Skip to Content

You may use the SAP Cloud Connector to securely connect to On-Premise systems. SAP Cloud Platform Integration supports this configuration via the connection proxy type ‘On-Premise’ currently in the following receiver adapters:

  • AS2 (enterprise license only)
  • OData
  • HTTP
  • IDOC
  • LDAP
  • SOAP | SOAP 1.x

This includes support for connections to multiple SAP Cloud Connectors. For this use case you specify in your SAP Cloud Connector configuration a Location ID which you refer to in your receiver adapter configuration. Please check our documentation for details.

With the July 2017 release of SAP Cloud Integration we release an RFC receiver adapter which refers to a SAP Cloud Platform destination and mandates SAP Cloud Connector usage, too. Details will be discussed in a dedicated blog and are documented in our product documentation.

What I want to emphasize here is the SAP Cloud Connector support added for the mail receiver adapter in our July 2017 release. This configuration utilizes the SOCKS5 proxy supported in SAP Cloud Connector version 2.10 and higher.

You may use it in your mail receiver adapters to connect via TCP to your On-Premise mail server. This scenario required so far dedicated ports to be opened in your fire-wall which was often not supported by your security policy. Opening of ports is now obsolete.

I assume you have already installed the SAP Cloud Connector and connected it to your SAP Cloud Platform account in which your subscription to SAP Cloud Platform Integration resides. If not download a SAP Cloud Connector from our tools page and follow it’s installation documentation.

All you need to do now is to

  1. configure a new Cloud to On-Premise system mapping in your Cloud Connector and
  2. configure your mail receiver adapter accordingly

Let’s go step by step. Logon to your Cloud Connector and add a Cloud to On-Premise system mapping. Maintain the parameter in the wizzard as follows.

Set the backend system type to ‘non SAP System’.

Select the ‘TCP’ protocol. The configuration options for TCP are not as specific as for e.g. HTTP, i.e. the SAP Cloud Connector may not restrict potential misuse from your SAP Cloud Platform account. This is referred as security risk.

Maintain your On-Premise mail server & port you want to connect to.

Define the virtual mail server & port you want to expose to your SAP Cloud Platform Account (it will be re-used later in the mail receiver adapter configuration).

Maintain an optional description, tick the ‘Check Internal Host’ checkbox (to have enable the ping test from SAP Cloud Connector to your On-Premise mail server) and finish.

You may check and maintain you system mapping in the Cloud To On-Premise overview.

Logon to your Cloud Platform account and check the corresponding Cloud Connector status.

If all is fine you may consume your just established TCP connection in the mail receiver adapter. Log on to the Cloud Integration WebUI and maintain the connection parameter in the mail receiver adapter properties as follows.

Maintain the virtual mail server name & port for the proxy type ‘On-Premise’. Maintain the protection & authentication configuration as required by your On-Premise mail server.

Done. Start sending mails from SAP Cloud Platform Integration via your own OnPremise mail server.


To report this post you need to login first.


You must be Logged on to comment or reply to a post.

  1. Former Member

    Hi Andreas, thank you very much for your stuff!!!

    I need to make a non-sap connection on my cloud connector and I would like to ask a question with you. My scenario is very simple: I need to extract data from my oracle database and send it to my hana database within my ecc.

    I understand that on the side of my Cloud Connector I want to create a TCP connection


    But I had some doubts regarding the implementation of this configuration, can you help me?

    *** Cloud Connector ***
    1) In the onpremise to cloud connection, will only my hana database (cloud) be mapped?
    2) In the cloud to onpremise connection, does sap recommend using TCP or using TCP SSL? Why?
    3) In the cloud to onpremise connection, on the hostname should I put the path of my oracle database?

    *** SAP Cloud Platform ***
    1) I need a destination in hcp, right? But how would that be? I saw there that the creation options are: HTTP, LDAP, MAIL and RFC only.

    Sorry for that lot of questions Andreas, you have very little documentation on this and I wanted to understand in detail how to proceed …

    Anyway, thank you very much for your support.
    Cardinal, T.

  2. Suresh Sakthivel

    Hi Andreas Quenstedt ,

    Thank you for great information !!!

    Would SAP recommends SAP HCI (mail Adapter)–> HCC (via TCP) –> On Premise mail Exchange server.

    We have to address the Security risk for the above mentioned approach. Whats the SAP Approach -Mail Exchange (Cloud to On-premise Exchange Server) which is security compliant.

    Select the ‘TCP’ protocol. The configuration options for TCP are not as specific as for e.g. HTTP, i.e. the SAP Cloud Connector may not restrict potential misuse from your SAP Cloud Platform account. This is referred as security risk.

    Best Regards,
    Suresh S

    1. Andreas Quenstedt
      Post author


      Hi Suresh,

      the risk is limited to potential misuse from your own SAP Cloud Platform account. If this is not acceptable in your context you should not use the described option.

      I describe an alternative here.

      Thanks & regards,


  3. Suresh Sakthivel

    Dear Andreas,

    Considering above mentioned approach, Could you kindly clarify following queries ?


    1. From HCI level can we maintain SMTPS or STARTTLS for Transport level security?


    1. Do we need to maintain mail server User credentials in HCI Key store (since dummy user has been used in HCI for ECC web service connectivity) ?


    1. How Transport level security been established/achieved between HCI and HCC ? Protocol adopted.


    1. What are the security risks foresee via this approach?

    Best Regards,
    Suresh S


Leave a Reply