CHANNEL PARTNER (VAR) Technical Support Network. SAP Global Service & Support March 2011

CHANNEL PARTNER (VAR) Technical Support Network SAP Global Service & Support March 2011

Advantage of Network Connections Technical communication between three parties customer, partner, SAP allows effective End-to-End-Support throughout the whole life cycle. SAP standards for best security requirements for data transfer are proven since decades. SAP offers its customers access to remote support and to a large number of support services delivered remotely in the customer system. Error analysis and services delivered remotely have one major advantage: they are available straight away. Customer, Channel Partner (VAR), and SAP are a perfect team in collaboration. To deliver Enterprise Support to customers a technical connection between three pillars of successful support is basic. For different ranges of use a network connection is necessary: 1. Incident management, Maintenance Optimizer easy message processing and support for updates 2. Remote access secured logon to customer system 3. EarlyWatch Alert early identifying of issues 2011 SAP AG. All rights reserved. 3

SAP End-to-End Support Network Customer Partner (VAR) SAP SAP Global Service Backbone Channel Partners are the link between customers and SAP. At all time customers are expecting reliable support services. This proven collaboration between three parties is founded on a technical collaboration. Secure network connections allow and control processes quickly, automatically, and transparently. 2011 SAP AG. All rights reserved. 4

Remote Connectivity and Access Process Overview Customer Partner (VAR) SAP Data Transfer Data Exchange SAP Global Service Backbone 4 1 Customer s SAP Solution Incident/EWA/MOPZ 3 2 Remote Access In order to completely use all offered options several network connections are necessary to provide End-to-End support: 1 2 3 Prerequisite: partners use RFC connection for data exchange between SAP Solution Manager and SAP Partners have access to their customer s system landscape via remote access Customers have access to partner s Service Desk for incident management, Maintenance Optimizer (MOPZ)*, EarlyWatch Alert (EWA) report 4 Customers can transfer data to partner s Solution Manager (e.g. for EWA data) *SAP Business All-in-One only 2011 SAP AG. All rights reserved. 6

Agreement Basis To leverage SAP Support Network partner must ensure that the communication connection partner SAP as well as end users SAP, are operable at all times and allow satisfactory response times. The connections are necessary for remote support to be provided efficiently,. This also covers the required communication connections to a third party involved. A partner must bear the connection costs resulting from remote support. SAP recommends that partner uses the technologies for remote support specified on SAP Service Marketplace (http://service.sap.com/~form/sapnet?_shortkey=01100035870000044806&_scenario=01100035870000000202&and SAP Note 35010). In case SAP Solution Manager as a collaboration and support platform is also installed for end user usage, partner will use this SAP Solution Manager to remotely access the software within End Users SAP environment for Incident Remedy subject to prior consent from End Users. 2011 SAP AG. All rights reserved. 7

Basic Connection to SAP Backbone Overview VAR SAP SAP Global Service Backbone RFC VPN Switch VPN Switch (sapserv1) INTRANET INTRANET VPN (with IPsec) (add. Hardware*) (- ISDN ) (leased line or dial-up) static IP address = Firewall = RFC to SAP = Demilitarized Zone * = additional VPN hardware (switch/gateway) 2011 SAP AG. All rights reserved. 9

Basic Connection to SAP Backbone Description To provide message processing for customers in standard scenario an Remote Function Call (RFC) connection between your SAP Solution Manager and SAP Backbone is necessary for 1. Synchronization of necessary customer data (master data) 2. Synchronization of messages is an SAP program that acts as an controlling gateway (proxy) in a network connection between SAP systems, or between SAP systems. controls the access to your network using static IP addresses, and, as such, is a useful enhancement to an existing firewall system (port filter). More details a) For a network connection via internet two methods are possible: 1. SNC (Secure Network Communication): SNC connections are established between two s using software-level encryption based on SNC standard. They require no additional hardware, but additional software has to be installed. SAP is recommending a VPN connection to SAP to use all offered options (incl. remote access to customer systems). 2. VPN (Virtual Private Network): VPN connection provides hardware-level encryption based on IPSec standard. A VPN switch is required at the partner site and at second party site. s at both parties are recommended. More information on technical specifications Both options are using three types of security measures to protect your systems and data from unauthorized access: State-of-the-art encryption Server authentication Access-control technology b) The network connection to SAP basically can also be established with a dial-up connection or with a leased line. But ISDN and Frame Relay are getting less important in times of growing internet distribution. 2011 SAP AG. All rights reserved. 10

