Prepare network for infrastructure deployment (preview)
Azure Center for SAP solutions is currently in PREVIEW. See the Azure Center for SAP solutions - Legal Terms for legal notices applicable to Azure Center for SAP solutions.
In this how-to guide, you'll learn how to prepare a virtual network to deploy S/4 HANA infrastructure using Azure Center for SAP solutions. This article provides general guidance about creating a virtual network. Your individual environment and use case will determine how you need to configure your own network settings for use with a Virtual Instance for SAP (VIS) resource.
If you have an existing network that you're ready to use with Azure Center for SAP solutions, go to the deployment guide instead of following this guide.
- An Azure subscription.
- Review the quotas for your Azure subscription. If the quotas are low, you might need to create a support request before creating your infrastructure deployment. Otherwise, you might experience deployment failures or an Insufficient quota error.
- It's recommended to have multiple IP addresses in the subnet or subnets before you begin deployment. For example, it's always better to have a
/26mask instead of
- Note the SAP Application Performance Standard (SAPS) and database memory size that you need to allow Azure Center for SAP solutions to size your SAP system. If you're not sure, you can also select the VMs. There are:
- A single or cluster of ASCS VMs, which make up a single ASCS instance in the VIS.
- A single or cluster of Database VMs, which make up a single Database instance in the VIS.
- A single Application Server VM, which makes up a single Application instance in the VIS. Depending on the number of Application Servers being deployed or registered, there can be multiple application instances.
You must create a network for the infrastructure deployment on Azure. Make sure to create the network in the same region that you want to deploy the SAP system.
Some of the required network components are:
- A virtual network
- Subnets for the Application Servers and Database Servers. Your configuration needs to allow communication between these subnets.
- Azure network security groups
- Azure application security groups
- Route tables
- Network Virtual Appliances (NVAs)
For more information, see the example network configuration.
At a minimum, the network needs to have outbound internet connectivity for successful infrastructure deployment and software installation. The application and database subnets also need to be able to communicate with each other.
If internet connectivity isn't possible, allowlist the IP addresses for the following areas:
- SUSE or Red Hat endpoints
- Azure Storage accounts
- Allowlist Azure Key Vault
- Allowlist Azure Active Directory (Azure AD)
- Allowlist Azure Resource Manager
Then, make sure all resources within the virtual network can connect to each other. For example, configure a network security group to allow resources within the virtual network to communicate by listening on all ports.
- Set the Source port ranges to *.
- Set the Destination port ranges to *.
- Set the Action to Allow
If it's not possible to allow the resources within the virtual network to connect to each other, allow connections between the application and database subnets, and open important SAP ports in the virtual network instead.
Allowlist SUSE or Red Hat endpoints
If you're using SUSE for the VMs, allowlist the SUSE endpoints. For example:
- Create a VM with any OS using the Azure portal or using Azure Cloud Shell. Or, install openSUSE Leap from the Microsoft Store and enable WSL.
- Install pip3 by running
zypper install python3-pip.
- Install the pip package susepubliccloudinfo by running
pip3 install susepubliccloudinfo.
- Get a list of IP addresses to configure in the network and firewall by running
pint microsoft servers --json --regionwith the appropriate Azure region parameter.
- Allowlist all these IP addresses on the firewall or network security group where you're planning to attach the subnets.
If you're using Red Hat for the VMs, allowlist the Red Hat endpoints as needed. The default allowlist is the Azure Global IP addresses. Depending on your use case, you might also need to allowlist Azure US Government or Azure Germany IP addresses. Configure all IP addresses from your list on the firewall or the network security group where you want to attach the subnets.
Allowlist storage accounts
Azure Center for SAP solutions needs access to the following storage accounts to install SAP software correctly:
- The storage account where you're storing the SAP media that is required during software installation.
- The storage account created by Azure Center for SAP solutions in a managed resource group, which Azure Center for SAP solutions also owns and manages.
There are multiple options to allow access to these storage accounts:
- Allow internet connectivity
- Configure a Storage service tag
- Configure Storage service tags with regional scope. Make sure to configure tags for the Azure region where you're deploying the infrastructure, and where the storage account with the SAP media exists.
- Allowlist the regional Azure IP ranges.
