Blogs by Ashwin

  SAP NetWeaver with AnyDB on Azure VMs This reference architecture consists of a set of proven practices for running SAP NetWeaver in a Windows environment on Azure with high availability and is always deployed with specific VM sizes that can changed to accommodate your organization's needs accordingly. High level architecture Architectural components The architecture exhibits the following infrastructure and key software components: Virtual network- The Azure Virtual network can securely connect all the Azure resources to each other as well as an on-premises environment via virtual gateway provisioned as a part of ExpressRoute or Site-to-Site connection. An ideal VDC design allows the virtual gateway to reside in the virtual network that also serves as the hub of a hub-spoke hierarchy containing multiple, peered virtual networks. The spokes represents the individual virtual networks hosting the SAP applications and database tiers. Subnets- Every virtual network is divided into se...

  Overview According to the Microsoft Azure Support Prerequisites, you must enable built-in SAP monitors about configuration as well as resource utilization from the underlying Azure infrastructure for full support. Hence, all the Azure instances that hosts software and related DBMS systems must be set up as follows: The Azure Monitoring Extension for SAP is deployed and correctly configured. Data from the Azure Monitoring Extension for SAP is visible in the SAP NetWeaver system.  The following technical requirement should be available for use of the Azure Monitoring Extension for SAP: An active route to the internet is required by the Azure Virtual Machine instance to easily access the Azure Extension Pool which also need the setting up of Internet proxies for the Virtual Machine Instance before deploying the Azure Virtual Machine Extension for SAP. The SAP Enhanced Monitoring is deployed which consists of the enhanced SAP Host Agent and monitors transaction of ST06 to precis...

  The following high availability provisions are applicable to Azure VM-based deployments: Window Server- Microsoft supports Windows Server Failover Cluster in Azure VMs with replication for non-shared storage. While SAP does not tests its applications with replication for non-shared storage, Microsoft can easily guarantee full transparency of this technology for SAP applications. Hence, the SAP applications can be operated by following the guidelines on how to set up HA configurations for SAP NetWeaver applications on Azure.  SUSE Linux Enterprise Server for SAP Applications- SUSE and Microsoft supports the SUSE Linux Enterprise Server for SAP Applications based cluster for HANA System Replication and SAP NetWeaver ASCS.  Red Hat Enterprise Linux HA Add-on- Red Hat and Microsoft supports the Red Hat Enterprise Linux HA Add-on for HANA System Replication and SAP NetWeaver ASCS.     Regarding SAP HANA on Azure (Large Instances), Microsoft supports some ...

  Network Security It is required for any SAP production system installed on Azure to operate in Virtual Private Network(s) which is/are connected to your datacenters with Azure site-to-site or ExpressRoute connectivity. End-user access to the application should be routed through your company's intranet and the Azure's site-to-site or ExpressRoute connections to the applications hosted in Azure VM Services. This way, the network and other security policies defined for on-premises applications are extended to the application in the Azure VMs. A design that is NOT supported is the segregation of the SAP application and DBMS layers into different Azure VMs that are not peered with each other. It is recommended to segregate the SAP application and DBMS layers by using subnets within an Azure virtual network instead of using the different Azure virtual networks. But, if you segregate the two layers into the different virtual networks, the two virtual networks need to be peered. The ...

  Azure VM NFS Storage Azure VM NFS storage is widely available for SAP workloads can be easily implemented by using Distributed Replicated Block Device (DRBD) with the help of Pacemaker clustering on Azure VMs running SUSE and also by using GlusterFS clustering on RHEL. Managed NFS storage is available in the form of Azure NetApp Files which is an enterprise-class, high-performance, metered file storage service. Azure NetApp Files supports a wide range of workloads and is highly available by default. Snapshots set up and service as well as performance level can be selected through the service. Microsoft has already tested the SAP file shares with Azure NetApp Files for application-level high availability and plans to provide support for SAP HANA in the near future, after the Azure NetApp Files are certified by SAP. Azure VM SMB Storage SMB shares are highly available for SAP workloads in Azure VMs and can be readily implemented by using Storage Space Direct (S2D)-based clusters wi...

  Azure VMs SAP certified operating systems supported for SAP products on Azure VMs includes: Microsoft Windows Server 2008 R2, 2012 (R2), 2016 and 2019 SUSE Linux Enterprise Server 12 (SLES 12) and higher SUSE SLES for SAP Applications (based on SLES 12) and higher Red Hat Enterprise Linux 7 (RHEL 7) and higher Red Hat RHEL for SAP (based on RHEL 7) and higher Red Hat RHEL for SAP HANA (based on RHEL 7) and higher Oracle Linux 7 (OL7) While running SAP products on Linux, you should also review the following SAP notes: 2243692- Linux on Microsoft Azure (Iaas) VM SAP license issues 2513384- SUSE Linux Enterprise Server for SAP Applications for Azure 2694118- Red Hat Enterprise Linux HA Add-On on Azure Note- Multi-SID cluster configurations for SAP Central Services is supported with Windows Server as guest operating system on Azure VMs, but it is not supported with any of the Linux distributions. SAP HANA on Azure (Large Instances) SAP-certified operating systems supported for SAP pr...

  General Prerequisites (SAP support in public cloud environments) As we all know, SAP provides scalable, compliant, and enterprise-proven platform for a range of SAP workloads which is based on the criteria stipulated by SAP. The general prerequisites for SAP supports in public cloud environments includes the following: Licensing for SAP software to be deployed. SAP system sizing and knowledge of resource requirements of SAP workloads to be deployed. Certified VM instance sizes and total capacity required by SAP software on the cloud provider platform. Sufficient network connectivity (in regard to bandwidth, latency, and package loss) to the cloud environment that will host SAP workloads. Certified operating systems on which the SAP workloads will be deployed. Support agreement available from the cloud provider. Experience with technical operation of SAP systems and the infrastructure of the cloud provider pertinent to the shared responsibilities model.   Deployment opti...

  Azure Resource Manager Templates Templates are known for providing unique benefits comparing to the traditional deployment methods that rely on the GUI or scripting and programming languages. Similar to the scripts, they can facilitate the deployment of the multicomponent solutions in an automated manner but don't specify the individual steps required to provision these solutions by simply defining their intended end state. All this results in the minimized deployment deployment time and reduces the potential for errors.  You can easily deploy the templates multiple times to the same resource group with the same outcome which is useful when you want to recreate an original deployment or remediate any issues resulting from post-deployment changes. Templates also supports VM extensions, allowing you to configure operating systems within Azure VMs as a part of their deployment. These extensions includes configuration management services, such as Power-Shell Desired State Config...

  Azure Resource Manager It is the deployment and management service of Azure providing a consistent management layer that enables you to create, update, and delete resources in your Azure subscription. The core concept of an Azure Resource Manager is a resource which is an elementary building block of the services and solutions that you can deploy into Azure.  Every resource exist in one and only one resource group which is a logical container that can easily simplify managing multiple resources. Resources in the same resource group generally shares the same life cycle, while you will have full fexibility in choosing your own criteria for grouping resources. For example, you can delegate permissions, identify costs, and audit events for all resources within a group in a single step. You can also remove them by deleting the group in which they can reside.    Role-Based Access Control (RBAC) RBAC gives you the capability to grant appropriate access to the Azure AD use...

Azure Active Directory (Azure AD) Azure AD is the Microsoft-managed, cloud-based, identity as well as access management solution which is capable of providing secure access for organizations and individuals to a variety of cloud-resident services, including Azure, Office 365, Microsoft Dynamics CRM online, and Microsoft Intune. It also offers multitenancy and scalability: Multitenancy- Azure AD is multitenant by design, which ensures isolation between its individual directory instances. From a technical point of view, the term tenant represents an individual Azure AD instance and as an Azure customer, you can create multiple Azure AD tenants. This approach is more useful if you want to test Azure AD functionality in one without affecting the others and each Azure AD tenant serves as a security boundary as well as a container for Azure AD objects such as users, groups, and applications.  Scalability- Azure AD is the world's largest multitenant directory, hosting over a million direc...

  Active Directory Domain Services (AD DS) AD DS is widely known for providing a variety of business-related and technological benefits by serving as an identity as well as access management solution for on-premises, independently managed isolated environments and the most of its characteristics reflects this underlying premise. There are three main scenarios that involves AD DS and Azure VMs: AD DS deployed to Azure VMs without cross-premises connectivity- This deployment results in the creation of a new forest, with all domain controllers residing in Azure. You can use this approach if you plan implement the Azure-resident workloads hosted on Azure VMs that rely on Kerberos authentication or GROUP Policy but have no on-premises dependencies. Existing on-premises AD DS deployment with cross-premises connectivity to an Azure virtual network where the Azure VMs reside- This scenario uses an existing on-premises AD environment to provide authentication for Azure VM-resident work...

  SAP HANA on Azure (Large Instances) networking, storage, & compute SAP HANA on Azure (Large Instances) includes deploying and running SAP HANA with the help of the physical servers dedicated to an individual customer instead of using a hypervisor. IT represents and example of HANA Tailored Data-integration Center (TDI) certified methodology where customers can easily choose from several server SKUs, widely ranging from 36 Intel CPU crores as well as 768 GB of memory to 480 Intel CPU crores as well as 24 TB of memory. Customer isolation within each infrastructure involves: Networking- The network isolation of tenants prohibits network communication between tenants in the infrastructure stamp level, even if the tenants belong to the same customer.  Storage- Storage volumes can be assigned to one storage virtual machine only which in turn is only assigned to one single tenant in the SAP HANA TDI certified infrastructure stack. As a result, storage volumes assigned to a stor...

