#ATR blog (4)
Informative Note: Created this blog to provide information on how to upgrade SAP Cloud Connector (SCC) and do High Availability Configuration (Windows)
Prerequisites - Knowledge on SCC Installation.
Cloud connector serves as a link between SAP BTP applications and on-premise systems. Eg: Business users will use SAP BTP BAS Application and fetch ABAP ODATA services to create new Fiori UI5 Apps.
General Knowledge Link: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector.
Pre-requisites for HA Configuration:
To avoid this scenario, we can update primary cloud connector to latest version before proceeding HA configuration.
Download Link for SAP JVM and Cloud Connector: https://tools.hana.ondemand.com/#cloud -> Cloud Connector
Current Scenario: Cloud Connector version: 2.13.2. Planned upgrade version: 2.15.2. Post which HA Configuration needs to be done.
2. Take backup of your cloud connector.
3) Check in browser whether shadow cloud connector VM(shadow) fetches right certificate for your Region (Europe Rot Neo, Frankfurt CF, etc.,.) If you are using proxy, make sure whether Cloud connector ports allowed in proxy. Cloud connector will redirect and fetch right certificate while adding/configuring subaccounts if ports are allowed in proxy.
You can find ports information in below link
https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/prerequisites.
If cloud connector fetches wrong certificate, ask security team to unblock SCC Region Ip and disable https inspection for all Ips - port 443.
4) Telnet and check whether cloud connector ports are reachable or not - In Shadow SCC VM(Windows) - command - telnet IP(port) 443. If it fails, we can't able to add subaccount/HA works but connectivity to subaccount will fail.
Also check whether master SCC port accessible from Shadow. If it fails, HA configuration won't work.
Command: telnet masterscchostname 8443
5) If you want to maintain secure SSL, renew shadow server VM(Windows) certificate with right domain name prior. We can apply certificate(in UI/System) post installation. Make sure to upload same certificate in On-Premises ABAP System - STRUST. This will avoid SSL communication issues post installation.
Below image captured post installation (UI & System Certificate)
6) We might face below error after configuring HA. If Master and Shadow state collapsed and lost, we can simply use reset (button) -> stop SCC then set Master/Shadow state via java.jar command accordingly. Once Master/Shadow role set, start SCC and recover using backup file.
" SWITCH ROLE FAILED IN FIRST ATTEMPT. ROLE EXCHANGE OK BUT CONNECTION CHECK NOT SUCCESSFUL”
java -jar configurator.jar -be master
FYI - https://me.sap.com/notes/0002899832 - Detailed Explanation
UPGRADE SCC FROM 2.13.2 to 2.15.2:
2. Stop Cloud Connector before upgrading - Windows Service - SAP Cloud Connector
3. Uninstall Cloud Connector. PFA - https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/upgrade.
Retain files so that it will fetch all connected subaccounts automatically. If you want to install upgraded version in any other preferred path, you can install fresh in your preferred path and use backup to recover your account. Make sure to take backup of scc config folder and files for safer side.
4. Once uninstalled, reinstall cloud connector with latest version (Current scenario - 2.15.2)
Choose SCC installation path. If you choose old path with retained files, SCC will fetch and connect all subaccounts as well as set whether SCC should act as Master/Shadow Role.
Prefer to use default port 8443
Choose SAP JVM path and start Cloud connector.
5. Before accessing SCC link, clear browser cache to avoid any unpredictable behavior due to the upgraded UI.
Check upgraded version details in ABOUT.
https://hostname:8443
HA CONFIGURATION:
Initial Configuration completed.
3. Replace default UI certificate with your renewed shadow hostname certificate.
Restart SCC to reflect newer certificate.
..................
Note:
1) UI certificate: Certificate matching corresponding CN name needed since UI certificate is server specific. If not updated, SCC link will be unsecure SSL state.
2) System certificate can be common certificate which used for connecting On-Premises systems. It can be Master/Shadow, but Master server certificate is recommended. You can use same UI certificate as System Certificate.
.................
4. Once shadow server installed and configuration completed, Enable high availability in Primary Master SCC.
5. Login into shadow SCC and use "Connect" option. Enter Master SCC password.
Check connectivity as well as mirrored subaccounts.
Connection to Master from Shadow successful.
6. Login into Master and check connectivity.
HA Configuration completed.
Switch Roles - Takeover:
On-Premise Connection Check:
Check ABAP System connection as well once takeover done. Make sure to upload both Master/Shadow System Certificate in ABAP STRUST.
Mail Config:
You can also set E-Mail Configuration for Alerts - Connectivity loss/timeout, Automatic Takeover,etc.,.
INFO:
If you are having old SAP SCC version and business SCC downtime not possible, you can download latest SCC for shadow and configure HA directly irrespective of their version mismatch. It might be incompatible but it won't impact much technically. You can switch roles once HA Configured and update old SCC version. This will avoid SCC downtime.
Thanks for visiting!
Informative Note: Created this blog to provide information on how to upgrade SAP Cloud Connector (SCC) and do High Availability Configuration (Windows)
Prerequisites - Knowledge on SCC Installation.
