally published on the SAP Service Marketplace, after which the customer is sent a link for access, or the customer can access the report by searching for service messages for their customer number(s). For DSS customers, a classified report remains at the customer site, and with the colleague who delivered the service (with a backup stored at a secure server at SAP AG (PS DSS)). In the SAP Service Marketplace, only a cover page containing the customer name, report name, session date and the name of the colleague who delivered the service is stored. A backup of the service report is available in the absence of the TQM/Service Deliverer, on request, via to sap_secure_support_services@sap.com. It is explained that the full report is not accessible because of customer security regulations. Prerequisite The prerequisites for Service Delivery are fulfilled by completing the SAP Solution Manager Configuration (transaction SOLMAN_SETUP). Therefore execute the following steps: Perform activities in sections System Preparation and Basic Configuration Perform activities in section Managed Systems Configuration for all systems that are in scope of the SAP Support Services 4.6 Service report generation for SAP Active Global Support onsite services SAP Active Global Support onsite services are also delivered using the customer s SAP Solution Manager. Remote services are normally triggered onsite from a service plan replicated to the customer s SAP Solution Manager, where a service session is created. In SAP AG 2013 Page 19 of 23

20 the absence of this replication, the onsite team manually creates a self-service in the customer s SAP Solution Manager. The difference from the SAP remote service is that the initial report is generated by the onsite team before they leave. Note Minimum prerequisite: Microsoft Office Word 2003 or higher with language English. Macro security settings set to low. The report is finalized at SAP and will be provided to the customer in PDF format, so the document generated with Microsoft Office Word 2003 or higher has to be transferred to SAP. This can be done by download via a shared folder, or the report is sent to SAP via e- mail by the prime customer contact. The final report is sent to a selected number of customer representatives by the Technical Quality Manager (TQM), and for long-term backup also cc. to the following address: sap_secure_support_services@sap.com In this way, a classified report remains at the customer site, and with the colleague who delivered the service, with a backup stored at a secure server at SAP AG (PS DSS) with access for security-cleared personnel only. In the SAP Service Marketplace, only a cover page containing the customer name, report name, session date and the name of the colleague who delivered the service is stored. A backup of this service report is available, in absence of the TQM/Service Deliverer, on request, via to sap_secure_support_services@sap.com. It is explained that the full report is not accessible because of the security regulations of the customer. Figure 4: Workflow classified reports Step by step workflow SAP Customer on 4.4 / 4.5 / 4.6 SAP EarlyWatch Alert reporting/service reporting in a high-security environment without connection/standard remote access to SAP Global Service Backbone. Figure 5: Remote Services Delivery Processes SAP AG 2013 Page 20 of 23

21 Processes Delivery Remote Services Customer Side SAP Service Engineer in secure room: Logon to SSM / Managed System / Create service session in SSM / Deliver service session 1 Service Engineer: Finalize the service report / Internal QA Service Engineer: Inform TQM about service report Customer or Service Engineer: Create 1st version of Service Report Customer: Move the 1st version of Service Report to the secure share 1st version of Service Report Final version of Service Report Service Engineer: Close Service Session in Service Portal (Add cover page ONLY to the service session / session text contains no details / real service rating) Service Engineer: Inform customer about service report Customer: Access the final service report and implement recommendations TQM: Responsible for Follow Up of red rated services (without creating RLPP activity) Customer: Analysis of EWA on regular base In case of red rating or other critical situation, copy report to the secure share and send a mail to TQM 2 EWA report TQM: Verify rating of red EWA and check problems TQM: Inform Service Delivery (certified consultant) Service Engineer : Analysis of Issues, Creation of Action Plan and discussion with TQM Customer: Access the recommendations / action list and implement recommendations TQM: Inform Customer about results of Analysis SAP 2008 / Page 2 Information Flow 1 2 Process Service Delivery Process EWA Post Processing Note: The secure share could be an FTP server controlled by the customer or standard SAP FTP Server SAPBox SAP AG 2013 Page 21 of 23

22 5 Appendix/Download Manager 5.1 Downloading SAP Notes with Download Manager Find your note on the SAP Service Marketplace When the note is displayed, choose [Download Corrections] Choose [Download Basket] Select the required SAP Notes and choose [Get Download Manager] SAP AG 2013 Page 22 of 23

23 5.2 First Installation of Download Manager The next screen explains what to do to for the first installation: Under related topics, you will also find information on how to use the Download Manager: SAP AG 2013 Page 23 of 23