Skip to main content

VPN Connection

If BTP is not used, a secure VPN tunnel between the Angles for SAP environment and the network that hosts your SAP environment is required for using Angles for SAP. In the figure below, you can see a high-level overview of a connection set-up from a customer network to an Angles for SAP cloud environment. Note that the subnets of the SAP systems and the end-users are separate. This requires configuring separate VPN tunnels.

Cloud_Network_Overview

Network Architecture

  • Secure by default
  • A VPN is setup between the VPC in the Amazon Cloud (AWS) and the customers' network
  • Extraction is executed by RFC calls (SNC), or RFC over web socket calls (HTTPS). Both scenarios are encrypted
  • Only RFC communication from VPC to the SAP system needs to be permitted on this connection
  • VPN + SNC or HTTPS + SSL ensures encrypted communication

1.png

VPN Setup Process

Information Required
Your Angles for SAP consultant will provide you with a VPN questionnaire that needs to be filled in to start setting up the VPN tunnels. This document requests the following information about your router:
  • Make
  • Model
  • Public IP of the VPN router
  • Subnet(s) of SAP system networks
    • Required to initiate extraction from SAP and deliver the data back to the cloud environment
    • Required to ensure that proper bandwidth is available for optimal data transfer performance
  • Subnet(s) of end-user networks
    • Required to support a connection from end-users to Angles for SAP
    • Required to ensure that all end-user networks can access Angles for SAP
  • IP ranges in your network (to make sure that no conflicts occur with the Angles for SAP setup)

    Configuration Steps

    Once that information has been received, the Angles for SAP consultant will set up the VPN tunnels on the cloud side. The consultant will then send you the VPN configuration that you can execute to set up and enable the VPN tunnels. This requires an IT or support employee on your side.
    Setting up the VPN tunnels can take some time as both sides need their side to be configured correctly for the tunnels to be secure. Some time needs to be set aside at the beginning of the project to set this up, as it might involve several meetings and testing sessions. Once the VPN tunnels have been established, the Angles for SAP system can safely and securely attempt to connect to the SAP system to retrieve the data.

SAP

Technical Requirements

  • SAP Certified Function Module is loaded into the SAP system using transport or AddOn (SAINT transaction)
  • SAP user is created, and the required permissions are assigned to this user
  • With SAP authorizations for this user, the scope of extractable tables/fields and filters can be defined
  • Scope of the Angles for SAP Data model is maintained in the A4S Workbench by the customer
  • This scope determines what SAP tables are required to populate the data model

Data Extraction Process

  • Process is repeated for each table
  • Batch job is created and started to select data from SAP
  • Shared memory (SHMM) is used as a buffer to transfer blocks from batch job to RFC

VPN to The Customer Network

If the SAP systems are not in the customer company network but located in a different datacenter, a second VPN tunnel must be set up between the Angles for SAP Cloud environment and the customer company network. This second VPN tunnel will be used so that end users can safely and securely connect to the Angles for SAP web application, log in, and create/view their reports. The steps for setting up the SAP VPN tunnel must be executed for this VPN tunnel as well.

Security And Encryption

  • Encryption in transit: All communications use TLS encryption, with or without VPN, ensuring secure data channels
  • Data at rest encryption: Encryption protocols are implemented for stored data (specific implementation details require further clarification)
  • Secure authentication: Multiple layers of security ensure authorized access only

BTP Vs VPN Connections For R2

BTP Advantages

  • No VPN Required: BTP connections use the public internet with TLS encryption, eliminating VPN complexity
  • Direct Access: End-users access Angles For SAP via the open internet without additional network configuration
  • Simplified Setup: No VPN needed for function module installation, configuration, or initial data verification
  • Reduced IT Overhead: You can use jump boxes or screen sharing instead of complex VPN setups

When VPN Is Still Required

  • When using SimpleRFC for data extraction
  • For users require additional network isolation beyond standard TLS encryption
  • For specific compliance or security policy requirements

Was this article helpful?

We're sorry to hear that.