Networking Changes

By Ashwin Venugopal -

 




Networking Changes for Azure VMs

The additional network requirements must be accounted for as a part of Azure VMs or Large Instances of SAP HANA on Azure.

Forced Tunneling

The default routes can be advertised to route all the traffic out through the cross-premises connection which will force traffic to Azure PaaS services back to your on-premises environment, but to return traffic to Azure via Microsoft peering path or over the Internet, you have to configure your routers. Generally, such routing is not required due to the performance reasons, however, you can easily leverage service endpoints to remediate this.

Virtual Network (VNet) service endpoints can extend your virtual network's private address space and the identity of your VNet to the Azure services, over a direct connection which also helps you to secure your critical Azure service resources to only your virtual networks. Service endpoints are usually available for a number of PaaS services and if they are enabled for a service, the traffic to that service cannot be forced to your premises and remain within the Azure backbone network.

Networking Changes for Azure SAP HANA on Azure (Large Instances)

Adding IP address ranges or subnets

If you want additional IP addresses or subnets, you should use either the Azure CLI, Azure portal or PowerShell.

Firstly, you have to add the new IP address range as a new range to the virtual address network space (and must not create a new aggregated range) and submit it to the Microsoft which helps you to connect to the HANA large instance units of your client. an azure support request can also be opened to add the new virtual network address space. You can move further after receiving the confirmation.

Adding virtual networks

Now, if you want to connect the additional Azure virtual networks that access SAP HANA on Azure  (Large Instances), then, you have to submit a request for Azure support which should also include the specific information of identifying the particular Azure deployment along with the IP address apace range or ranges of the Azure virtual network address space. After this step, the SAP HANA on Microsoft service Management can offer the necessary information required to connect the additional virtual networks as well as Azure ExpressRoute. For every virtual network, a unique authorization key is required to connect to the ExpressRoute circuit to HANA Large Instances.

Increasing Bandwidth of an ExpressRoute circuit

If SAP HANA on Microsoft Service Management advises you to increase the bandwidth of the SAP HANA on Azure (large instances) ExpressRoute circuit, then, you have to generate an Azure support request and can request an increase up to a maximum of 10 Gbps for a single circuit bandwidth.

Adding an ExpressRoute circuit

If SAP HANA on Microsoft Service Management advises you for additional ExpressRoute circuit, then, you can create an Azure support request along with a request to get authorization information to connect to the new circuit. But, before that, you have to define the address space used on the virtual networks.

When the new circuit is created, and the SAP HANA on  Microsoft Management configuration is complete, you receive a notification with the information needed to proceed further. However, if the Azure virtual networks  are already connected to another SAP HANA on Azure (Large Instances) ExpressRoute circuit in the same Azure region, then, you cannot connect them to this additional circuit.

Deleting a Subnet

You can easily use Azure portal, PowerShell, or Azure CLI if you want to delete a virtual network subnet. If you have defined one of the Azure Virtual network address range or address space as multiple IP address ranges and assigned it to your deleted subnet, then you have to make sure to delete that from your virtual network address space; and then inform SAP HANA on Microsoft Service Management to remove it from the ranges that SAP HANA on Azure (large instances) is allowed to communicate with.

Deleting a Virtual Network

SAP HANA on Microsoft Service Management can easily remove the existing authorizations on the SAP HANA Azure (large instances) ExpressRoute circuit, and azure virtual network IP address range or address space for the communication with HANA large instances. After that, you can open an Azure support request to provide the IP address space range or ranges to be removed. You must delete the ExpressRoute connection, the virtual network gateway, the virtual network gateway public IP, and the virtual network to ensure the removal of everything.

Deleting an ExpressRoute circuit

If you want tor delete an additional SAP HANA on azure (Large Instances)ExpressRoute circuit, you can open an Azure support request with SAP HANA on Microsoft Service Management and request that the circuit should be deleted, as you can easily delete or keep the virtual network as required within the Azure subscription. But, you must ensure that the connection between the HANA Large Instances ExpressRoute circuit and the linked virtual network gateway is deleted.   

   













Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different groups of computers, re
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning of alert rule parameter
Read more

Design Planning (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Complex Organizational Structures SIEM can be an expensive security control, hence, it is common multiple businesses to contribute to the overall expense. Various organizational units may require a level of access to specific dashboards or sets of data. Microsoft Sentinel offers the ability to assign table-level permissions and limit the level of access to the minimum required to perform requisite job functions.  Role-based Access Control (RBAC) Requirements Microsoft Sentinel offers an extensive list of Azure built-in roles that can be used to provide granular access according to the job requirements and permitted level of access. Some of them are various Microsoft Sentinel dedicated roles: Microsoft Sentinel Contributor- Can perform all engineering-related configuration, such as creating alert rules, configuring data connectors, and additional similar tasks.  Microsoft Sentinel Reader- Can query the log data stor
Read more