You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Prepare network for infrastructure deployment
3
-
description: Learn how to prepare a network for use with an S/4HANA infrastructure deployment with Azure Center for SAP solutions through the Azure portal.
2
+
title: Prepare a network for infrastructure deployment
3
+
description: Learn how to prepare a virtual network for an S/4HANA infrastructure deployment with Azure Center for SAP solutions.
4
4
ms.service: sap-on-azure
5
5
ms.subservice: center-sap-solutions
6
6
ms.topic: how-to
7
-
ms.date: 10/19/2022
7
+
ms.date: 03/17/2026
8
8
author: sagarkeswani
9
9
ms.author: sagarkeswani
10
-
#Customer intent: As a developer, I want to create a virtual network so that I can deploy S/4HANA infrastructure in Azure Center for SAP solutions.
11
10
# Customer intent: As a network administrator, I want to configure a virtual network and its components for S/4HANA deployment, so that I can ensure proper connectivity and security for the infrastructure on Azure.
12
11
---
13
12
14
-
# Prepare network for infrastructure deployment
13
+
# Prepare a network for infrastructure deployment
15
14
15
+
[Azure Center for SAP solutions](overview.md) lets you deploy and manage SAP systems on Azure. When you deploy S/4HANA infrastructure through the service, you need a virtual network that provides outbound connectivity and allows communication between application and database subnets. Without a properly configured network, the infrastructure deployment and SAP software installation can fail.
16
16
17
+
In this article, you create and configure a virtual network, set up connectivity and security rules, and allow list the endpoints that the deployment requires. Your specific network settings depend on your environment and use case.
17
18
18
-
In this how-to guide, you'll learn how to prepare a virtual network to deploy S/4 HANA infrastructure using *Azure Center for SAP solutions*. This article provides general guidance about creating a virtual network. Your individual environment and use case will determine how you need to configure your own network settings for use with a *Virtual Instance for SAP (VIS)* resource.
19
-
20
-
If you have an existing network that you're ready to use with Azure Center for SAP solutions, [go to the deployment guide](deploy-s4hana.md) instead of following this guide.
19
+
If you already have a network that's ready to use with Azure Center for SAP solutions, [go to the deployment guide](deploy-s4hana.md) instead.
21
20
22
21
## Prerequisites
23
22
24
23
- An Azure subscription.
25
-
-[Review the quotas for your Azure subscription](/azure/quotas/view-quotas). If the quotas are low, you might need to create a support request before creating your infrastructure deployment. Otherwise, you might experience deployment failures or an **Insufficient quota** error.
26
-
- It's recommended to have multiple IP addresses in the subnet or subnets before you begin deployment. For example, it's always better to have a `/26` mask instead of `/29`.
27
-
- The names including AzureFirewallSubnet, AzureFirewallManagementSubnet, AzureBastionSubnet and GatewaySubnet are reserved names within Azure. Please do not use these as the subnet names.
28
-
- Note the SAP Application Performance Standard (SAPS) and database memory size that you need to allow Azure Center for SAP solutions to size your SAP system. If you're not sure, you can also select the VMs. There are:
29
-
- A single or cluster of ASCS VMs, which make up a single ASCS instance in the VIS.
30
-
- A single or cluster of Database VMs, which make up a single Database instance in the VIS.
31
-
- A single Application Server VM, which makes up a single Application instance in the VIS. Depending on the number of Application Servers being deployed or registered, there can be multiple application instances.
24
+
- Sufficient [quotas for your Azure subscription](/azure/quotas/view-quotas). If the quotas are low, create a support request before creating your infrastructure deployment. Otherwise, you might experience deployment failures or an **Insufficient quota** error.
25
+
- Have multiple IP addresses in the subnet or subnets before you begin deployment. For example, it's better to have a `/26` mask instead of `/29`.
26
+
- The names **AzureFirewallSubnet**, **AzureFirewallManagementSubnet**, **AzureBastionSubnet**, and **GatewaySubnet** are reserved names within Azure (don't use these names as subnet names).
27
+
- Knowledge of the SAP Application Performance Standard (SAPS) and database memory size that you need so that Azure Center for SAP solutions can size your SAP system. If you're not sure, you can also select the virtual machines (VMs). The following VM types are used:
28
+
29
+
- A single Advanced Business Application Programming Central Services (ASCS) VM or a cluster of ASCS VMs, which make up a single ASCS instance in the VIS.
30
+
- A single database VM or a cluster of database VMs, which make up a single database instance in the VIS.
31
+
- A single Application Server VM, which makes up a single Application instance in the VIS. Depending on the number of Application Servers being deployed or registered, there can be multiple application instances.
32
32
33
-
## Create network
33
+
## Create a network
34
34
35
-
You must create a network for the infrastructure deployment on Azure. Make sure to create the network in the same region that you want to deploy the SAP system.
35
+
Create a network for the infrastructure deployment on Azure. Make sure to create the network in the same region where you want to deploy the SAP system.
36
36
37
37
Some of the required network components are:
38
38
@@ -42,19 +42,19 @@ Some of the required network components are:
42
42
- Route tables
43
43
- Firewalls (or NAT Gateway)
44
44
45
-
For more information, see the [example network configuration](#example-network-configuration).
45
+
For more information, see [Configure an example network](#configure-an-example-network).
46
46
47
-
## Connect network
47
+
## Connect the network
48
48
49
-
At a minimum, the network needs to have outbound internet connectivity for successful infrastructure deployment and software installation. The application and database subnets also need to be able to communicate with each other.
49
+
At a minimum, the network must have outbound internet connectivity for successful infrastructure deployment and software installation. The application and database subnets must also be able to communicate with each other.
50
50
51
-
If internet connectivity isn't possible, allowlist the IP addresses for the following areas:
51
+
If internet connectivity isn't possible, allow list the IP addresses for the following areas:
52
52
53
-
-[SUSE or Red Hat endpoints](#allowlist-suse-or-red-hat-endpoints)
-[Allow list an Azure Key Vault](#allow-list-a-key-vault)
56
+
-[Allow list a Microsoft Entra ID](#allow-list-a-microsoft-entra-id)
57
+
-[Allow list an Azure Resource Manager](#allow-list-an-azure-resource-manager)
58
58
59
59
Then, make sure all resources within the virtual network can connect to each other. For example, [configure a network security group](../../virtual-network/manage-network-security-group.md#work-with-network-security-groups) to allow resources within the virtual network to communicate by listening on all ports.
60
60
@@ -64,59 +64,57 @@ Then, make sure all resources within the virtual network can connect to each oth
64
64
65
65
If it's not possible to allow the resources within the virtual network to connect to each other, allow connections between the application and database subnets, and [open important SAP ports in the virtual network](#open-important-sap-ports) instead.
66
66
67
-
### Allowlist SUSE or Red Hat endpoints
67
+
### Allow list SUSE or Red Hat endpoints
68
68
69
-
If you're using SUSE for the VMs, [allowlist the SUSE endpoints](https://www.suse.com/c/azure-public-cloud-update-infrastructure-101/). For example:
69
+
If you're using SUSE for the VMs, [allow list the SUSE endpoints](https://www.suse.com/c/azure-public-cloud-update-infrastructure-101/). For example:
70
70
71
-
1. Create a VM with any OS [using the Azure portal](/azure/virtual-machines/linux/quick-create-portal) or [using Azure Cloud Shell](../../cloud-shell/overview.md). Or, install *openSUSE Leap* from the Microsoft Store and enable WSL.
72
-
1. Install *pip3* by running `zypper install python3-pip`.
73
-
1. Install the *pip* package *susepubliccloudinfo* by running `pip3 install susepubliccloudinfo`.
71
+
1. Create a VM with any OS [by using the Azure portal](/azure/virtual-machines/linux/quick-create-portal) or [by using Azure Cloud Shell](../../cloud-shell/overview.md). Or, install openSUSE Leap from the Microsoft Store and enable Windows Subsystem for Linux.
72
+
1. Install `pip3` by running `zypper install python3-pip`.
73
+
1. Install the `pip` package `susepubliccloudinfo` by running `pip3 install susepubliccloudinfo`.
74
74
1. Get a list of IP addresses to configure in the network and firewall by running `pint microsoft servers --json --region` with the appropriate Azure region parameter.
75
-
1.Allowlist all these IP addresses on the firewall or network security group where you're planning to attach the subnets.
75
+
1.Allow list all these IP addresses on the firewall or network security group where you plan to attach the subnets.
76
76
77
-
If you're using Red Hat for the VMs, [allowlist the Red Hat endpoints](/azure/virtual-machines/workloads/redhat/redhat-rhui#the-ips-for-the-rhui-content-delivery-servers) as needed. The default allowlist is the Azure Global IP addresses. Depending on your use case, you might also need to allowlist Azure US Government or Azure Germany IP addresses. Configure all IP addresses from your list on the firewall or the network security group where you want to attach the subnets.
77
+
If you're using Red Hat for the VMs, [allow list the Red Hat endpoints](/azure/virtual-machines/workloads/redhat/redhat-rhui#the-ips-for-the-rhui-content-delivery-servers) as needed. The default allow list is the Azure Global IP addresses. Depending on your use case, you might also need to allow list Azure US Government or Azure Germany IP addresses. Configure all IP addresses from your list on the firewall or the network security group where you want to attach the subnets.
78
78
79
-
### Allowlist storage accounts
79
+
### Allow list storage accounts
80
80
81
81
Azure Center for SAP solutions needs access to the following storage accounts to install SAP software correctly:
82
82
83
-
- The storage account where you're storing the SAP media that is required during software installation.
83
+
- The storage account where you store the SAP media required during software installation.
84
84
- The storage account created by Azure Center for SAP solutions in a managed resource group, which Azure Center for SAP solutions also owns and manages.
85
85
86
86
There are multiple options to allow access to these storage accounts:
87
87
88
88
- Allow internet connectivity
89
89
- Configure a [**Storage** service tag](../../virtual-network/service-tags-overview.md#available-service-tags)
90
90
- Configure [**Storage** service tags](../../virtual-network/service-tags-overview.md#available-service-tags) with regional scope. Make sure to configure tags for the Azure region where you're deploying the infrastructure, and where the storage account with the SAP media exists.
91
-
-Allowlist the regional [Azure IP ranges](https://www.microsoft.com/en-us/download/details.aspx?id=56519).
91
+
-Allow list the regional [Azure IP ranges](https://www.microsoft.com/download/details.aspx?id=56519).
92
92
93
-
### Allowlist Key Vault
93
+
### Allow list a Key Vault
94
94
95
-
Azure Center for SAP solutions creates a key vault to store and access the secret keys during software installation. This key vault also stores the SAP system password. To allow access to this key vault, you can:
95
+
Azure Center for SAP solutions creates a key vault to store and access the secret keys during software installation. This key vault also stores the SAP system password. To allow access to this key vault:
96
96
97
97
- Allow internet connectivity
98
-
- Configure a[**AzureKeyVault** service tag](../../virtual-network/service-tags-overview.md#available-service-tags)
98
+
- Configure an[**AzureKeyVault** service tag](../../virtual-network/service-tags-overview.md#available-service-tags)
99
99
- Configure an [**AzureKeyVault** service tag](../../virtual-network/service-tags-overview.md#available-service-tags) with regional scope. Make sure to configure the tag in the region where you're deploying the infrastructure.
100
100
101
-
<aname='allowlist-azure-ad'></a>
102
-
103
-
### Allowlist Microsoft Entra ID
101
+
### Allow list a Microsoft Entra ID
104
102
105
-
Azure Center for SAP solutions uses Microsoft Entra ID to get the authentication token for obtaining secrets from a managed key vault during SAP installation. To allow access to Microsoft Entra ID, you can:
103
+
Azure Center for SAP solutions uses Microsoft Entra ID to get an authentication token for obtaining secrets from a managed key vault during SAP installation. To allow access to Microsoft Entra ID:
106
104
107
105
- Allow internet connectivity
108
106
- Configure an [**AzureActiveDirectory** service tag](../../virtual-network/service-tags-overview.md#available-service-tags).
109
107
110
-
### Allowlist Azure Resource Manager
108
+
### Allow list an Azure Resource Manager
111
109
112
-
Azure Center for SAP solutions uses a managed identity for software installation. Managed identity authentication requires a call to the Azure Resource Manager endpoint. To allow access to this endpoint, you can:
110
+
Azure Center for SAP solutions uses a managed identity for software installation. Managed identity authentication requires a call to the Azure Resource Manager endpoint. To allow access to this endpoint:
113
111
114
112
- Allow internet connectivity
115
113
- Configure an [**AzureResourceManager** service tag](../../virtual-network/service-tags-overview.md#available-service-tags).
