Route Permission Table

The route permission table contains the host names and port numbers of the predecessor and successor points on the route (from the SAProuter’s point of view), as well as the passwords required to set up the connection (corresponds to a substring).

It is used to specify which connections are allowed and which prohibited by SAProuter. It also specifies whether SNC connections are set up and which these are.

For more information, see: Route Strings

Structure

Standard Entries

Standard entries in a route permission table appear as follows:

P/S/D <source-host> <dest-host> <dest-serv> <password>

Here <source-host> and <dest-host> could be the SAProuter.

Elements of a table entry are described below:

Handling Connection: P/S/D

The beginning of the line can be as follows:

P(ermit) causes SAProuter to set up the connection. P(ermit) entries can contain a password. SAProuter checks whether this password corresponds to that sent by the client.
Directly after the P, you can also specify the maximum number of SAProuters permitted before and after this SAProuter on the route for the connection to be allowed: Pv,n –here v denotes the maximum number of preceding SAProuters on the route, n the maximum number of following ones.
S(ecure) only allows connections with the SAP Protocol; connections with other protocols (such as TCP) are not allowed.

With Sv,n you can determime the number of preceding and succeeding SAProuters on the route, the same as you can with P.
D(eny) prevents the connection from being set up.
You can also add comment lines, which must begin with #.

Source Host <source host>

This element describes the host from where the connection comes (from viewpoint of the SAProuter). This can be a host name, an IP address, or an IP subnetwork.

For more information, see: Creating a Route Permission Table

Destination Host <dest host>

This element describes the host the connection is going to (from viewpoint of the SAProuter). This can be a host name, an IP address, or an IP subnetwork.

Destination Port <dest serv>

This element describes the port (service) of the destination host where the connection is going to. Here you can also specify port ranges by separating the two ports that enclose the port range with a point. If <dest-serv> has value 3200.3298, this means connections to the target server on all ports between 3200 and 3298.

Note Note

If a <source-host> client wants to set up a connection to <dest-host> <dest-serv> using SAProuter, SAProuter checks its route permission before the connection is set up. If the password and route SAProuter has received correspond to the entries in the route permission table, SAProuter sets up the connection. In this is not the case, SAProuter does not set up the connection, and issues the message, Route permission denied.

End of the note.

For more information, see:

Example of a Route Permission Table

Identifying and Correcting Errors

SNC Entries

SNC entries always start with the letter K (like key).

There are two types of SNC entries:

KT entries (key target)
This defines which connections should be SNC connections. This can be defined for both incoming and outgoing connections (from the point of view of this SAProuter).
1. Incoming connections
  The syntax is KT <SNCname src-host> <src-host> <src-serv>.
  
  This means that connections coming from the host <src-host> <src-serv> with the SNC name <SNCname src-host> should be SNC connections.
  
  The user can thus define that service connections from SAP must be SNC connections.
2. Outgoing connections
  They have the syntax KT <SNCname dest-host> <dest-host> <dest-serv>. This means that connections from the SAProuter to <dest-host> <dest-serv> with the SNC name <SNCname> should be SNC connections.
KD, KP, and KS entries

They have the following syntax:

K<D/P/S> <SNCname source-host> <dest-host> <dest-serv> <password>. This means that the (encrypted) SNC connection from <SNCname source-host> via SAProuter to <dest-host> <dest-serv> is set up when the route string contains the correct <password>.

Caution
So that SNC connections are possible, the appropriate SAProuters need to have been started with the option -K and the route permission table must contain the appropriate KT entry.

End of the caution.

For more information, see: Example of a Route Permission Table with SNC

Evaluation of the Route Permission Table

The following rules apply when the SAProuter evaluates the route permission table.

First Match

The first entry in the route permission table for which source address, target address, and target port match is decisive. In other words, in the Example of a Route Permission Table, this means that the connection from host1 to host2, service serviceX, is not allowed (because of the first entry) although all connections with service serviceX are allowed according to the third entry.

No match

If there is not an appropriate entry in the table for a route, the connection is rejected. It behaves as though the last line were a

D * * *.

Wildcards Exception

If the SAProuter is the last SAProuter on the route (for example, the front end), and the service is not an SAP service (not an SAP protocol), a wildcard (“*”) cannot be used with the service. The connection is only allowed if the non-SAP service is explicitly selected. If the example given above contained a * instead of telnet, and the SAProuter was the last one on the route, the telnet connection would not be set up.

Note Note

Security Note

For security reasons SAP recommends, that you do not use wildcards ( *) for the target host ( <dest-host>) and the target port ( <dest-serv>) in P and S lines in the route permission table. If the table contains these lines, the SAProuter issues a warning message:

WARNING: wildcard character used in route target

End of the note.

More Information

Creating a Route Permission Table

SAProuter Route Permission in the implementation part.