Solution Brief

Reliable Secure Remote
Access for SAP with Zscaler
Private Access (ZPA)© 2022 Zscaler, Inc. All rights reserved.

With 98% of the top 100 most valued brands relying on SAP—
85 of which are SAP S/4HANA customers with more businessmigrating workloads everyday—it’s crucial to provide reliable
and secure remote access to business-critical SAP applications.
Additionally, as hybrid work becomes the new norm and users
access SAP from anywhere, on any device, and from any location,
the virtual perimeter has expanded beyond the network all the way
to users, devices, and applications. Yet, organizations continue torely on legacy, network-centric technologies such as VPNs andfirewalls to control application access. These traditional approaches
are ineffective in the cloud and mobile-first world, creating
performance bottlenecks and increasing security risks.

Solution Brief© 2022 Zscaler, Inc. All rights reserved.

2

Instead, your business can leverage a zero trust

Benefits of Zscaler for SAP

approach that relies on identity and behavior• Deliver superior SAP user experience:

to verify users and machines in real-time, andBoost the productivity of your hybrid

restricts data and access on a least-privilege

workforce and proactively resolve user

basis. In fact, Gartner states that by 2025, at least

experience issues with ZDX’s continuous

70% of new remote access deployments will

monitoring and visibility.

be served predominantly by zero trust network
access (ZTNA).

Introducing Zscaler Private Access (ZPA)
Zscaler Private Access (ZPA) is the world’s most
deployed ZTNA platform with 150+ pointsof presence powered by 100% renewableenergy worldwide and peered with the world’s
largest cloud providers, providing secure, directconnectivity to private applications. Users
accessing SAP applications that run on-prem or• Extend zero trust across apps,
workloads, and IoT: Leverage a single
global policy engine to deliver fast,
direct access to private SAP apps,
workloads, and OT/IIoT devices.
• Reduce operational complexity andcosts: With no hardware or software
to manage, cloud-delivered zero trust
network access (ZTNA) deployments
eliminate infrastructure overhead.
• Mitigate the risk of a data breach:
Make SAP applications invisible tounauthorized users and enforce

in the public cloud are never put on the network,

least-privileged access, minimizing

making applications invisible to the internet andapplication attack surface of SAP

unauthorized users or attackers. IP addresses are

S/4HANA.

never exposed using inside-out connections, andapplications are segmented so that users can only
access a specific app, limiting lateral movement.
When remote access becomes effortless,connectivity and availability improves. For
customers such as Growmark, an agriculture
supply cooperative, ZPA enabled business
continuity and resiliency by allowing 98% of theirstaff to continue to effectively carry out theirwork from home. Eric Fisher, Director of IT atGrowmark, noted that with ZPA for SAP, “we’regetting a better security footprint, better visibility
and we’re more compliant”.

“With ZPA for SAP,
we’re getting a better
security footprint, better
visibility and we’re morecompliant. We canenable our users workfrom anywhere - a win
all around.”
Eric Fisher
Director of IT, Growmark© 2022 Zscaler, Inc. All rights reserved.

Solution Brief

3

How Zscaler Private Access Works

INSIDE SAP S/4HANAAC

SAP S/4HANALOADBALANCERSAP ERP
Data Center
ACACAWS/AzureAC

SAP APPSERVERSAP S/4HANAACAPPCONNECTORS(Each supports upto 500 mbps)

AWS/Azure
Network Configuration is detailed in theSAP Network Configuration Gudie.

Zero Trust
Exchange

Zscaler Client Connector
installed on user devices.

NicoleFigure 1: User reliably while securely accessing SAP applications in S/4HANA with ZPA

ZPA and SAP can be easily configured by understanding these common components, configuration steps,
and following SAP best practices.
ZPA/SAP Components• App Connectors provide an authenticated• Zscaler Client Connector is an application

secure interface between organizations

installed on your device to ensure that yourapplication servers and the ZPA cloud.

internet traffic and access to your organization’s• The Zscaler Zero Trust Exchange Platform

internal apps are secure and in compliance with(ZTE) enables fast, secure connections andyour organization’s policies.

allows your employees to work from anywhere• Applications are a fully qualified domain nameusing the internet as the corporate network.