Incident Management Overview CUSTOMER VAR SAP HTTPS SAP Web Dispatcher SAP Global Service Backbone RFC (sapserv1) INTRANET INTRANET VPN (with IPsec) (add. Hardware*) (- ISDN ) (leased line or dial-up) INTRANET = RFC to SAP = Incident (HTTPS access to Work Center at partner s Service Desk) = Firewall = Demilitarized Zone * = additional VPN hardware (switch/gateway) 2011 SAP AG. All rights reserved. 12

Incident Management Description Incident Management with SAP Solution Manager Service Desk is an essential task for channel partners. Usually customers are having access to their partner s Service Desk via Internet. Customer user create and process messages in a Work Center in partner s Solution Manager instead of SAP Service Marketplace. To provide secure access of the customers to Work Centers in partner s Solution Manager with HTTPS SAP is recommending the use of SAP Web Dispatcher. Message process: Customer Partner SAP (1 & 2 level support) (3 level support) Message process: A customer creates a message in the web based Work Center of his channel partner. One of the support employees of the partner is processing a new customer message and sends back a solution proposal. If this is not solving customer s issue then the message is set back for processing by partner. Sometimes further expertise by an SAP specialist is necessary. Therefore this message is forwarded to SAP and send back to partner who automatically or manually forwards the solution proposal to customer. If now the customer is satisfied the message is confirmed a partner and at SAP. 2011 SAP AG. All rights reserved. 13

Incident Management Links to Documentation Overview of Incident management: http://service.sap.com/~sapidb/011000358700000248452008 Information SAP Web Dispatcher: http://help.sap.com/saphelp_erp60_sp/helpdata/en/42/5cfd3b0e59774ee10000000a114084/frameset.htm Setup SAP Web Dispatcher: http://service.sap.com/~sapidb/011000358700000121752008 Configuring the SAP Web Dispatcher to Support SSL: http://help.sap.com/saphelp_nw70/helpdata/de/39/09a63d7af20450e10000000a114084/frameset.htm 2011 SAP AG. All rights reserved. 14

Remote Access Overview CUSTOMER VAR SAP SAP Global Service Backbone (sapserv1) INTRANET INTRANET SNC (with SSL certificates) (add. software) or VPN (with IPsec) (add. hardware) (- ISDN, Frame Relay) (leased line or dial-up) VPN (with IPsec) (add. hardware*) (- ISDN ) (leased line or dial-up) INTRANET = Remote Access via SAP to customer system = Firewall = RFC to SAP = Demilitarized Zone * = additional VPN hardware (switch/gateway) 2011 SAP AG. All rights reserved. 16

Remote Access Description For the solution of a customer message a look into the customer s system often is helpful. The customer can leave logon data in Secure Area at SAP when creating a message. So a message processor can start remote logon at customer in a customer message. SAP Solution Manager (Customer Connection SAP Service Backbone) of the partner will call an application in SAP Service Marketplace which guaranties secure logon at customer systems. Currently two ways of remote access are provided: --connection: direct logon at customer system Netviewer: especially for the needs of SAP adjusted tool for desktop sharing Access to this application at SAP side is not supported via an SNC connection. You can either use ISDN connected s, or set up an IPSec VPN tunnel instead of (or in addition to) the SNC connection. For information about IPsec VPN connections please see http://service.sap.com/internetconnection To use an ISDN might not be very cost effective since you have to pay for the ISDN long distance calls, so it might be better to set up an IPSec VPN tunnel. How to set-up Remote Connection for Partners: http://service.sap.com/~form/sapnet?_shortkey=01100035870000722611&_object=011000358700000547222009e Schedule VPN connection to SAP network: https://service.sap.com/sap/support/notes/486688 Note on connection with customers: http://service.sap.com/sap/support/notes/1124718 Netviewer usage: http://service.sap.com/~form/sapnet?_shortkey=01100035870000725685&_object=011000358700001192462009e Description of Netviewer: (http://service.sap.com/~form/sapnet?_shortkey=01100035870000688675&_scenario=01100035870000000202&) 2011 SAP AG. All rights reserved. 17

Remote Access Links to Documentation How to set up a Remote Network Connection to SAP: http://service.sap.com/~form/sapnet?_shortkey=01100035870000044806&_scenario=01100035870000000202& Differences VPN/SNC and Technical Specifications http://service.sap.com/~sapidb/011000358700004675142006 Secure Network Communications (SNC): http://help.sap.com/saphelp_nw70/helpdata/en/e6/56f466e99a11d1a5b00000e835363f/frameset.htm How to configure the : http://service.sap.com/~form/sapnet?_shortkey=01100035870000044248&_scenario=01100035870000000202& Installing the sapcrypto library and starting the : http://service.sap.com/~form/sapnet?_shortkey=01100035870000234692&_scenario=01100035870000000202&_object=011000358700004675142006e 2011 SAP AG. All rights reserved. 18

Service Connection Types Links to Documentation Service Connection Type Description SAP Note SAP GUI based connection R/3 Support enables remote access to an SAP system via SAP GUI 812732 Connection types providing application sharing methods or access on OS-level (operating system) Netviewer enables collaboration and application sharing access via Netviewer 1124718 (for VARs) 2011 SAP AG. All rights reserved. 19

EarlyWatch Alert Data Transfer Overview CUSTOMER VAR SAP SAP Global Service Backbone RFC back RFC (sapserv1) INTRANET INTRANET SNC (with SSL certificates) (add. software) or VPN (with IPsec) (add. hardware) (- ISDN, Frame Relay) (leased line or dial-up) INTRANET = Service Connection (back destination: EWA, ) = RFC to SAP = Firewall = Demilitarized Zone = Red alert - very critical/error 2011 SAP AG. All rights reserved. 21

EarlyWatch Alert Description SAP EarlyWatch Alert (EWA) is necessary for SAP Enterprise Support. In a customer system EWA gathers performance data using a data-collecting mechanism that runs as a background job. This data is sent from the customer s system to partner s central SAP Solution Manager for processing and evaluation. Partner can send an HTML report automatically via email to end customer or provide the report in a separate Work Center. Depending on the criticality of the EWA report, the necessary action is taken by VAR. If the overall rating of the report is Red: Very critical/error, VAR contacts SAP Partner Support Advisory Center and subsequently open a message to SAP (SV-ES-SAC) with attached SAP Customer Partner SAP EarlyWatch Alert report within 24 hours. SAP Partner Support Advisory Center will 1 analyze the situation based on the report 3 and decide if a Technical Quality Check (TQC) is required. SAP Partner Support Advisory Center will inform partners on Send EWA Data If red rating the analysis result and, if required, Process EWA Data Check red rated EWA Report Collect Data schedule service delivery of relevant forward to SAP Technical Quality Check session jointly Check EWA Report Implement with partner and end customer. For details, see SAP Note 1162164 (Channel Partner Support Advisory for SAP Enterprise Support). recommendations 2 SAP Solution Manager Implement recommendations 5 Deliver Services (for example Early Watch) Contact Customer 4 Contact Customer and create Service Plan 2011 SAP AG. All rights reserved. 22

EWA Data Transfer Links to Documentation For setup EarlyWatch Alert see SAP Solution Manager IMG with Transaction SPRO Online learning maps in SAP Service Marketplace http://service.sap.com/~iron/fm/011000358700004587872005e/011000358700006436682006wrk2?tmp=1241458520143#bkm_show1_08_00qq Best Practice for Value Added Resellers (VARs) - Activating SAP EarlyWatch Alert in End Customer s System http://service.sap.com/~sapidb/011000358700000567342009e Online documentation http://help.sap.com/saphelp_smehp1/helpdata/en/2f/de3316e1fc425080f83c718bec41de/frameset.htm 2011 SAP AG. All rights reserved. 23

Channel Partners Remote Connections Summary CUSTOMER VAR SAP HTTPS SAP Web Dispatcher SAP Global Service Backbone RFC back RFC (sapserv1) INTRANET INTRANET SNC (with SSL certificates) (add. software) or VPN (with IPsec) (add. hardware) (- ISDN, Frame Relay) (leased line or dial-up) VPN (with IPsec) (add. hardware*) (- ISDN ) (leased line or dial-up) INTRANET = Service Connection (back destination: EWA, ) = Firewall = Remote Access via SAP to customer system = RFC to SAP = Incident (HTTPS access to Work Center at partner s Service Desk) = WebDispatcher: application gateway / reverse proxy = Demilitarized Zone * = additional VPN hardware (switch/gateway) 2011 SAP AG. All rights reserved. 25

Remote Function Call (RFC) Types You can create the following RFC connections to navigate between systems: - READ RFC connection (for Monitoring managed systems) - BACK RFC connection (can only be used in programs called from remote sources) SAP EarlyWatch Alert The BACK RFC connection (SM_<SID>CLNT<Client>_BACK) from a managed system to the Solution Manager system is required for the following scenarios: - Service Desk, to send Service Desk messages - Solution Monitoring, to send SDCCN data - Implementation, to check for changes to locked Customizing objects in the Customizing Distribution function Change Management, to ensure the integration of Service Desk and Change Request Management ( When a function module establishes an RFC call using the destination BACK, the return connection is automatically protected with SNC if the original connection was SNC-protected. The system does not set up a new connection for the BACK destination; it uses the original connection for the return connection.) -http://help.sap.com/saphelp_nw70/helpdata/en/6c/ef1865f0494d0083300f87174177d9/content.htm -TRUSTED RFC connection (A calling system can be defined in the called system as a 'trusted system', using transaction SMT1. AS ABAP can log on to another AS ABAP without a password. This kind of trusting relationship between AS ABAPs has the following advantages: Single sign-on, no passwords are transferred across the network,timeout mechanisms for logon data prevent misuse, user-specific logon data for the trusted system is checked.) or - LOGIN RFC connection For detailed information about creating RFCs with the Solution Manager System Landscape, see the online documentation of the Solution Manager System Landscape (Transaction SMSY -> Help -> Application Help -> System Landscape Management). 2011 SAP AG. All rights reserved. 26

