3596089 - Error "403 Forbidden" when creating a SAP BW/4HANA Model Transfer connection in Datasphere

Below error messages are displayed when creating a SAP BW/4HANA Model Transfer connection in Datasphere:

We were not able to retrieve the SAP HANA host, port, and schema from the ABAP server. Please validate the live data connection (tunnel) "XXX" by editing and saving it in the “Data Integration” tab of the “Configuration” display; then try again. You can still enter the host, port, and schema manually, but we recommend you first validate the tunnel connection. If the issue persists, please contact your administrator.
We can provide the following information to assist either you or an SAP engineer to solve the issue:

Correlation ID: XXX
HTTP Status: 500 error
Error Code: tunnelDBInfoErrorTwoTenant
Technical Message: [LCS Service] failed to retrieve the HANA DB information of the BW/4HANA system for live data connection (tunnel) :: XXX. Status Code : 403, Status Message : Forbidden, Cause: "[String]Access denied to resource https://<virtual host>:<virtual port>/sap/bw4/v1/dwc/dbinfo?sap-client=xxx on system <virtual host>:<virtual port>. In case this was a valid request, ensure to expose the resource correctly in your cloud connector."

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."    

SAP Datasphere

model import, model import connection , KBA , DS-DI-CON , Connections , Problem