Updated August 17, 2026

Configure SAP Router for Velo access

What you'll achieve

By the end of this guide, Velo's cloud execution cluster will be able to reach your internal SAP ECC system through your already-deployed SAP Router, using a scoped route-permission entry and a firewall rule that exposes only the minimum surface area required.

This is the recommended connectivity approach when your SAP system sits on a private network or behind a corporate firewall, and you want to avoid deploying a separate tunnel agent or opening a VPN.

SAP Router must already be deployed. This guide assumes you have a running saprouter instance reachable from the public internet. If you haven't set up SAP Router yet, refer to the official SAP documentation first:

• SAP Router — Overview & Downloads (SAP Support Portal)
• SAProuter Configuration and Administration (SAP Help Portal)

Prerequisites

• SAP Router running — a saprouter process is listening on port 3299 (or a custom port) with a public IP or hostname.
• Access to saprouttab — you can edit the route permission table on the SAP Router host and restart the process.
• Firewall admin access — you can modify inbound rules on the host or network firewall in front of the SAP Router.
• SAP system details — you know the private hostname or IP of your SAP ECC application server and its system number (e.g., 00, 01).
• Velo IP address — Velo execution cluster egress IP ranges to configure the system connection.

Network overview

Velo execution cluster                SAP Router (public)              SAP ECC app server
   (fixed egress IP)                    saprouter :3299                   (private network)
        │                                      │                                 │
        │  TCP 3299 — SAP NI routing string    │   internal network only        │
        └────────────────────────────────────► │ ───────────────────────────────►
                                                │   dispatcher :3200 (32<sysno>) │
                                                │   message srv :3600 (36<sysno>)│

Velo connects once, over the public internet, to your SAP Router on port 3299. SAP Router then forwards the session internally to your SAP ECC application server — no inbound access to the SAP system itself is required.

Steps

1. Get Velo's egress IP

Velo's execution cluster connects to your SAP Router from a fixed set of outbound IPs. You must whitelist these in both your saprouttab and your network firewall.

Ask your Velo administrator for the current execution-cluster egress IP (or CIDR), then use that value in saprouttab and the firewall rule below. Do not hardcode an IP from an older copy of this guide.

2. Add Velo route entries to saprouttab

Open the route permission table on your SAP Router host. The file is typically located at the path passed to the -R flag when SAP Router was started, commonly located at:

• Linux → /usr/sap/saprouter/saprouttab
• Windows → C:\saprouter\saprouttab

Add one permit entry per Velo egress IP, pointing to your SAP ECC application server and dispatcher port (32 + system number). The dispatcher line is required for the connection string in step 5.

# saprouttab — Velo access entries
# Format: P <source_host> <dest_host> <dest_port> [<password>]
# Replace values in <> with your environment specifics

# Velo execution cluster — egress IPs (add one line per IP/range)
P   <VELO_EGRESS_IP_1>   <sap-ecc-hostname-or-private-ip>   3200

# If the Robot connection string uses /W/<password>, the same password
# must appear as the fourth field (and the reverse: a password here
# requires /W/<password> on the connection string).
P   <VELO_EGRESS_IP_1>   <sap-ecc-hostname-or-private-ip>   3200   <route-password>

# Message server port — only if you use SAP logon groups (not required
# for a dispatcher hop such as /S/3200). Port = 3600 + system number.
P   <VELO_EGRESS_IP_1>   <sap-ecc-hostname-or-private-ip>   3600

# Deny everything else — this line must remain at the end
D   *   *   *

Route password. /W/<password> in the connection string and the optional fourth saprouttab field must match. A permit line without a password will deny a password-protected hop, and a hop without /W/ will fail if saprouttab requires one.

Keep the deny-all rule at the bottom. SAP Router evaluates saprouttab top-to-bottom and stops at the first match. A D * * * at the end is your safety net — removing it would allow any source to route to any destination via your SAP Router.

For reference on all supported saprouttab syntax (permit, deny, password-protected, SNC entries), see the SAP Route Permission Table documentation.

3. Open the SAP Router port in your firewall

Your SAP Router host needs to accept inbound TCP on port 3299 (or your custom port). Add rules in your network or host-based firewall; the table below shows the required inbound entries:

No inbound rules are needed on the SAP ECC application server itself; it only communicates with SAP Router over the internal network, which is already permitted.

Custom port? If your SAP Router runs on a port other than 3299 (e.g., 3298), use that port in the firewall rule and in the Velo connection string in step 5.

4. Restart SAP Router to apply the new routes

SAP Router reads saprouttab at startup. You must stop and restart the process for your new entries to take effect.

