SAP On-Premise to Cloud Connectivity
Many organizations run SAP ERP on servers inside their own data centers — firewalled from the internet. At the same time, they use SAP Integration Suite in the cloud. The question is: how does the cloud-based integration platform reach an SAP system that is locked inside a private corporate network?
Opening the corporate firewall to allow inbound internet traffic to SAP is not an option. The security risk is too high. Instead, SAP provides the SAP Cloud Connector — a software component installed inside the corporate network that creates a secure outbound-only tunnel to SAP BTP. The cloud reaches in through this tunnel, but nothing from the outside can push through it without going through the Cloud Connector's control.
The SAP Cloud Connector
The SAP Cloud Connector (SCC) is a lightweight Java application that runs on a server inside your corporate network. It establishes a persistent, encrypted, outbound-only connection to SAP BTP. Through this tunnel, CPI iFlows can reach on-premise systems as if they were in the cloud.
Key Properties of the Cloud Connector
- Outbound-only connection – The SCC initiates the connection from inside the network to BTP. No inbound ports need to be opened in the firewall.
- Encrypted tunnel – All traffic uses TLS. Nobody can read data in transit.
- Access control – SCC enforces a whitelist of allowed systems and resources. Even if someone compromises the BTP side, they can only reach exactly what the administrator allowed.
- High availability – Run two SCC instances in master/shadow mode. If one fails, the other takes over automatically.
How the Cloud Connector Works
CORPORATE NETWORK (Firewall protected) SAP BTP CLOUD
────────────────────────────────────── ─────────────
[SAP ERP] [CPI iFlow]
↑ │
│ On-premise systems │ Calls virtual host
│ │
[Cloud Connector] ←──────────────────────────────→ │
│ Outbound-only secure tunnel │
│ (No firewall inbound port needed) │
│ │
[Firewall] ← only outbound port 443 needed
Virtual Hosts: How CPI Addresses On-Premise Systems
CPI cannot use the real internal hostname of your SAP system (like "erp-prod.internal"). That hostname is not resolvable from the cloud. Instead, the Cloud Connector maps internal hosts to virtual hosts — fictional names that only exist inside the SCC configuration.
INSIDE SCC MAPPING: Virtual Host: erp-prod-virtual:443 Maps to Real: erp-prod.internal:443 In CPI iFlow: Receiver URL: https://erp-prod-virtual:443/sap/opu/odata/... CPI sends request to virtual host → SCC intercepts → forwards to real host
This mapping also provides an additional security benefit: even if someone discovers the virtual hostname, they learn nothing about the actual internal network topology. The real hostname never leaves the corporate network.
Access Control List (ACL)
The SCC administrator defines an Access Control List — a list of exactly which internal systems and URL paths the cloud is allowed to access. Everything not on the list is blocked.
ACL example: ┌──────────────────────────┬────────────────────────────────┐ │ Virtual Host │ Allowed Path │ ├──────────────────────────┼────────────────────────────────┤ │ erp-prod-virtual:443 │ /sap/opu/odata/* │ │ erp-prod-virtual:443 │ /sap/bc/soap/* │ │ hana-db-virtual:30015 │ (HANA SQL connection) │ └──────────────────────────┴────────────────────────────────┘ /sap/bc/rest/ is NOT on the list → blocked, even if CPI tries to call it
Protocol Support
The Cloud Connector supports multiple protocols for different integration scenarios:
- HTTPS – For OData, REST, and SOAP web services
- RFC – For ABAP Remote Function Calls and BAPIs
- IDOC – For SAP IDoc exchange
- HANA – For direct HANA database connections
- LDAP – For Active Directory / LDAP integration
Cloud Connector Installation
Installing the Cloud Connector requires a server (Windows or Linux) inside the corporate network with outbound internet access on port 443. The installation process:
- Download the Cloud Connector installer from SAP
- Install on a server in the corporate network
- Open the SCC administration UI (runs on the local server on port 8443)
- Connect to your SAP BTP subaccount using BTP credentials
- Configure the on-premise systems (add virtual host mappings)
- Configure the ACL (add allowed paths)
- Test connectivity from BTP to verify the tunnel works
High Availability Setup
A single SCC instance is a single point of failure. If it goes down, all connections from CPI to on-premise systems break. For production environments, always run a second SCC instance in Shadow mode:
NORMAL OPERATION:
[BTP/CPI] ←──tunnel──→ [Master SCC] → [SAP On-Premise]
MASTER FAILS:
[BTP/CPI] ←──tunnel──→ [Shadow SCC] → [SAP On-Premise]
(auto-promoted to master)
Shadow SCC maintains a synchronized copy of the master's configuration. Failover happens automatically in seconds without administrator action.
Monitoring the Cloud Connector
The SCC administration interface shows the tunnel status, connection statistics, and audit logs. In SAP BTP, you can also view Cloud Connector status from the BTP cockpit — whether the SCC is connected and how many connections are active.
Monitor SCC availability as part of your integration operations. A disconnected Cloud Connector causes all dependent integrations to fail silently from the cloud side. Include SCC connectivity in your alerting setup so your operations team knows immediately if the tunnel drops.