3586001 - Error "NIECONN_BROKEN" when validate S/4HANA On-Premise connection in Datasphere

When validate the S/4HANA On-Premise connection in Datasphere, below error message is displayed in the details:

Remote Tables: Unable to connect remote source:[SAP][ODBCforABAP] (08001) Open backend connection: 
NIECONN_BROKEN : unable to receive data from connproxy-xxx. Response: HTTP/1.1 503 Service Unavailable

Or:

Remote Tables: Unable to connect remote source:[SAP][ODBCforABAP] (08001) Open backend connection: 
NIECONN_BROKEN : unable to receive data from connproxy-xxx. Response: HTTP/1.1 500 Internal Server Error

Cloud Connector is selected for Data Provisioning Option under Remote Tables section of S/4HANA On-Premise connection to use the ABAP SQL service to federate data with remote tables.

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental." 

SAP Datasphere

1. Select the checkbox in front of the connection to S/4HANA On-Premise.
2. Click Validate button.

Possible Cause 1:

Handshake failure between SAP Cloud Connector network and Datasphere HANA Cloud Database.

Possible Cause 2:

Virtual host and port of RFC protocol mapping is used in Datasphere connection.

Resolution for Cause 1:

Step 1: Add the external (public) IPv4 address (range) of SAP Cloud Connector to both "Trusted IPs" and "Trusted Cloud Connector IPs" in Datasphere. If a network firewall with a proxy is used, add the external (public) IPv4 address (range) of the proxy.

• To determine the external IP of SCC:
  • Case 1: server (where SAP Cloud Connector installed) is managed by customer: check with your network administrator for the public IP address. Below command can be used for reference:
    
    • In Linux, run from the terminal: curl ifconfig.me OR dig +short myip.opendns.com @resolver1.opendns.com
    • In Windows, run from CMD: nslookup myip.opendns.com. resolver1.opendns.com or access https://whatismyipaddress.com/ in Web browser.
  • Case 2: server (where SAP Cloud Connector installed) is managed by SAP ECS (Enterprise Cloud Services):
    • Collaborate with ECS team to find this information.
• To manage IP Allowlist in Datasphere, follow the steps in Manage IP Allowlist.

Step 2: If you are using egress firewalling, add the following domains (wildcard) to the firewall/proxy allowlist in your on-premise network: 

• *.hanacloud.ondemand.com
• *.k8s-hana.ondemand.com

See Configure Cloud Connector | SAP Help Portal for more information.

Resolution for Cause 2:

Please use the virtual host and port of HTTPS protocol mapping (in SCC) in Datasphere connection.

Using ABAP SQL Services for Accessing Data from SAP S/4HANA

KBA , DS-DI-CON , Connections , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , HAN-CLS-HC , HANA Cloud Services HANA Cloud , Problem