Azure for SAP Workloads Reference Architecture

By Ashwin Venugopal -

 



SAP NetWeaver with AnyDB on Azure VMs

This reference architecture consists of a set of proven practices for running SAP NetWeaver in a Windows environment on Azure with high availability and is always deployed with specific VM sizes that can changed to accommodate your organization's needs accordingly.

High level architecture




Architectural components

The architecture exhibits the following infrastructure and key software components:
  • Virtual network- The Azure Virtual network can securely connect all the Azure resources to each other as well as an on-premises environment via virtual gateway provisioned as a part of ExpressRoute or Site-to-Site connection. An ideal VDC design allows the virtual gateway to reside in the virtual network that also serves as the hub of a hub-spoke hierarchy containing multiple, peered virtual networks. The spokes represents the individual virtual networks hosting the SAP applications and database tiers.

  • Subnets- Every virtual network is divided into separate subnets hosting application (SAP NetWeaver) as well as database tiers with the additional subnets hosting infrastructure services such as Active Directory domain controllers and serving the role of the network perimeter while all these generally resides in the hub virtual network.

  • Virtual Machines- Azure VMs hosts the application and database tiers components grouped as SAP NetWeaver which runs SAP Central Services as well as SAP application servers; and AnyDB which runs as the source database like the Microsoft SQL Server, Oracle, or IBM DB2.

  • Jumpbox- It is also known as the Bastion Host which can easily run the hardened operating system instance that administrators can use to connect to the other VMs and also Windows or Linux. You can readily use a Windows jumpbox tools like HANA Cockpit or HANA Studio. 

  • Active Directory Domain Controllers- They can offer authentication as well as authorization services for Windows and Linux operating systems.

  • Load Balancers- They can be used to distribute traffic to Azure VMs in the application and database tiers. 

  • Availability Sets- Azure VMs serving the same role can be grouped into distinct availability sets with at least two VMs per availability set in the highly available configurations. On the contrary, the individual VMs serving the same role can also be deployed into the distinct availability zones, in multi-zone deployments.

  • Network Interface Cards (NICs)- They can attach VMs to a virtual network.

  • Network Security Groups (NSGs)- They restricts incoming, outgoing, and intra-subnet traffic in a virtual network.

  • Virtual Gateway- It can allow you to extend your on-premises network to the Azure virtual network and it is generally recommended to use ExpressRoute service for cross-premises connectivity of SAP deployments in Azure, but alternately, a Site-to-Site VPN or Virtual WAN can also do the job.

  • Disks- Azure VM disks offers persistent storage for SAP workloads. 

  • Azure Storage- It can provide a wide range of storage services and can also be used b Cloud Witness to implement quorum for Windows Server Failover Clustering.

  • SAP Web Dispatcher Pool- Its component can be used as a load balancer for SAP traffic among the SAP application servers and to achieve its high availability, Azure load balancer can also be used to implement the parallel Web Dispatcher setup. Web Dispatcher uses a round-robin configuration for HTTP(S) traffic distribution among all the available load dispatchers in the load balanced backend pool. 

  • SAP Central Services Cluster- It can be a potential Single Point of Failure (SPOF) whenever it is deployed to a single VM and if you want to implement a high availability solution, you can easily deploy multiple Central Services instances while configuring them as the members of a failover cluster with a shared disk or a file share providing highly available storage accessible by all the cluster nodes. 

Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can...
Read more