116
114
117
115
### Open important SAP ports
118
116
119
-
If you're unable to [allow connection between all resources in the virtual network](#connect-network) as previously described, you can open important SAP ports in the virtual network instead. This method allows resources within the virtual network to listen on these ports for communication purposes. If you're using more than one subnet, these settings also allow connectivity within the subnets.
117
+
If you're unable to [allow connections between all resources in the virtual network](#connect-the-network) as previously described, you can open important SAP ports in the virtual network instead. This method allows resources within the virtual network to listen on these ports for communication. If you're using more than one subnet, these settings also allow connectivity between the subnets.
120
118
121
119
Open the SAP ports listed in the following table. Replace the placeholder values (`xx`) in applicable ports with your SAP instance number. For example, if your SAP instance number is `01`, then `32xx` becomes `3201`.
122
120
@@ -131,60 +129,61 @@ Open the SAP ports listed in the following table. Replace the placeholder values
131
129
| Control agent | 5xx13, 5xx14 | Yes | No | Stop, start, and get status of SAP system. |
132
130
| SAP installation | 4237 | Yes | No | Initial SAP installation. |
133
131
| HTTP and HTTPS | 5xx00, 5xx01 | Yes | Yes | HTTP/S server port. |
| Telnet | 5xx08 | Yes | No | Service port for management. |
137
-
| SQL communication | 3xx13, 3xx15, 3xx40-98 | Yes | No | Database communication port with application, including ABAP or JAVA subnet. |
135
+
| SQL communication | 3xx13, 3xx15, 3xx40-98 | Yes | No | Database communication port with application, including Advanced Business Application Programming (ABAP) or JAVA subnet. |
138
136
| SQL server | 1433 | Yes | No | Default port for MS-SQL in SAP; required for ABAP or JAVA database communication. |
139
137
| HANA XS engine | 43xx, 80xx | Yes | Yes | HTTP/S request port for web content. |
140
138
141
-
## Example network configuration
139
+
## Configure an example network
142
140
143
141
The configuration process for an example network might include:
144
142
145
143
1. Create a virtual network, or use an existing virtual network.
146
144
147
145
1. Create the following subnets inside the virtual network:
148
146
149
-
1. An application tier subnet.
147
+
1. An application tier subnet.
150
148
151
-
1. A database tier subnet.
149
+
1. A database tier subnet.
152
150
153
-
1. A subnet for use with the firewall, named **Azure FirewallSubnet**.
151
+
1. A subnet for use with the firewall, named **AzureFirewallSubnet**.
154
152
155
153
1. Create a new firewall resource:
156
154
157
-
1. Attach the firewall to the virtual network.
155
+
1. Attach the firewall to the virtual network.
158
156
159
-
1. Create a rule to allowlist RHEL or SUSE endpoints. Make sure to allow all source IP addresses (`*`), set the source port to **Any**, allow the destination IP addresses for RHEL or SUSE, and set the destination port to **Any**.
157
+
1. Create a rule to allow list RHEL or SUSE endpoints. Make sure to allow all source IP addresses (`*`), set the source port to **Any**, allow the destination IP addresses for RHEL or SUSE, and set the destination port to **Any**.
160
158
161
-
1.Create a rule to allow service tags. Make sure to allow all source IP addresses (`*`), set the destination type to **Service tag**. Then, allow the tags **Microsoft.Storage**, **Microsoft.KeyVault**, **AzureResourceManager** and **Microsoft.AzureActiveDirectory**.
159
+
1.To allow service tags, create a rule. Make sure to allow all source IP addresses (`*`), set the destination type to **Service tag**. Then, allow the tags **Microsoft.Storage**, **Microsoft.KeyVault**, **AzureResourceManager**, and **Microsoft.AzureActiveDirectory**.
162
160
163
161
1. Create a route table resource:
164
162
165
-
1. Add a new route of the type **Virtual Appliance**.
163
+
1. Add a new route of the type **Virtual Appliance**.
166
164
167
-
1. Set the IP address to the firewall's IP address, which you can find on the overview of the firewall resource in the Azure portal.
165
+
1. Set the IP address to the firewall's IP address, which you can find on the **Overview** page of the firewall resource in the Azure portal.
168
166
169
167
1. Update the subnets for the application and database tiers to use the new route table.
170
168
171
169
1. If you're using a network security group with the virtual network, add the following inbound rule. This rule provides connectivity between the subnets for the application and database tiers.
0 commit comments