Cloud connector serves as a link between SAP BTP applications and on-premise systems. Eg: Business users will use SAP BTP BAS Application and fetch ABAP ODATA services to create new Fiori UI5 Apps.
General Knowledge Link: https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/cloud-connector.
Pre-requisites for HA Configuration:
- Upgrade Cloud connector to latest version. Although HA supports with different cloud connector version, there can be inconsistencies between primary and secondary SCC due to version mismatch. We won't have much impact technically.
To avoid this scenario, we can update primary cloud connector to latest version before proceeding HA configuration.
Download Link for SAP JVM and Cloud Connector: https://tools.hana.ondemand.com/#cloud -> Cloud Connector
Current Scenario: Cloud Connector version: 2.13.2. Planned upgrade version: 2.15.2. Post which HA Configuration needs to be done.
2. Take backup of your cloud connector.
3) Check in browser whether shadow cloud connector VM(shadow) fetches right certificate for your Region (Europe Rot Neo, Frankfurt CF, etc.,.) If you are using proxy, make sure whether Cloud connector ports allowed in proxy. Cloud connector will redirect and fetch right certificate while adding/configuring subaccounts if ports are allowed in proxy.
You can find ports information in below link
https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/prerequisites.
If cloud connector fetches wrong certificate, ask security team to unblock SCC Region Ip and disable https inspection for all Ips - port 443.
4) Telnet and check whether cloud connector ports are reachable or not - In Shadow SCC VM(Windows) - command - telnet IP(port) 443. If it fails, we can't able to add subaccount/HA works but connectivity to subaccount will fail.
Also check whether master SCC port accessible from Shadow. If it fails, HA configuration won't work.
Command: telnet masterscchostname 8443
5) If you want to maintain secure SSL, renew shadow server VM(Windows) certificate with right domain name prior. We can apply certificate(in UI/System) post installation. Make sure to upload same certificate in On-Premises ABAP System - STRUST. This will avoid SSL communication issues post installation.
Below image captured post installation (UI & System Certificate)
6) We might face below error after configuring HA. If Master and Shadow state collapsed and lost, we can simply use reset (button) -> stop SCC then set Master/Shadow state via java.jar command accordingly. Once Master/Shadow role set, start SCC and recover using backup file.
" SWITCH ROLE FAILED IN FIRST ATTEMPT. ROLE EXCHANGE OK BUT CONNECTION CHECK NOT SUCCESSFUL”
java -jar configurator.jar -be master
FYI - https://me.sap.com/notes/0002899832 - Detailed Explanation
UPGRADE SCC FROM 2.13.2 to 2.15.2:
- Make sure whether you have downloaded updated JVM and set JVM path in JAVA_HOME & PATH Environment variable. It will help SCC to detect SAP JVM files and use for connectivity purposes.
2. Stop Cloud Connector before upgrading - Windows Service - SAP Cloud Connector
3. Uninstall Cloud Connector. PFA - https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/upgrade.
Retain files so that it will fetch all connected subaccounts automatically. If you want to install upgraded version in any other preferred path, you can install fresh in your preferred path and use backup to recover your account. Make sure to take backup of scc config folder and files for safer side.
4. Once uninstalled, reinstall cloud connector with latest version (Current scenario - 2.15.2)
Choose SCC installation path. If you choose old path with retained files, SCC will fetch and connect all subaccounts as well as set whether SCC should act as Master/Shadow Role.
Prefer to use default port 8443
Choose SAP JVM path and start Cloud connector.
5. Before accessing SCC link, clear browser cache to avoid any unpredictable behavior due to the upgraded UI.
Check upgraded version details in ABOUT.
https://hostname:8443
HA CONFIGURATION:
- Install Shadow Server - Use same upgrade steps to install Shadow server. Start Shadow Cloud Connector.
- Initial Configuration: Administrator user and Password 'manage' and set "Shadow" role.
Initial Configuration completed.
3. Replace default UI certificate with your renewed shadow hostname certificate.
Restart SCC to reflect newer certificate.
..................
Note:
1) UI certificate: Certificate matching corresponding CN name needed since UI certificate is server specific. If not updated, SCC link will be unsecure SSL state.
2) System certificate can be common certificate which used for connecting On-Premises systems. It can be Master/Shadow, but Master server certificate is recommended. You can use same UI certificate as System Certificate.
.................
4. Once shadow server installed and configuration completed, Enable high availability in Primary Master SCC.
5. Login into shadow SCC and use "Connect" option. Enter Master SCC password.
Check connectivity as well as mirrored subaccounts.
Connection to Master from Shadow successful.
6. Login into Master and check connectivity.
HA Configuration completed.
Switch Roles - Takeover:
On-Premise Connection Check:
Check ABAP System connection as well once takeover done. Make sure to upload both Master/Shadow System Certificate in ABAP STRUST.
Mail Config:
You can also set E-Mail Configuration for Alerts - Connectivity loss/timeout, Automatic Takeover,etc.,.
INFO:
If you are having old SAP SCC version and business SCC downtime not possible, you can download latest SCC for shadow and configure HA directly irrespective of their version mismatch. It might be incompatible but it won't impact much technically. You can switch roles once HA Configured and update old SCC version. This will avoid SCC downtime.
Thanks for visiting!
- SAP Managed Tags:
