Unable to open port

Question

Unable to open port

Santosh Kumar 20

Hi

I am running into a connection time between the systems, though the NSG inbound rules & outbound rules are in place for the port 3299, where external SAP backbone systems connect to SAP router hosted on Azure.

[Thr 88780] Tue Jul 07 05:36:50 2026 [Thr 88780] *** ERROR => mainU: NiBufConnect (rc=-5) [saprcchk.cpp 1236] [Thr 88780] [Thr 88780] ***************************************************************************** [Thr 88780] * [Thr 88780] * ERROR timeout occured [Thr 88780] * [Thr 88780] * TIME Tue Jul 07 05:36:50 2026 [Thr 88780] * RELEASE 753 [Thr 88780] * COMPONENT NI (network interface) [Thr 88780] * VERSION 40 [Thr 88780] * RC -5 [Thr 88780] * MODULE D:/depot/bas/753_REL/src/base/ni/nibuf.cpp [Thr 88780] * LINE 4730 [Thr 88780] * DETAIL NiBufIConnect: route connect

Please advise

Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-07T04:53:48.1566667+00:00
Hello Santosh Kumar

To narrow this down, please share:

Is the SAP Router VM using a Public IP, Load Balancer, or Azure Firewall DNAT?

Is port 3299 reachable from the Internet using Test-NetConnection?

Are there any UDRs, Azure Firewall, or third-party NVAs in the traffic path?

Is the SAP Router running on Windows or Linux?

These details will help determine whether this is an NSG issue, routing issue, firewall issue, or SAP Router service issue.
Santosh Kumar 20 Reputation points

2026-07-07T13:17:39.54+00:00
SAP Router VM is using a Public IP

2)Pls see the below :

F:\usr\sap\saprouterdir>netstat -ano | findstr 3299

TCP 0.0.0.0:3299 0.0.0.0:0 LISTENING 1644

Test-NetConnection 194.xx.xxx.34 -Port 3299

ComputerName : 194.xx.xxx.34

RemoteAddress : 194.xx.xxx.34

RemotePort : 3299

InterfaceAlias : Ethernet

SourceAddress : 10.0.0.5

TcpTestSucceeded : True

No firewall is being used

SAP Router running on Windows
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-08T02:28:44.99+00:00

Hi @Santosh Kumar ,

Thank you for the update. Since SAP Router is listening on port 3299, could you please confirm whether the connectivity test was performed from an external source and verify that TCP port 3299 is allowed in the associated NSG? If the issue continues, please share the SAP Router logs for further analysis.
Santosh Kumar 20 Reputation points

2026-07-08T02:45:20.0266667+00:00

We have NSG inbound rule in place for port 3299. I have requested SAP to validate the same.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-08T04:54:25.47+00:00

Hi @Santosh Kumar ,

Thank you for the update. Since port 3299 is allowed and the SAP Router service is listening, everything looks good from the Azure side. Please share the SAP validation results when available.
Santosh Kumar 20 Reputation points

2026-07-08T13:58:53.65+00:00

Hi @Bhavani Kamidi SAP confirmed SAP Support System is not connecting to SAP Router, asked to check the ports blocking on Azure side, since we have opened the port, unable to figure out why it is not connecting. SInce this is public platform, i am not able to put any logs here, which has IP address of both SAP & Azure server.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-16T02:02:09.7166667+00:00

Hi Santosh,

Thank you for the update. Based on the information shared, we do not see any indication that the NSG is blocking port 3299. As the issue persists, additional connectivity validation is required to identify where the connection is timing out.
Santosh Kumar 20 Reputation points

2026-07-16T02:28:24.7166667+00:00

Please let me know when you want to investigate, please send the meeting invite or let me know what information you needed to access the VM logs.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-17T05:04:41.1866667+00:00

Hi Santosh,
Can you please share your availability so that I can schedule a meeting.
Santosh Kumar 20 Reputation points

2026-07-17T14:17:47.1933333+00:00

Pleases send the meeting invite anytime today or Monday during US central - 8 AM to 6M
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-21T12:53:12.68+00:00

