SAP · with VMware Migrations, a certified SAP partner

See every connection
your SAP landscape makes.

Enterprise SAP environments exchange sensitive business data between hundreds of components. Traditional firewall monitoring can't see inside that traffic. We move your SAP landscape off VMware — and give you continuous network visibility across every system, on-premise and in the cloud.

Talk to the SAP team VMware migration advisor
SAP landscape · traffic monitored between all components Continuous traffic analysis
Access & EdgeApplicationData & Ops Fiori Frontend Server SAP Web Dispatcher SAProuter SAP Cloud Connector SAP S/4HANA NetWeaver AS ABAP NetWeaver AS Java SAP Gateway SAP HANA Database SAP Content Server SAP Solution Manager SAP BusinessObjects

Every link above is a traffic path a network-detection sensor can watch — RFC, DIAG, SQL, replication and HTTP — for the security and health signals below.

// Why SAP network visibility matters

Hundreds of components. Sensitive data between every pair.

Continuous network traffic analysis of the SAP landscape surfaces what firewalls and application logs miss:

Unencrypted SAP communication

Cleartext RFC, DIAG or HTTP between components that should be TLS-protected.

Unexpected RFC connections

New or unauthorised RFC destinations appearing between systems.

Unauthorised external access

Connections into SAP services from outside the trusted landscape.

East-West movement

Lateral traffic inside the SAP landscape that bypasses the perimeter.

Data exfiltration attempts

Large or unusual outbound transfers from application or HANA servers.

Cloud connectivity issues

Broken or misrouted links across VPN, ExpressRoute or Cloud Connector.

Misconfigured load balancers

Health-check gaps, asymmetric routing and single points of failure.

Network bottlenecks

Latency and saturation that quietly degrade SAP performance.

// SAP on-premise architecture

The components — and what runs between them.

Access & Edge
  • Fiori Frontend Server
  • SAP Web Dispatcher
  • SAProuter
  • SAP Cloud Connector
Application
  • SAP S/4HANA
  • NetWeaver AS ABAP
  • NetWeaver AS Java
  • SAP Gateway
Data & Ops
  • SAP HANA Database
  • SAP Content Server
  • SAP Solution Manager
  • SAP BusinessObjects

// SAP on AWS, Azure & GCP

The landscape spreads. The visibility gap grows.

◇Monitor across the cloud fabric

Virtual Networks (VPC / VNet)Network Security GroupsLoad BalancersPrivate LinkVPNExpressRouteDirect ConnectCloud NATBastion HostsSAP HANA cluster communicationPacemaker cluster trafficBackup trafficStorage replicationSAP Cloud Connector

△Additional cloud risks

Public IP exposureIncorrect NSG rulesMissing subnet isolationExcessive East-West trafficInternet routing mistakesCross-region replication

// Critical SAP ports

Know the ports to watch.

ServiceTypical ports
SAP Dispatcher32NN
Gateway33NN
Message Server36NN / 39NN
ICM HTTP80NN
ICM HTTPS443NN
SAP GUI32NN
SAP HANA SQL3NN15
HANA System Replication3NN40+
SAP Router3299
RFC33NN
Web Dispatcher443 / custom
FioriHTTPS
Cloud ConnectorHTTPS 443

NN represents the SAP instance number.

// Security events worth highlighting

Signals a sensor can raise proactively.

high
New RFC destination starts communicating
Possible unauthorised integration or compromised system
high
Unexpected SAP GUI login source
Stolen credentials or VPN misuse
crit
HANA SQL port accessed from non-SAP subnet
Potential lateral movement or reconnaissance
high
SAProuter receives connections from unknown IPs
Unauthorised remote access attempts
crit
Large outbound transfer from SAP application or HANA server
Possible data exfiltration
high
Loss of HANA System Replication traffic
High-availability risk
med
Sudden increase in Fiori or OData requests
API abuse or denial-of-service activity
high
SAP Cloud Connector establishes unexpected outbound connections
Misconfiguration or compromised connector
med
TLS downgraded or unencrypted SAP traffic detected
Increased risk of interception
med
Communication across environment boundaries (DEV ↔ PRD)
Violation of landscape segregation policies

// The partnership

VMware & SAP, under one roof.

Palantir Group brings the network-detection engineering. VMware Migrations — our Poland-based partner and a certified SAP partner — brings deep SAP landscape expertise. Together we move you off VMware and stand up continuous visibility across the whole estate.

  • VMware → KVM / Hyper-V / Proxmox / Nutanix migration of SAP workloads
  • SAP-aware network traffic analysis: RFC, HANA SQL, replication, Fiori/OData
  • On-premise and hyperscaler (AWS / Azure / GCP) coverage
  • Landscape segregation, TLS posture and exfiltration monitoring
Start an SAP conversation