Allowlist Key Vault
Azure Center for SAP solutions creates a key vault to store and access the secret keys during software installation. This key vault also stores the SAP system password. To allow access to this key vault, you can:
- Allow internet connectivity
- Configure a AzureKeyVault service tag
- Configure an AzureKeyVault service tag with regional scope. Make sure to configure the tag in the region where you're deploying the infrastructure.
Allowlist Azure AD
Azure Center for SAP solutions uses Azure AD to get the authentication token for obtaining secrets from a managed key vault during SAP installation. To allow access to Azure AD, you can:
- Allow internet connectivity
- Configure an AzureActiveDirectory service tag.
Allowlist Azure Resource Manager
Azure Center for SAP solutions uses a managed identity for software installation. Managed identity authentication requires a call to the Azure Resource Manager endpoint. To allow access to this endpoint, you can:
- Allow internet connectivity
- Configure an AzureResourceManager service tag.
Open important SAP ports
If you're unable to allow connection between all resources in the virtual network as previously described, you can open important SAP ports in the virtual network instead. This method allows resources within the virtual network to listen on these ports for communication purposes. If you're using more than one subnet, these settings also allow connectivity within the subnets.
Open the SAP ports listed in the following table. Replace the placeholder values (
xx) in applicable ports with your SAP instance number. For example, if your SAP instance number is
|SAP service||Port range||Allow incoming traffic||Allow outgoing traffic||Purpose|
|Host Agent||1128, 1129||Yes||Yes||HTTP/S port for the SAP host agent.|
|Web Dispatcher||32xx||Yes||Yes||SAPGUI and RFC communication.|
|Gateway (secured)||48xx||Yes||Yes||RFC communication.|
|Internet Communication Manager (ICM)||80xx, 443xx||Yes||Yes||HTTP/S communication for SAP Fiori, WEB GUI|
|Message server||36xx, 81xx, 444xx||Yes||No||Load balancing; ASCS to app servers communication; GUI sign-in; HTTP/S traffic to and from message server.|
|Control agent||5xx13, 5xx14||Yes||No||Stop, start, and get status of SAP system.|
|SAP installation||4237||Yes||No||Initial SAP installation.|
|HTTP and HTTPS||5xx00, 5xx01||Yes||Yes||HTTP/S server port.|
|IIOP||5xx02, 5xx03, 5xx07||Yes||Yes||Service request port.|
|P4||5xx04-6||Yes||Yes||Service request port.|
|Telnet||5xx08||Yes||No||Service port for management.|
|SQL communication||3xx13, 3xx15, 3xx40-98||Yes||No||Database communication port with application, including ABAP or JAVA subnet.|
|SQL server||1433||Yes||No||Default port for MS-SQL in SAP; required for ABAP or JAVA database communication.|
|HANA XS engine||43xx, 80xx||Yes||Yes||HTTP/S request port for web content.|
Example network configuration
The configuration process for an example network might include:
Create a virtual network, or use an existing virtual network.
Create the following subnets inside the virtual network:
An application tier subnet.
A database tier subnet.
A subnet for use with the firewall, named Azure FirewallSubnet.
Create a new firewall resource:
Attach the firewall to the virtual network.
Create a rule to allowlist RHEL or SUSE endpoints. Make sure to allow all source IP addresses (
*), set the source port to Any, allow the destination IP addresses for RHEL or SUSE, and set the destination port to Any.
Create a rule to allow service tags. Make sure to allow all source IP addresses (
*), set the destination type to Service tag. Then, allow the tags Microsoft.Storage, Microsoft.KeyVault, AzureResourceManager and Microsoft.AzureActiveDirectory.
Create a route table resource:
Add a new route of the type Virtual Appliance.
Set the IP address to the firewall's IP address, which you can find on the overview of the firewall resource in the Azure portal.
Update the subnets for the application and database tiers to use the new route table.
If you're using a network security group with the virtual network, add the following inbound rule. This rule provides connectivity between the subnets for the application and database tiers.
Priority Port Protocol Source Destination Action 100 Any Any virtual network virtual network Allow
If you're using a network security group instead of a firewall, add outbound rules to allow installation.
Priority Port Protocol Source Destination Action 110 Any Any Any SUSE or Red Hat endpoints Allow 115 Any Any Any Azure Resource Manager Allow 116 Any Any Any Azure AD Allow 117 Any Any Any Storage accounts Allow 118 8080 Any Any Key vault Allow 119 Any Any Any virtual network Allow