Hi Santosh,
I apologize that I was unable to schedule a call yesterday. Could you please let me know your availability today.
Santosh Kumar 20 Reputation points

2026-07-21T13:39:19.92+00:00

I am available today anytime after 10am US Central
Santosh Kumar 20 Reputation points

2026-07-24T12:58:20.43+00:00

Hi, I did not receive any meeting invite yet, any update on this issue ?
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-08-22T14:44:31.0833333+00:00

Hi Santosh Kumar,

Thank you for sharing your availability over the teams. We can connect at 8:00 AM IST on Monday using the same Teams meeting/chat.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-08-26T09:19:08.2133333+00:00

Hi Santosh kumar,

Could you let me know your availability tomorrow? We can connect on Teams to discuss this further.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-09-02T07:13:53.7+00:00

Hello ,

Hope you are doing well !

I just wanted to follow up on my previous email, hope you had a chance to go through it, if so do let us know, so that we can move ahead accordingly.

Please feel free to let us know if you have any queries or concerns and we will be happy to assist you.

Awaiting your response.

1 answer

Your answer

Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-07T04:53:48.1566667+00:00

Hello Santosh Kumar

To narrow this down, please share:

Is the SAP Router VM using a Public IP, Load Balancer, or Azure Firewall DNAT?

Is port 3299 reachable from the Internet using Test-NetConnection?

Are there any UDRs, Azure Firewall, or third-party NVAs in the traffic path?

Is the SAP Router running on Windows or Linux?

These details will help determine whether this is an NSG issue, routing issue, firewall issue, or SAP Router service issue.
Santosh Kumar 20 Reputation points

2026-07-07T13:17:39.54+00:00

SAP Router VM is using a Public IP

2)Pls see the below :

F:\usr\sap\saprouterdir>netstat -ano | findstr 3299

TCP 0.0.0.0:3299 0.0.0.0:0 LISTENING 1644

Test-NetConnection 194.xx.xxx.34 -Port 3299

ComputerName : 194.xx.xxx.34

RemoteAddress : 194.xx.xxx.34

RemotePort : 3299

InterfaceAlias : Ethernet

SourceAddress : 10.0.0.5

TcpTestSucceeded : True

No firewall is being used

SAP Router running on Windows
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-08T02:28:44.99+00:00

Hi @Santosh Kumar ,

Thank you for the update. Since SAP Router is listening on port 3299, could you please confirm whether the connectivity test was performed from an external source and verify that TCP port 3299 is allowed in the associated NSG? If the issue continues, please share the SAP Router logs for further analysis.
Santosh Kumar 20 Reputation points

2026-07-08T02:45:20.0266667+00:00

We have NSG inbound rule in place for port 3299. I have requested SAP to validate the same.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-08T04:54:25.47+00:00

Hi @Santosh Kumar ,

Thank you for the update. Since port 3299 is allowed and the SAP Router service is listening, everything looks good from the Azure side. Please share the SAP validation results when available.
Santosh Kumar 20 Reputation points

2026-07-08T13:58:53.65+00:00

Hi @Bhavani Kamidi SAP confirmed SAP Support System is not connecting to SAP Router, asked to check the ports blocking on Azure side, since we have opened the port, unable to figure out why it is not connecting. SInce this is public platform, i am not able to put any logs here, which has IP address of both SAP & Azure server.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-16T02:02:09.7166667+00:00

Hi Santosh,

Thank you for the update. Based on the information shared, we do not see any indication that the NSG is blocking port 3299. As the issue persists, additional connectivity validation is required to identify where the connection is timing out.
Santosh Kumar 20 Reputation points

2026-07-16T02:28:24.7166667+00:00

Please let me know when you want to investigate, please send the meeting invite or let me know what information you needed to access the VM logs.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-17T05:04:41.1866667+00:00

Hi Santosh,
Can you please share your availability so that I can schedule a meeting.
Santosh Kumar 20 Reputation points

2026-07-17T14:17:47.1933333+00:00

Pleases send the meeting invite anytime today or Monday during US central - 8 AM to 6M
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-21T12:53:12.68+00:00