Linux

# If managed by systemd
sudo systemctl restart saprouter

# If started manually as the saprouter OS user
su - saprouter
/usr/sap/saprouter/saprouter -s          # send stop signal
/usr/sap/saprouter/saprouter -r 
  -R /usr/sap/saprouter/saprouttab 
  -G /usr/sap/saprouter/dev_rout &

Windows

REM Run as Administrator in Command Prompt
saprouter.exe -s
saprouter.exe -r -R C:saproutersaprouttab -G C:saprouterdev_rout

5. Add the SAP system connection string in your Robot test cases

The connection is done using a connection string in the following format:

/S/ is optional on each hop and defaults to 3299 (the SAP Router listener). The target dispatcher port (32 + system number, e.g. 3200) must still be set.

The router string tells Velo's SAP GUI runtime to hop through SAP Router before reaching the application server. The format follows the standard SAP NI routing string convention. See SAP Help: Route strings for full syntax details.

Connect waits 60 seconds by default for a router hop — long enough for a typical cross-internet DIAG handshake.

The following is an example test case with system number 00 and a SAP Router on a public Elastic IP 18.185.44.20:

*** Settings ***
Library    VeloSapguiLibrary    port=8081

*** Variables ***
${SAP_SERVER}     /H/18.185.44.20/S/3299/H/10.0.1.55/S/3200
# With a saprouttab route password:
# ${SAP_SERVER}    /H/18.185.44.20/S/3299/W/<password>/H/10.0.1.55/S/3200
${SID}            S4H

*** Test Cases ***
Create Sales Order
    ECC Login
    Create Sales Order
    Logout

*** Keywords ***
ECC Login
    Connect               ${SAP_SERVER}    SystemId=${SID}
    Type                  User        ${USER}
    Type                  Password    ${PASSWORD}
    Press Enter

Acknowledge Warning about License
    Press Enter

Create Sales Order
    Open Transaction      VA01
    Type                  Sales Document Type         or
    Type                  Distribution Channel        10
    Type                  Division                    00
    Press Enter

    Type                  Sold-to Party               17100003
    Type                  Ship-to Party               17100003
    Type                  Customer Reference          PO29922
    Type                  Incoterms Version           2010
    Type                  Incoterms (Part 1)          FAS
    Type                  Incoterms Location 1        100
    Type Cell             Material            0       NS0002
    Type Cell             Order Quantity      0       1
    Press Key             Ctrl+S
    Click                 Continue
    Verify                Status Bar                  MessageType        Contains    S
    ${order_number}=      Get Status Bar              MessageParameter[1]
    Log                   New order number is: ${order_number}

Logout
    Open Transaction      /nex

6. Enable SNC encryption (optional)

If your SAP system requires SNC, append SNC parameters to the connection string. This path is SAP GUI for Java / Velo cloud only. The Windows COM OpenConnection backend does not honour &sncon=… parameters.

An optional conn= prefix is accepted and stripped before the string is passed to openConnectionByConnectionString. The NI route and the &-delimited parameters are forwarded as supplied (the route is not rewritten).

${SAP_SERVER}    conn=/H/<router-ip>/S/3299/W/<password>/H/<sap-ecc-ip>/S/3200&sncon=true&sncqop=9&manualLogin=true&systemName=ECD

The supported parameters are:

Encryption only, not SSO. Velo uses the SNC library bundled with SAP GUI for Java, which secures the channel but does not provide an SNC identity. Logon still happens with user and password, so keep manualLogin=true and continue using the Type User / Type Password keywords. If your system is configured with snc/accept_insecure_gui = 0 it will reject this kind of connection — it requires a full PKI setup (CommonCryptoLib plus a PSE and credentials), which Velo does not currently support.

Note that a route password (/W/<password>) and SNC are independent: the password authorises the hop through SAP Router, while SNC protects the DIAG session end to end.

Verify

After restarting SAP Router, confirm it's listening and reachable before running a test:

# On the SAP Router host — confirm the process is listening
# Linux
ss -tlnp | grep 3299

# Windows (PowerShell)
netstat -ano | findstr :3299

From a Velo-side debug session (or any host on the whitelisted egress IP), confirm the port is reachable:

telnet <saprouter-ip> 3299

If the connection opens (even if it immediately closes, since telnet doesn't speak the SAP NI protocol), your firewall and saprouttab entries are correctly in place. You can then trigger a Velo run against the connection string from step 5.

Troubleshooting

Frequently asked questions

P   <VELO_IP>   10.0.1.55   3200   # ECC DEV (sysno 00)
P   <VELO_IP>   10.0.1.56   3201   # ECC QA  (sysno 01)
D   *   *   *

Related

• SAP GUI for Java
• Tunnels — generic outbound channel when SAP Router is not an option
• Tunnel agent architecture