3586001 - Error "NIECONN_BROKEN" when validate S/4HANA On-Premise connection in Datasphere

When validate the S/4HANA On-Premise connection in Datasphere, below error message is displayed in the details:

Remote Tables: Unable to connect remote source:[SAP][ODBCforABAP] (08001) Open backend connection: 
NIECONN_BROKEN : unable to receive data from connproxy-xxx. Response: HTTP/1.1 503 Service Unavailable

Or:

Remote Tables: Unable to connect remote source:[SAP][ODBCforABAP] (08001) Open backend connection: 
NIECONN_BROKEN : unable to receive data from connproxy-xxx. Response: HTTP/1.1 500 Internal Server Error

Or:

Remote Tables: Unable to connect remote source:[SAP][ODBCforABAP] (08001) Open backend connection: 
NIECONN_BROKEN : unable to receive data from connproxy-xxx. Response: HTTP/1. 403 Forbidden

Cloud Connector is selected for Data Provisioning Option under Remote Tables section of S/4HANA On-Premise connection to use the ABAP SQL service to federate data with remote tables.

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental." 

SAP Datasphere

1. Select the checkbox in front of the connection to S/4HANA On-Premise.
2. Click Validate button.

• Possible Cause 1:
  Handshake failure between SAP Cloud Connector network and Datasphere HANA Cloud Database.
• Possible Cause 2:
  Virtual host and port of HTTPS protocol mapping is not used in Datasphere connection.
• Possible Cause 3:
  Message Server is selected for SAP Logon Connection Type when create the connection.
  
  
  

Resolution for Cause 1:

Step 1: Add the external (public) IPv4 address (range) of SAP Cloud Connector to both "Trusted IPs" and "Trusted Cloud Connector IPs" in Datasphere. If a network firewall with a proxy is used, add the external (public) IPv4 address (range) of the proxy.

• To determine the external IP of SCC see KBA 3643152 - Contact(s) to obtain Public IP of SAP Cloud Connector for SAP Datasphere Connection:
  • Case 1: server (where SAP Cloud Connector installed) is managed by customer: check with your network administrator for the public IP address. Below command can be used for reference:
    
    • In Linux, run from the terminal: curl ifconfig.me OR dig +short myip.opendns.com @resolver1.opendns.com
    • In Windows, run from CMD: nslookup myip.opendns.com. resolver1.opendns.com or access https://whatismyipaddress.com/ in Web browser.
  • Case 2: server (where SAP Cloud Connector installed) is managed by SAP ECS (Enterprise Cloud Services):
    • Collaborate with ECS team to find this information.
• To manage IP Allowlist in Datasphere, follow the steps in Manage IP Allowlist.

Step 2: If you are using egress firewalling, add the following domains (wildcard) to the firewall/proxy allowlist in your on-premise network: 

• *.hanacloud.ondemand.com
• *.k8s-hana.ondemand.com

See Configure Cloud Connector | SAP Help Portal for more information.

Resolution for Cause 2:

Use the virtual host and port of HTTPS protocol mapping (in SCC) in Datasphere connection.

Resolution for Cause 3:

Data federation with remote tables using the ABAP SQL service is supported for SAP Logon connection type Application Server and basic authentication with User Name and Password. Change the SAP Logon connection type to Application Server.

• Using ABAP SQL Services for Accessing Data from SAP S/4HANA
• KBA 3643152 - Contact(s) to obtain Public IP of SAP Cloud Connector for SAP Datasphere Connection

KBA , DS-DI-CON , Connections , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , HAN-CLS-HC , HANA Cloud Services HANA Cloud , Problem