Hi Santosh,
I apologize that I was unable to schedule a call yesterday. Could you please let me know your availability today.
Santosh Kumar 20 Reputation points

2026-07-21T13:39:19.92+00:00

I am available today anytime after 10am US Central
Santosh Kumar 20 Reputation points

2026-07-24T12:58:20.43+00:00

Hi, I did not receive any meeting invite yet, any update on this issue ?
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-08-22T14:44:31.0833333+00:00

Hi Santosh Kumar,

Thank you for sharing your availability over the teams. We can connect at 8:00 AM IST on Monday using the same Teams meeting/chat.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-08-26T09:19:08.2133333+00:00

Hi Santosh kumar,

Could you let me know your availability tomorrow? We can connect on Teams to discuss this further.
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-09-02T07:13:53.7+00:00

Hello ,

Hope you are doing well !

I just wanted to follow up on my previous email, hope you had a chance to go through it, if so do let us know, so that we can move ahead accordingly.

Please feel free to let us know if you have any queries or concerns and we will be happy to assist you.

Awaiting your response.

Answer 1

Alex Burlachenko 25,120 MVP Volunteer Moderator

Hi Santosh Kumar & thx for join me here at Q&A portal,

port 3299 is only one part of it. A timeout means the traffic is being dropped somewhere, not refused by SAProuter.

Check the full path NSG allows inbound to the SAProuter VM NIC/subnet, Azure Firewall allows inbound DNAT / network rule if traffic passes through it, VM OS firewall allows TCP 3299, SAProuter is actually listening on 0.0.0.0:3299 or the right private IP, UDR/routing sends return traffic back the same way, No NVA/firewall is blocking outbound return traffic. From the SAProuter VM, run

netstat -ano | findstr 3299

From another machine, test

Test-NetConnection <saprouter-public-ip-or-dns> -Port 3299

If Azure Firewall is in the path, check Firewall logs. That will tell u if the traffic is denied or not even reaching it.

If NSG rules are correct but the timeout stays, my bet would be routing, Azure Firewall DNAT/rules, or the service not listening. NSG gets blamed a lot, but it’s not always the villain.

rgds,

Alex &

pls if my answer was helpfull mark it as an answer & follow me here and at my blog https://ctrlaltdel.blog/

Santosh Kumar 20 Reputation points

2026-07-07T13:15:03.49+00:00

Pls see the below :

F:\usr\sap\saprouterdir>netstat -ano | findstr 3299

TCP 0.0.0.0:3299 0.0.0.0:0 LISTENING 1644

Test-NetConnection 194.xx.xxx.34 -Port 3299

ComputerName : 194.xx.xxx.34

RemoteAddress : 194.xx.xxx.34

RemotePort : 3299

InterfaceAlias : Ethernet

SourceAddress : 10.0.0.5

TcpTestSucceeded : True
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-10T15:31:09.6533333+00:00

Hi Santosh Kumar,

Thank you for sharing the results. SAP Router is listening on port 3299, and the connectivity test was successful. This confirms that traffic is reaching the server and Azure NSG connectivity is working as expected. The timeout appears to be occurring on the SAP side.
Santosh Kumar 20 Reputation points

2026-07-10T16:54:45.4666667+00:00

we tested the out bound, but inbound is not working, SAP tested the connection, it is not working...
Bhavani Kamidi 5 Reputation points Microsoft External Staff

2026-07-13T07:16:31.5533333+00:00

Hi Santosh kumar,

Thank you for the update.

Since the SAP Router service is listening on port 3299 and connectivity checks are successful, the Azure VM and NSG configuration appear to be working as expected. As inbound connections are still failing, could you please share the SAP Router logs from the failed connection attempt? This will help us identify where the timeout is occurring and assist further.
Santosh Kumar 20 Reputation points

2026-07-13T17:47:57.06+00:00

I have already sent the emailto you, with all the results, can you please check your email, test results shared, also please set a meeting to address this immediately, or else there is be exchange of messages every day, till the issue is resolved, more over there is Public IP address which is not a best way to share in this public platform.