SAP BTP Cloud Connector Connectivity Troubleshooting: A Practitioner’s Field Guide

Dr. Sarah Chen breaks down what you need to know

A 503 Service Unavailable from your SAP BTP application, seconds before a stakeholder demo, is rarely a coding problem. In 16 years of architecting hybrid landscapes, I’ve found that the underlying cause is almost always a broken Cloud Connector tunnel or a subtle destination misconfiguration. The Connectivity Proxy—the BTP runtime component that forwards requests through the tunnel—is a polite liar: it masks the real failure behind opaque HTTP statuses. Let’s cut through the noise with a three‑check triad that systematically locates the fault, from tunnel health down to the target host.

The Real Story

The SAP BTP Connectivity Service (CF) relies on a Connectivity Proxy—an enforcer that inspects destinations of ProxyType: OnPremise and routes requests via the Cloud Connector’s secure SOCKS5 tunnel. The proxy doesn’t connect directly to your backend; it trusts that the Cloud Connector is alive, properly mapped to the subaccount, and configured with a matching location ID. Any break in that chain yields a generic 502 Bad Gateway or 504 Gateway Timeout.

Cloud Connector troubleshooting must therefore follow a strict dependency order:

1. Tunnel health (the most critical layer)
2. Location ID mapping (often the hidden mismatch)
3. Target host accessibility (the endpoint we actually need)

Skipping ahead often leads to wasted hours. I’ve seen seasoned Basis engineers spend afternoons debugging SSL certificates when the tunnel to SAP BTP had simply collapsed.

What This Means for You

• Developers: A stale destination clientid/clientsecret can produce authentication errors, but if your app receives a connectivity proxy error like “connection refused” or “timeout”, the problem is infrastructure‑side. Immediately escalate the three checks below.
• Basis & Platform Architects: You own tunnel monitoring. An often‑misunderstood fact: the Cloud Connector’s own health is not reflected in BTP Destination “Check Connection” tests. Those tests only validate destination metadata; they cannot detect a downed tunnel.
• Consultants: During initial setup, always explicitly define a location ID in both the Cloud Connector and the destination. Leaving it blank works only until your first multi‑tenant or multi‑region project—then silent breakage appears.

Action Items

Perform these checks sequentially. Each one builds on the previous layer’s confirmation.

1. Verify the Cloud Connector Is Still Connected to the BTP Subaccount

Open the Cloud Connector administration UI (default https://<host>:8443). Under Monitor, the subaccount card must show Connected. If it shows Reconnecting or Disconnected, jump to the Cloud Connector host immediately.

Use the command line for automated checks:

lscct --list

or query the REST API:

GET /api/v1/connection/status

Expected: "connected": true, "subaccount": "<your-subaccount>".

Common root causes:

• The Cloud Connector’s local proxy configuration has changed (check Settings → Proxy).
• The on‑premise firewall now blocks the outbound connectivity service endpoint (ports 443 to connector.cf.<region>.hana.ondemand.com). Always verify with telnet connector.cf.eu10.hana.ondemand.com 443.
• TLS certificate issues on the Cloud Connector’s JVM—review the log file ljs_trace.log, particularly any PKIX path building failed errors.

2. Ensure the Location ID Used in the Request Matches the Cloud Connector’s Location ID

Location IDs are case‑sensitive and often misconfigured. The destination property CloudConnectorLocationId must exactly match the Location ID assigned to your Cloud Connector in its admin UI (Connector → Define Location ID). If the destination omits this property, it defaults to an empty string, which only works if the Cloud Connector’s Location ID is also empty—a fragile practice.

To verify:

• In SAP BTP Cockpit, open your destination, select Edit, and inspect the property CloudConnectorLocationId.
• In Cloud Connector Administration, navigate to the Subaccount tab, and under Location ID Mapping, confirm the expected ID is active for the connected subaccount.

Real‑world example: A destination referencing CloudConnectorLocationId: "PRIMARY" will silently fail if the Cloud Connector maps to "primary" (lowercase) or "EUR". The connectivity proxy does not warn you; it simply returns a 502. Always enforce uppercase‑only naming conventions.

// Destination snippet – note the exact match required
{
  "Name": "erp-backend",

## References

- [SAP BTP Connectivity - Troubleshooting](https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/connectivity-proxy-troubleshooting)
- SAP Community Hub
- SAP News Center

---

## References

- [SAP BTP Connectivity - Troubleshooting](https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/connectivity-proxy-troubleshooting)
- [SAP News Center](https://news.sap.com/)
- [SAP Community Hub](https://community.sap.com/)