Connection Types Additional Details Internet connections Internet connections Secure network communication (SNC) via software to deliver software encryption Virtual private networks (VPN), which provide hardware-level encryption VPN (Virtual Private Network) is a network that uses tunneling technique to transmit encrypted data from point to point over the public internet. A VPN provides hard data encryption at hardware level. For the VPN approach a VPN switch (VPN gateway) is required at both connected points (partner / customer / SAP) in front of a. SNC (Secure network communication) connections are established between two. No additional hardware is required at either end of the connection. The technology of SNC makes the connection over the internet secure, using stateof-the-art encryption. They require no additional hardware, but additional software has to be installed. You can download this software directly from SAP Service Marketplace. HTTP connections can be secured by using SSL (HTTPS) and RFC connections can be secured by using SNC. 2011 SAP AG. All rights reserved. 27

Connection Types Additional Details More Connections Phone Connections Frame Relay Frame Relay networks are currently offered primarily in North America. They are also packet switching networks, but have higher protocol levels that handle data security, enabling the network to work with significantly less administrative information. SAP recommends the following parameters for a Frame Relay connection: Port speed of 56 or 64 kbits/second. Recommended CIR (Committed Information Rate) of 4 or 8 kbits/second. This data speed is sufficient for connecting to the SAP Service Network. Higher CIRs are more expensive, and are therefore not recommended. The CIR is the minimum transfer speed that is always guaranteed by the network provider, but higher transmission rates are possible, provided the network load is not too high. We recommend using routers for the connection to a Frame Relay network, as the connection via routers is safer and more flexible. Make sure that the routers used are suitable for Frame Relay. ISDN ISDN (Integrated Services Digital Network) will most likely replace the current analog telephone lines. In ISDN, communication takes place in different channels. Communication companies offer ISDN with different configurations. To connect to the SAP Service Network you need a basis, or S0, connection. This connection contains two B channels and one D channel. An ISDN connection is set up by switching a B channel connection. In theory, it is also possible to transport X.25 data packets in addition to the control information on the D channel (9600 baud) and to transfer these to X.25 networks (X.31). This functionality must be explicitly supported by both the connection side and the hardware and represents a normal X.25 connection to SAP. The PPP protocol and CHAP authentication procedure are used by SAP for data transfer on the B channel. Customers therefore need to find out if their systems support these if they want to establish an ISDN connection to SAP. Please contact your consulting partner or SAP directly for more information. Please note that connection fees for ISDN connections are dependent on time and distance. With long distances and/or long connection times you should consider using Frame Relay or a network provider as an alternative. Also note that ISDN connection is not possible everywhere. Please ask your local phone company or PTT. 2011 SAP AG. All rights reserved. 28

Thank You!

2011 SAP AG. All rights reserved No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9, iseries, pseries, xseries, zseries, eserver, z/vm, z/os, i5/os, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server, PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes, BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX, Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Sun Microsystems, Inc. JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company. Sybase and Adaptive Server, ianywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase, Inc. Sybase is an SAP company. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. The information in this document is proprietary to SAP. No part of this document may be reproduced, copied, or transmitted in any form or for any purpose without the express prior written permission of SAP AG. This document is a preliminary version and not subject to your license agreement or any other agreement with SAP. This document contains only intended strategies, developments, and functionalities of the SAP product and is not intended to be binding upon SAP to any particular course of business, product strategy, and/or development. Please note that this document is subject to change and may be changed by SAP at any time without notice. SAP assumes no responsibility for errors or omissions in this document. SAP does not warrant the accuracy or completeness of the information, text, graphics, links, or other items contained within this material. This document is provided without a warranty of any kind, either express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. SAP shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. This limitation shall not apply in cases of intent or gross negligence. The statutory liability for personal injury and defective products is not affected. SAP has no control over the information that you may access through the use of hot links contained in these materials and does not endorse your use of third-party Web pages nor provide any warranty whatsoever relating to third-party Web pages. 2011 SAP AG. All rights reserved. 30