(FQDN), local domain name, or IP address

The Zero Trust Exchange consists of 150 datathat you define on a standard set of ports.

centers worldwide, ensuring that the service isApplications must be defined within an

close to your users, co-located with the cloud

application segment.

providers and applications they are accessing,such as Microsoft 365 and AWS. It guarantees
the shortest path between your users and theirdestinations, providing comprehensive security• App Segment is a grouping of defined
applications, based upon access type or user
privileges.

and an amazing user experience.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief4• Policies in ZPA control how users access applications. Before a user can access an application, a policy
must be defined. There are many types of policies. Please refer to our resource link for more informationon policy types.
• A Zscaler Tunnel (Z-Tunnel), is a TLS-encrypted, mutually authenticated point-to-point connection
between Zscaler Client Connector and a ZPA Public Service Edge managed by Zscaler, or it’s between
an App Connector and a ZPA Private Service Edge managed by an organization. A Z-Tunnel does notcontain any direct IP data. Also, the Z-Tunnel can carry within it multiple communication channels called
Microtunnels.
• A Microtunnel (M-Tunnel) is an end-to-end communication channel created between Zscaler ClientConnector and an internal application via a ZPA Public Service Edge, or ZPA Private Service Edge and an
App Connector upon demand.
• SAP App Servers are servers that host SAP applications.

Securing remote access for users to SAP S/4HANA with ZPA

INSIDE SAP S/4HANAACLOADBALANCER

SAP S/4HANASAP ERP
Data CenterACACAWS/AzureAC

APP
CONNECTORS(Each supports upto 500 mbps)

Network Configuration is detailed in theSAP Network Configuration Gudie.

SAP S/4HANAAWS/Azure

Zero Trust
Exchange

SAP APPSERVERAC

3.

Policies determine if the user has accessto the app

4.

If allowed, the cloud establishes
outbound-only connection:from Client Connector to Service Edge
from App Connector to same Service Edge

ID Provider

Zscaler Client Connector
installed on user devices.

1.

User authenticate to IdP

2.

Authenticated user requests
access to an app

NicoleFigure 2: User reliably while securely accessing SAP applications in S/4HANA with ZPA (additional details)

Figure 1 and 2 depicts a ZPA deployment for a hybrid SAP environment. Nicole is an employee at ACME
who needs to access an SAP application. Nicole can be located anywhere—at company headquarters, at
her home, off-site at a company factory, or a coffee shop in the city.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief5

When Nicole first requests access to an SAP application, she is prompted to authenticate with herorganization’s IDP. After authentication, the Zscaler Cloud evaluates Nicole’s application request againstexisting policy. If Nicole is permitted to access the application, the Zero Trust Exchange will reach out tothe App Connector nearest to the application, which will establish an inside out Z-Tunnel, an encrypted
TLS connection, from the application to the Zero Trust Exchange. At the same time, the Zscaler Cloud will
initiate an inside out Z-Tunnel from the Client Connector on Nicole’s device back to the Zscaler Cloud. TheZscaler Cloud will then stitch the Z-Tunnels together and form an M-Tunnel inside of it, an end-to-end
communication channel between Nicole and the application. Nicole now has secure access to the SAP
application with the best user experience possible by leveraging the fastest connection from one of theover 150 global Zscaler points-of-presence.

“It’s critical to provide ouremployees with a secureand highly available
working environment byguaranteeing them secureaccess to applications in
the cloud like SAP, and theinternet at all times, while
reducing our exposure.”
Schmitz Cargobull© 2022 Zscaler, Inc. All rights reserved.

Solution Brief

6

Getting started with ZPA and SAP
For detailed steps on configuring ZPA refer to https://help.zscaler.com/zpa.
Step 1: Configure Single sign-on (SSO) Authentication and IDP

ZPA leverages user identities from an organization’s existing Identity Provider (IdP), and can be configured
to support one or multiple IdP solutions. ZPA supports single sign-on (SSO) via SAML so that your remoteusers can access enterprise applications without having to log in separately to ZPA.
In order for users to access your applications via ZPA, they must first authenticate into Zscaler ClientConnector using any SAML 2.0-compliant identity provider (IdP) using the service provider-initiated (SPinitiated) model. ZPA user SSO is SP-initiated, but ZPA admin SSO can be SP-initiated or IdP-initiated.
1.

Set up your IdP and specify ZPA as the SP. Before you can add an IdP configuration using the ZPA 		
Admin Portal, you must have the IdP in place for your organization.

2. Add an IDP configuration via the ZPA Admin Portal.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief

7

Step 2. Deploy App Connectors

App Connectors provide the secure authenticated interface between SAP applications and the ZPA cloud.
App Connectors are generally deployed in pairs for high-availability, and typically deployed adjacent to theSAP application server. App Connectors can be deployed in several forms. Zscaler distributes a standard
virtual machine (VM) image for deployment in enterprise data centers, local private cloud environments,
such as VMware, or public cloud environments such as Amazon Web Services (AWS) EC2. Additionally,
Zscaler provides packages that can be installed on supported Linux distributions.
Standard App Connector configuration consists of two main steps:1.

Add an App Connector via the ZPA Admin Portal.

2. Deploy App Connectors on the supported platform of your choice.
However, configuring App Connectors for SAP HEC/PCE requires special steps:
1.

SAP customer requests Zscaler Endpoint Service from their SAP account rep or customer
delivery manager.

