External RFC servers usually lack user controls comparable to ABAP. Without ACLs, they may accept unauthorized registrations or calls.
Four distinct control scopes
| Control | Scope |
|---|---|
reginfo | Registration of external RFC servers and access to registered servers. |
secinfo | Starting external servers through the Gateway. |
prxyinfo | Using the Gateway as a proxy to other ABAP systems. |
gw/acl_file | General client and network access through the Gateway. |
Reginfo and secinfo do not replace access controls for function modules in the ABAP server. Permission to register a server does not by itself restrict its clients: also review ACCESS restrictions in reginfo.
Preparation and simulation
SMGW provides tools for initial ACL setup. Review generated entries because current registrations do not cover every infrequent scenario. Maintain files and logging across all instances.
gw/sim_mode = 1 temporarily simulates reginfo, secinfo and prxyinfo. Disallowed requests are logged instead of blocked. Disable simulation after the review. Simulation does not cover the ACL configured through gw/acl_file.
Activate ACL changes dynamically in SMGW for a specific instance or the entire system, without restarting the system.
Key configuration parameters
| Parameter | Purpose |
|---|---|
gw/acl_mode | 1 enables default restrictions when ACL files are absent. |
gw/sec_info, gw/reg_info, gw/prxy_info | ACL file paths; a shared directory can support consistent instance configuration. |
gw/reg_no_conn_info | Bitmask; 255 enables the described features. 129 combines bits for bypass protection and proxy checks. Interpret bits according to the installed kernel. |
gw/monitor | 1 permits local monitoring, unlike 2 for remote access. |
gw/logging | Actions SsMPXZ support the described logging. Lowercase s limits relevant logging to rejected requests; Z records simulation activity. |
Proxy and network segmentation
A Gateway used as an intermediary can weaken expected network separation. The following example permits proxy requests from local instances of the same system:
P SOURCE=local,internal DEST=*Adapt the rule to required connections and kernel behavior. Use firewalls for network access control, with gw/acl_file as an additional safeguard.
Review checklist
- Review reginfo, secinfo, prxyinfo and the scope of gw/acl_file.
- Assess registrations and client access to external servers.
- Analyze logs and simulation results across all instances.
- Disable simulation after testing and monitor continued enforcement.