Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 5 of 5

Troubleshooting connectivity

10 min

Listen to this lesson

0:00 / 8:27

Connectivity failures waste more test days than almost anything else in a BTP project, mostly because people guess. The fix is to walk the path in order, from the app outward, and to collect evidence at each layer before changing anything. Priya's team uses the same five-layer walk for every "cannot connect" defect.

  1. 1. AppRead the app log: which destination, which URL path, which HTTP status or error text, which user
  2. 2. DestinationRight subaccount and name? Proxy type, URL, location ID, authentication; run Check Connection
  3. 3. Cloud ConnectorSubaccount connected and certificate valid? Mapping and resource exist? Check most recent requests and logs
  4. 4. Back end reachabilityInternal host reachable from the Cloud Connector (availability check); ICM and service active
  5. 5. Back-end authentication and authorizationUser or certificate mapping valid; the SAP user has the API authorizations
The five-layer walk for connectivity defects.
The Sign-Off Table · thesignofftable.com/academy/sap-btp-203

Reading the symptoms

SymptomLikely layerFirst things to check
503, no Cloud Connector connected for the subaccountCloud ConnectorIs it connected to this subaccount? Does the location ID in the destination match? Has the subaccount certificate expired?
Check Connection: back end not in the list of system mappingsCloud ConnectorVirtual host and port in the destination match an access control entry exactly
Check Connection: resource not accessibleCloud ConnectorExposed path and sub-path setting; case of the path
Check Connection: back end not reachable from Cloud ConnectorBack end reachabilityInternal host and port, network route, back end up
401 Unauthorized from the back endBack-end authenticationPassword or certificate; user locked or expired; for propagation, certificate mapping rules
403 Forbidden from the back endBack-end authorizationMissing authorization of the SAP user for the API; use an authorization trace
Worked yesterday, propagation fails today after an IdP changeCloud Connector trustSynchronize trusted identity providers in the Cloud Connector

Common symptoms and where to look first. Exact messages vary by version.

Read the symptom before touching anything: 503 and mapping messages point to the Cloud Connector, while 401 and 403 come from the back end.
The Sign-Off Table · thesignofftable.com/academy/sap-btp-203

Tools at each layer

In the Cloud Connector, the monitor for cloud-to-on-premises traffic shows the most recent requests (up to 50) per virtual host, with durations split into back end, connection and Cloud Connector time, and, in recent versions, the HTTP status code. The Log and Trace Files page lets administrators raise trace levels temporarily and download logs; it also links to SAP's Guided Answers and the Support Log Assistant, which analyzes uploaded logs. In SAP S/4HANA, Basis uses the ICM monitor (SMICM), the system log and an authorization trace to see what the back end received and why it refused.

Each layer of the path has its own evidence source, from the Cloud Connector monitor to SMICM and an authorization trace in SAP S/4HANA.
The Sign-Off Table · thesignofftable.com/academy/sap-btp-203
Destination misconfiguredWrong name, subaccount, proxy type or URL; Check Connection fails early
Tunnel or mapping gapNo Cloud Connector, location ID mismatch, unmapped virtual host or unexposed path
Credentials or trustWrong secret, expired token setup, untrusted identity provider on the app side
Back-end identity401 from locked user or certificate mapping; 403 from missing SAP authorizations
Four families of connectivity failure. Identify the family before changing configuration.
The Sign-Off Table · thesignofftable.com/academy/sap-btp-203

Prevent the repeat

Most connectivity defects recur because the fix is undocumented. After each one, Contoso records the symptom, the layer, the evidence and the fix in the defect, and adds a check to the release checklist if a configuration step was missed. Two checks earned their place quickly: compare destination exports between stages before each test cycle, and track the Cloud Connector subaccount certificate expiry date as an operations alert.

What would you do?

After a weekend change to the corporate identity provider configuration, fleet supervisors get errors on every action that uses principal propagation, while read-only screens using the technical user still work. Where should Sam look first?

Key points
  • Walk the path in order: app, destination, Cloud Connector, back-end reachability, back-end identity.
  • Read the symptom: 503 and mapping messages point to the Cloud Connector; 401 and 403 point to the back end.
  • Use the Cloud Connector monitor, logs, Guided Answers and Support Log Assistant; SMICM and authorization traces in SAP S/4HANA.
  • Traffic traces can contain sensitive data: short, controlled, and switched off afterwards.
  • Record each fix and add missed steps to the release checklist, such as destination comparison and certificate expiry alerts.

Check your understanding · not graded

Lesson check

  1. 1. Which layer does a 503 saying no Cloud Connector is connected point to?

  2. 2. A call reaches SAP S/4HANA and returns 403. Where should the analysis focus?

  3. 3. Why should tunnel traffic traces be activated only briefly and with care?

  4. 4. Which Cloud Connector view shows the latest requests per virtual host with timing?