2. SAP installs high availability App Connectors in SAP HEC/PCE on behalf of customer.
3. Customer provides SAP with the ZPA license to apply to App Connectors.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief8Step 3. Configure Client Connector

Zscaler Client Connector is a lightweight app that sits on users’ endpoints—corporate-managed laptops
and mobile devices, BYOD, handheld devices, and more—and enforces security policies and accesscontrols regardless of device, location, or application. The Zscaler Client Connector app forwards traffic
to the closest Zscaler Cloud point of presence, where the traffic is routed to SAP applications through theZero Trust Exchange.
1.

Complete system requirements and prerequisite tasks:• Configure appropriate security and access settings in the ZPA Admin Portal.
• SAML-based authentication must be configured and users provisioned. You cannot use the Zscaler
Client Connector Portal as an IdP for the ZPA service.
• Ensure that Zscaler Client Connector properly processes traffic for ZPA.

2. Configure administration settings for Zscaler Client Connector. The acceptable use policy, update 		settings, forwarding policies, user access to support and logging, and fail open settings are
all configurable.
2. Configure Client Connector Profiles. In the Zscaler Client Connector Portal, you can configure app 		
profiles by adding policy rules to each profile. You can select the order of precedence among the rules
as well as to whom each rule applies (i.e., to all users or to different groups of users). When a userenrolls the app with the Zscaler service, the app takes into account the order of precedence and theidentity of the user in order to download an app profile with the appropriate policy rule.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief

94. Download Zscaler Client Connector from the Client Connector store
5. Customize Client Connector with installer options. You can configure a Zscaler Client Connector 		installer file with installation options that allow you to remove steps from the user enrollment 		
process (e.g., allowing users to skip the enrollment page or the cloud selection prompt on Zscaler 		Client Connector).
6. Deploy Client Connector. You can install Zscaler Client Connector manually on individual devices or
use your organization’s device management mechanism to deploy Zscaler Client Connector on yourusers’ devices.

Step 4. Add Applications Segments

An application segment is a collection of application instances. Applications are auto-discovered and canbe grouped automatically based on matching criteria. An application segment can be anchored to one ormore hosts or host segments. Application segments are used to accommodate policies that include or span
multiple other segments.
Zscaler recommends the following best practices for configuring SAP App Segments:• Create a single application segment for all SAP applications. This will allow the ZPA service to loadbalance user requests for these applications. However, if segmentation is required, then create multiple
application segments for the SAP applications.
• Create application segments for SAP applications using FQDNs. If the SAP client is unsuccessful inresolving the host’s FQDN, it will attempt to connect to the IP address. While the service supports IPaddresses, it is more secure for zero trust models to connect with FQDNs.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief

10• If the SAP hostname is not an FQDN, a DNS

1.

Add an Application segment via thesearch domain is required. If the client has noZPA Amin Portal.

search suffix, it cannot complete the FQDN to• In the Add Application window, underconnect to SAP. The client will fall back to theIP address provided by the SAP message server,which might not be desirable or routable overthe ZPA service.

Define Applications. Enter a fully qualified
domain name (FQDN) that corresponds tothe SAP applications. While it’s possible toenter an IP address, Zscaler recommends• Use the Wireshark trace, or SAP configurations,

you use FQDNs wherever possible as it’sto identify the IP addresses of all SAP servers,

more secure. If the client has no searchand create an application segment whichsuffix, it cannot complete the FQDN toincludes only these IP addresses and theconnect to SAP. The client will fall backappropriate TCP ports. Do not advertise theto the IP address provided by the SAPentire subnet range (e.g., 192.168.1.0/24).

Message Server.

• If there is an access control list (ACL) configured• To ensure Zscaler Client Connector Accessin the SAP message server or application server,

make sure to enter the TCP Port ranges foradd the App Connector IP addresses to it. Since

the application.

the ZPA service performs a source NAT for theclient, all traffic is seen from the IP address ofthe App Connector. For the App Connector
group associated with the application
segments, ZPA will load balance user requests
across App Connectors in this App Connector
group. Because of this, it’s recommended that
the IP addresses for all the App Connectors inthe App Connector group be added to the ACL.

2. Add a DNS Search Domain. For SAP, you canconfigure DNS Search Domains for FQDNs 		
within the ZPA Admin Portal. This allows theSAP client to append the search suffix and 		build the FQDN. However, you can also 		
configure SAP to provide an FQDN 		
instead of a short name. Doing this removes
the need to configure a DNS Search Domain.

Supporting SAP applications in ZPA requires you
to configure application segments and DNS
search domains.

Resources
ZPA Policies
ZPA: Supporting SAP Applications
RISE with SAP S/4HANA Cloud, private
edition and SAP ERP, PCE

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134©2022 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

zscaler.com