  To read part 1 please click  here Traffic Manager A DNA-based traffic load balancer Azure Traffic Manager enables you to distribute the traffic in the most favorable way to the services across global Azure regions, while readily offering high availability and responsiveness. It provides a vast range of traffic-routing methods and endpoint monitoring options that suits different application needs as well as automatic failover models which makes it resilient to any kind of failure, including the failure of an entire Azure region.  Routing Azure implements a default routing configuration granting basic connectivity, ability to reach the internet and to communicate with the other resources on the same or directly connected virtual; networks. This default configuration can be modified in the following ways: Creating user-defined routes, which are known as the route tables with one or more rules altering the default routing behavior as well as associate them with virtual netw...

  To read part 2 please click  here Azure Virtual Networks Azure Virtual Networks provides direct, private IP-based connectivity between network-attached resources, like Azure VMs while supporting Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Internet Control Message Protocol (ICMP).  A virtual network consists of one or more subnets which can easily facilitates segmentation of networks, providing a means of controlling communication network resources. VMs generally uses a virtual network adapter to attach to a subnet to communicate with the other VMs as well as the other network resources like load balancers or gateways. The maximum number of network adapters that you can use depends on its size.  IP Addressing A unique private IP address is generally allotted to a network adapter of a VM, an internal Azure load balancer, or an application gateway from the IP address range of the subnet to which they are connected. Most of the Azure resource...

  Azure Storage Types You can use Azure Storage Service to store unstructured and partially structured data while creating an Azure Storage Account which is capable of hosting different types of following objects: Blobs- These typically represents unstructured files such as media content, virtual machine disks, backups, or logs while offering a locking mechanism, which facilitates exclusive file access that IaaS VMs requires. There are three types of blobs. The first one, known as a block blob, is the most effectively used for sequential access, which is ideal for media content. The second one, referred to as a page blob, provides superior random-access capabilities, which is the best suited for VM disks. The third one, referred to as an append blob, supports data append operations, without the need to modify existing content. This works the best with logging and auditing activities. Tables- These hosts non-relational and partially structured content consisting of multiple rows of ...

  Azure for SAP Workloads Whenever you use Microsoft Azure, you can easily run SAP applications across the development, test as well as teh production scenarios in Azure, while readily taking advantage of its scalability, flexibility, and cost savings. With the expanded partnership between Microsoft and SAP, you can be fully supported on every platform. Azure can be considered unique for SAP HANA as it enables hosting more memory and CPU resource in the scenarios involving SAP HANA, while offering the use of customer-dedicated bare-metal hardware.  SAP and Microsoft have a strong partnership along with a long history of working together that has mutual benefits for the customers. Microsoft is providing constantly updated platform and new certification details to SAP ensuring that Microsoft Azure is the best platform to run your SAP workloads. Azure Virtual Machines (VMs) Azure VMs consists of the primary Infrastructure as a Service (IaaS) compute service offerings available in...

 Access Azure Sentinel Data with External Tools Azure Sentinel's foundation is based on the Log Analytics Data Store, which is capable of combining the high-performance querying, dynamic schema, and scales to massive data volumes. The Azure portal and all the other Azure Sentinel tools always uses a standard API to access this data store which is also available for external tools such as Python and PowerShell. There are two libraries that can be used to simplify API access: kqlmagic msticpy kqlmagic The kqlmagic library provides the easy to implement API wrapper to run KQL queries. msticpy msticpy, also known as the Microsoft Threat Intelligence Python Security Tools, is a set of Python tools intended to be used for security investigations and hunting. Many of the tools originated as code Jupyter notebooks solve a problem as part of security investigation. Some of the tools are only useful in notebooks, but many others can be used from the Python command line or imported into your ...

  Manage Azure Sentinel Threat-Hunting Queries To efficiently find and isolate security threats, and unwanted activities in Contoso's environment, you can use the Azure Sentinel which contains powerful query tools. Hunt by using built-in queries Search and query tools can be used in Azure Sentinel to hunt for security threats and tactics throughout your environment. The Hunting page in Azure Sentinel provides built-in queries that can easily guide your hunting process as well as helps you to pursue the appropriate hunting paths to uncover issues in your environment while also exposing issues with the help of Hunting Queries that aren't significant enough on their own to generate an alert but have happened often enough over time to warrant investigation.  The Hunting page also provides a list of all hunting queries that can be saved by selecting the Favorites star icon for the query in the list.  Tip- When a query is selected as a favorite, it runs automatically each time ...

  CyberSecurity Threat Hunting The term "threat hunting" is defined differently by different people. The most commonly used definition is that it is the idea that you are proactively hunting through your environment for a threat or a set of activities that you have not previously detected.  Other uses of the term hunting includes searching for threats with newly obtained indicators. If a new IP Address considered harmful is provided by a Threat Intelligence Feed, an analyst can then note the IP address to search the log to find if the new indicator was seen in the past. Azure Sentinel already provides hunting queries to facilitate this process.Next, you can hunt for more evidence-based threats from a current Incident or Alert as part of an Incident Analysis Process which is vital to explore the data based on the evidence found in a current incident. Both Azure Sentinel and Microsoft 365 Defender provides this type of hunting capability. Using KQL queries to find threats is th...