One of the most critical factors you must take into account when deciding how to install the Internet Transaction Server (ITS) is security.

Linking the R/3 System to the Internet via the ITS raises obvious security issues, because it exposes data to unauthorized or illegal access. For this reason, it is advisable to separate sensitive data in R/3 from the Web server and restrict available functions to a bare minimum.

• WGate is small and functionally simple. Its sole function is to pass requests back and forth between the Web server and the AGate, so there are few possible targets of attack

• AGate, however, handles most of the processing required to run a transaction over the Internet and is connected directly to R/3, so security is critical

You can install WGate and AGate:

• On the same machine in a single host installation
• On separate machines in a dual host installation

It is best to install the components on separate machines, especially when setting up production systems. This allows you to place a firewall between them and increase the level of protection.

A single host installation places the Web server, WGate and AGate on the same host machine:

The single host installation is appropriate for development and test systems where security is less critical and may also be sufficient for some intranet applications. In this case, you can just place a firewall between the Web server and the Internet.

A dual host installation places WGate and AGate on separate host machines - WGate on the Web server host and AGate on a different host:

The dual host installation is appropriate for production systems where security is vital. In this case, a firewall between WGate and AGate is indispensable.

To maximize security, you could install a firewall between the Web browser and the Web server, a firewall between WGate and AGate, and a firewall between AGate and R/3: