3321989 - Timeout IPS error when opening connection to on-premise system through Cloud Connector

1. There is a Cloud connector setup with IPS as per Connecting to On-Premise Systems and there is an error in the IPS job log:
   
   com.sap.conn.jco.JCoException: Initialization of repository destination <Cloud connector destination> failed: Opening connection to backend failed: Timed out waiting for tunnel to open for tunnelId account:///<subaccount-id>
   
   
2. The Cloud connector ljs_trace.log shows errors like:
   
   2023-03-30 15:01:05,256 +0200#DEBUG#com.sap.core.connectivity.tunnel.client.AbstractClient#tunnel-client-35-1#          #Handshake failed! Closing channel [id: 0x8e932478] immediately.
   io.netty.channel.ConnectTimeoutException: connection timed out: <hostname>/<ip-address>:443
       at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe$1.run(AbstractNioChannel.java:261)..   
   2023-03-30 15:01:05,257 +0200#TRACE#com.sap.core.connectivity.spi.util.ChannelUtil#tunnel-client-35-1#          #Closing channel immediately [id: 0x8e932478] 
   2023-03-30 15:01:05,258 +0200#ERROR#com.sap.core.connectivity.tunnel.client.application.ApplicationClientConnectTask#Thread-12#          #Unexpected exception while establishing application tunnel connection for tunnelId: account:///<subaccount-id>
   io.netty.channel.ConnectTimeoutException: connection timed out: <hostname>/<ip-address>:443 ..

• Identity Provisioning
• SAP Cloud Connector

Cloud Connector, CF, timeout, on-premise, ABAP, S/4 HANA, Timeout, firewall, handshake error, com.sap.conn.jco.JCoException, IPS, SCC, timed out, backend failed, tunnelID , KBA , BC-IAM-IPS , Identity Provisioning Service (IPS) , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem