Introduction to SAP workloads on IBM Cloud® VPC
The objective of this document is to provide solution designs for the deployment of SAP solution types on IBM Cloud® Virtual Private Cloud (VPC). This solution:
- Accelerate and simplify solution design by providing a standard IBM Cloud® VPC deployment architecture. For more information, see Architecture framework.
- Provide end to end enterprise-class solution design that includes diagrams, component architecture decisions, and rationale for cloud component selection for a secure, resilient SAP on IBM Cloud VPC.
- Verify if requirements can be met by performance, system availability, and security perspectives.
SAP configuration and SAP component deployment scenarios are not covered in this solution design. It is limited to IBM Cloud infrastructure options to support SAP workloads.
Enterprise-class, mission-critical workloads need to be secure, resilient, and provide High Availability (HA) and Disaster Recovery (DR). This pattern can be used as a guide to meet typical user requirements and provide a base reference solution for a secure and resilient SAP NetWeaver and HANA or SAP NetWeaver and AnyDB deployment to IBM Cloud VPC. This supports the deployment of SAP Business Applications running on SAP NetWeaver, SAP HANA or SAP AnyDB, and other SAP products by using other technologies. Other technologies include SAP Content Server or newer applications such as SAP Data Intelligence.
IBM Cloud SAP-Certified infrastructure provides the flexibility to run SAP workloads in the IBM Cloud and also addresses issues such as:
- Moving SAP workloads to the cloud
- Rapidly expanding or contracting capacity
- Supplementing an existing private cloud architecture
IBM Cloud® VPC introduction
IBM Cloud Virtual Servers for VPC offers fast provisioning compute capacity, also known as virtual machines with the highest network speeds and most secure, software-defined networking resources available on the IBM Cloud. This is built on IBM Cloud Virtual Private Cloud (VPC) featuring powerful, 4th Gen Intel® Xeon® processors with new Intel® Software Guard Extensions (Intel® SGX®) to help protect data in use through a unique application isolation technology.
A VPC is a public cloud offering that an enterprise uses to establish its own private cloud-like computing environment on shared public cloud infrastructure. VPC gives an enterprise the ability to define and control a virtual network that is logically isolated from all other public cloud tenants, creating a private, secure place on the public cloud.
A VPC’s logical isolation is implemented by using virtual network functions and security features that give an enterprise user granular control over which IP addresses or applications can access particular resources.
SAP workloads on the IBM Cloud® VPC
As part of an ongoing partnership with SAP, IBM is constantly providing new platform configurations for certification by SAP as part of its Infrastructure-as-a-Service (IaaS) offering, designed to best fit any SAP workload scenario from small business to intensive workloads running SAP HANA.
SAP note 2927211 offers a complete description of SAP products, database solutions, and OS releases that are available in IBM Cloud VPC. These are supported by SAP which is part of IBM’s Infrastructure-as-a-Service (IaaS) virtual machines and bare metal servers.
The Infrastructure-as-a-Service (IaaS) server types within the IBM Cloud VPC Infrastructure environment are the Intel Bare Metal Servers and the Intel Virtual Servers, based on IBM Cloud's managed KVM hypervisor.
| Linux operating systems | Windows Server operating systems | |
|---|---|---|
| Applications running on the ABAP Platform (inter alia the technology foundation for S/4 HANA 1809 and higher) |
|
|
| Applications running on the Application Servers ABAP and/ or Java as part of SAP NetWeaver 7.4 or higher |
|
|
| Applications running on the Application Server ABAP and/ or Java as part of SAP NetWeaver 7.1 or higher |
|
|
| Applications running on the Application Server ABAP as part of SAP NetWeaver 7.0x |
|
|
| Versions | |
|---|---|
| SAP Search and Classification (TREX) |
|
| SAP liveCache | The minimal version for SAP LC/LCAPPS 10.0 SP 46 including liveCache 7.9.10.04 and LCA-Build 46, released for EhP 4 for SAP SCM 7.0 or higher. For details, see SAP Note 2074842. |
| SAP Content Server | SAP Content Server 7.53 and higher version on Linux and Windows Server. For more information, see SAP Note 719971(SAP Content Server release strategy){: external}. |
| SAP IQ | The SAP IQ 16.x version is used. For more information, see SAP Note 2133194. |
| SAP Business Objects | For the support of SAP BusinessObjects Business Intelligence suite on IBM Cloud see SAP Note 2279688. |
| SAP Business One |
|
| Versions | |
|---|---|
| RDBMS |
|
Supported Operating Systems
- Red Hat Enterprise Linux (RHEL) version 7 or higher.
- SUSE Linux Enterprise Server (SLES) version 12 SP4 or higher.
- Microsoft Windows Server 2016, 2019, and 2022.
For more information on valid DB/OS combinations please consult the SAP Product Availability Matrix (PAM).
Prerequisites
-
Create an API key for your VPC. The API key is used to authenticate with the IBM Cloud platform and to determine your permissions for IBM Cloud services. For more information, see Create or retrieve an IBM Cloud API key.
-
Create a SSH key on the IBM Cloud VPC. For more information, see Create or retrieve your SSH key ID.
Before deploying any SAP workload in the IBM Cloud VPC, there are certain IBM Cloud services which need to be provisioned. The order in which these are provisioned is mentioned here:
- VPC for SAP provisioning
- New Subnet for the VPC
- Security Group for the VPC
- New Intel Virtual Server Instance (VSI)
- Block storage for Intel Virtual Server Instances (VSIs) – additional storage can be added post VSI creation
- NFS-based file storage for VPC – additional request for certain deployment scenarios
- New Intel Virtual Server Instance (VSI)
VPC for SAP provisioning
Before deploying any SAP workload into VSI, a IBM Cloud VPC must be created.
Following are the steps to setup the VPC:
-
Click Menu icon > VPC Infrastructure > Network > VPCs.
-
Choose the Region and click Create.
-
Confirm the Location (Geography and Region).
-
Enter a unique name for the VPC.
-
Select a Resource group. Use resource groups to organize your account resources for access control and billing purposes.
For more information, see Best practices for organizing resources in a resource group and What makes a good resource group strategy?.
-
Optional: Enter the tags to help you organize and find your resources. You can add more tags later. For more information, see Working with tags.
-
Select whether the default security group allows inbound SSH and ping traffic to virtual server instances in this VPC. You can configure more rules for the default security group later.
-
Optional: Default address prefixes. Disable this option if you do not want to assign default subnet address prefixes to each zone in your VPC. After you create the VPC, go to the details page and set your own subnet address prefixes. If you disable this option, the new subnet for VPC section will be hidden and requires manual definition after the VPC is created. The value is set to default.
You can only enable a VPC for classic access when it is created. You cannot update a VPC to add or remove classic access. In addition, you can have only one classic access VPC in your account at any time. For more information, see Create an IBM Cloud VPC.
New subnet for VPC
Following are the steps to create a new subnet for the VPC:
-
To add a new subnet during the creation of new VPC, click Add subnet.
-
Enter a unique name for the VPC subnet.
-
Select a Resource group for the subnet.
-
Select a Location for the subnet. The location consists of a region and a zone.
The region is automatically inherited from the VPC (currently in creation).
-
Optional: Make use of tags to better organize and find your resources.
-
Enter an address prefix, number of addresses, and an IP range for the subnet. The IP range is entered in CIDR notation, for example: 10.240.0.0/24. Usually, you can use the default IP range. If you want to specify a custom IP range, you can use the IP range calculator to select a different address prefix or change the number of addresses.
A subnet cannot be resized after it has been created.
-
Attach a public gateway to the subnet to allow all the attached resources to communicate with the public internet (not mandatory for certain scenarios).
-
Click Create virtual private cloud.
If you have disabled the default address prefixes, which hides the new subnet for VPC section on the VPC ordering page, then you need to manually define your subnets before provisioning your virtual servers for VPC. Following are the steps to set up your subnets:
- Click Menu icon > Infrastructure > Network > Subnets.
- Choose the desired Region and click Create.
- Confirm the Location (Geography, Region and Zone).
- Enter a unique name and select the VPC to be associated.
- Select a Resource group.
- Optional: Use tags to better organize and find your resources.
- Choose the VPC fro the subnet to be associated.
- Enter an Address prefix, Total IP addresses and an IP range for the subnet. The IP range is entered in CIDR notation, for example: 10.240.0.0/24. Usually, you can use the default IP range. If you want to specify a custom IP range, you can use the IP range calculator to select a different address prefix or change the number of addresses.
- Leave the values as default for the Routing table and Subnet access control list.
- Choose a Public gateway to the subnet to allow all the attached resources to communicate with the public internet (not mandatory for certain scenarios).
- Review the costs of your subnet resource and click Create subnet.
Security Group for VPC
After creating the VPC and subnet, a default Security Group will be automatically provisioned.
- Navigate to Menu icon > Infrastructure > Network > VPCs.
- Selecting the VPC, displays the Overview tab, showing various information on the VPC and the default security group.
- Click on the default security group, to display the Overview tab.
- Navigate to the Rules tab to bring forward the Inbound rules and Outbound rules settings.
By default, this Security Group is unrestricted, and the user should close the Inbound/Outbound access according to its security requirements and regulations.
New Intel Virtual Server Instance (VSI)
Before provisioning an Intel VSI (compute component of any SAP Workload), you should understand the available profile families in the IBM Cloud VPC.
Virtual server profile names
In IBM Cloud VPC, the profile families that are certified for SAP are:
- Compute Optimized
- Balanced
- Memory Optimized
- Very High Memory Optimized
- Ultra High Memory Optimized
All the memory family profiles provide memory intensive workloads, such as demanding database applications, in-memory analytics workloads, and are designed for SAP HANA workloads. For more information, see x86-64 instance profiles. For more information about SAP profiles, see Intel Virtual Server certified profiles on VPC infrastructure for SAP HANA and Intel Virtual Server certified profiles on VPC infrastructure for SAP NetWeaver.
The following profile families are available to provision the VSI:
| Profile Families | Description |
|---|---|
| Balanced | Balanced profiles offer a core to RAM ratio that is best for midsize databases and common cloud applications with moderate traffic. |
| Compute | Compute profiles offer a core to RAM ratio that is best for moderate to high web traffic workloads. Compute profiles are best for workloads with intensive CPU demands, such as high web traffic workloads, production batch processing, and front-end web servers. |
| Memory | Memory profiles offer a core to RAM ratio that is best for memory caching and real-time analytics workloads. Memory profiles are best for memory intensive workloads, such as large caching workloads, intensive database applications, or in-memory analytics workloads. |
| Very High Memory | Very High Memory profiles offer a core to RAM ratio of 1 vCPU to 14 GiB of RAM. This family is optimized for running small to medium in-memory databases and OLAP workloads, such as SAP BW/4 HANA. |
| Ultra High Memory | Ultra High Memory profiles offer the most memory per core with 1 vCPU to 28 GiB of RAM. These profiles are optimized to run large in-memory databases and OLTP workloads, such as SAP S/4 HANA. |
| GPU | GPU enabled profiles provide on-demand access to NVIDIA V100 and A100 GPUs to accelerate AI, high-performance computing, data science, and graphics workloads. |
| Storage Optimized | Storage Optimized profiles offer temporary SSD instance storage disks at a ratio of 1 vCPU to 300 GB instance storage with a smaller price point per GB. These profiles are designed for storage-dense workloads and offer virtio interface type for attached disks. |
| Confidential Compute | Confidential Compute-supported profiles use processor reserved memory called EPC (Enclave Page Cache) to encrypt application data. Processor reserved memory EPC maintains confidentiality and integrity. |
The first letter of the profile name indicates the profile family:
| First letter | Characteristics of the related profile family |
|---|---|
| c | Compute Optimized family, vCPU to memory ratio 1:2 or 1:2.5 |
| b | Balanced family, vCPU to memory ratio 1:4 or 1:5 |
| m | Memory Optimized family, higher vCPU to memory ratio 1:8 or 1:10 |
| v | Very High Memory Optimized family, very high vCPU to memory ratio 1:14 |
| u | Ultra High Memory Optimized family, ultra high vCPU to memory ratio 1:28 |
Instance storage
Instance storage is a set of one or more solid-state drives (full or isolated partial storage spaces) attached to your virtual server instance when the instance is provisioned. Instance storage is close to the compute resources of the virtual server and on a high-speed communication channel that is independent from the network. An instance storage disk provides fast, affordable, temporary storage to improve the performance of cloud native workloads with scratch space, caching buffers, or a place for replicated data. The data that is stored on instance storage is temporary, which means that the data is attached directly to the instance lifecycle. The instance storage disk is automatically created and destroyed with the instance. Instance storage data is not lost when an instance is rebooted.
Instance storage is a complementary storage technology to boot and block storage volumes that are offered with VPC. For more information, see About instance storage on IBM Cloud VPC. Below are the examples for instance storage disks:
-
Distributed File Systems: Technologies like Hadoop Distributed File System (HDFS) replicate data across multiple servers to improve read bandwidth and ensure reliability. It is recommended to maintain at least three copies of the data, ideally across availability zones, when using Instance Storage for these workloads.
-
Transactional jobs: Transaction processing usually creates a significant number of temporary files. Instance storage is a great place to temporarily store that data while the transactions are processed, with the results stored persistently on a data volume.
Block storage for virtual servers on VPC infrastructure
When you create secondary data volumes, you select a volume profile to meet your requirements. Volume profiles are available in three predefined tiers or as a custom profile. These volume profiles relate to virtual server instance profiles:
- A 3 IOPS general-purpose tier profile provides IOPS/GB performance suitable for a virtual server instance Balanced profile.
- A 5-IOPS tier profile provides IOPS/GB performance suitable for a virtual server instance Compute profile.
- A 10-IOPS tier profile provides IOPS/GB performance suitable for a virtual server instance Memory profile.
For network storage, IOPS per GB is limited and performance varies based on the workload. For Relational Database Management Systems (RDBMS), it is beneficial to store both the database log and data on the same volume, depending on the applications behavior. In general, for typical RDBMS-based applications, a 5 IOPS/GB profile is reasonable. If your application relies on specific KPIs for storage performance, test the storage throughput before deploying software.
More information on Block Storage for Virtual Servers Instances on VPC can be found under About Block Storage for VPC.
NFS-based file storage for VSI on VPC infrastructure
IBM Cloud® File Storage for VPC is a zonal file storage offering that provides NFS-based file storage services. You can create file shares in an availability zone within a region. You can share them with multiple virtual server instances within the same zone or other zones in your region, across multiple VPCs. You can also limit access to a file share to a specific virtual server instance within a VPC and encrypt the data in transit.
File Storage for VPC provides file shares within the VPC Infrastructure. You create a file share in a zone and create the mount targets for the share per VPC. Replication between the source file share and a replica file share can be enabled. So if an outage at the primary site was to occur, you can fail over to the replica file share. Data on a file share is encrypted at rest with IBM-managed encryption by default. For added security, you can use your own root keys to protect your file shares with customer-managed keys.
For more information on NFS-based file storage for Virtual Server Instances on VPC Infrastructure, see About File Storage for VPC.
Catalog images on VPC
When provisioning IBM Cloud virtual servers for VPC on x86 architecture, choose from the supported stock images, a virtual server operating system bundle, or a custom image from IBM Cloud Object Storage. The selected image determines the operating system that is provisioned for your instance. If the image selected is a virtual server operating system bundle stock image, then the software that is part of that bundle is also included in your instance.
In the IBM Cloud console, go to the navigation Menu icon > Infrastructure > Compute > Images.
There are 3 different types of images for VPC:
- Custom images (includes Image from volume)
- Stock images
- Catalog images
To share or publish a custom image within your enterprise, you must create a private catalog, which allows you to manage access to products for multiple accounts within the same enterprise. You can share any existing x86 virtual server custom image with a private catalog, except for an encrypted image. For more information about these limitations, see VPC considerations when using custom images in a private catalog.
When you select a catalog image, ensure that you are informed about any associated billing plans.
Catalog images are billed in one of the following ways:
- Free trial
- Usage-based
- Bring Your Own License (BYOL)
Bring your own OS product license
When you have your own operating system license, you can install on your virtual server based on the instructions. For more information about custom images, see Importing and managing custom images. The OS chosen must be certified for SAP and have access to the necessary OS packages for SAP. For more information, see Bring your own license.
Provisioning the Intel Virtual Server Instance (VSI)
Once you understand the server profile, storage, and image options, then the Intel Virtual Server Instance (VSI) can be provisioned.
- Click Menu icon > Infrastructure > virtual server instances.
- From the virtual server instance main screen, click Create after ensuring the right Region is selected.
- Choose the desired Location. This is done by choosing the Geography, Region and Zone.
- Enter a unique name for the virtual server, that becomes the hostname. SAP hostnames must consist of a maximum of 13 alpha-numeric characters. For more information about SAP hostnames, see SAP Notes 611361 and 129997.
- Choose a Resource group.
- Optional: Enter tags to help you organize and find your resources. You can add more tags later. For more information, see Working with tags.
- Select your preferred operating system from either Windows Server, Red Hat Linux or SUSE Linux to run SAP NetWeaver, or from Red Hat or SUSE to run SAP HANA. Ensure SAP certified is selected.
-
Select Profile. For more information, see based on the guidance that is detailed in Intel Virtual Server certified profiles for SAP HANA or Intel Virtual Server certified profiles for SAP NetWeaver, which lists the profiles that are certified for SAP HANA and SAP NetWeaver.
-
Select the SSH key that you want to add to the virtual server. For this step, you can create a new SSH key.
-
In the Data Volumes section, click Create. This will allow adding data disks to the provisioned VSI. Afterwards, these disks can be used for partitioning and storage management (File system distribution).
- For SAP HANA, these volumes must meet special KPI needs that are defined by SAP and are mandatory. For more information, see Storage specifications - Intel Virtual Server certified profiles for SAP HANA or Storage design considerations to learn these special needs and how you should configure the data volumes.
- For SAP NetWeaver, these volumes are based on the requirements of the installed SAP NetWeaver instance. The standard tiered options are 3K, 5K, and 10K IOPS, and custom IOPS. These options can be used to accommodate the specific requirements.
-
During Data Volume creation, the option Auto-delete can be enabled, if required. This will mark the data volume to be automatically deleted when the VSI itself will be deleted. Consider this option carefully.
Data volume sizes must be specified in GB and Profile and IOPS values need to be specified. More information on IOPS can be found under Block Storage for VPC profiles. Choose your preferred encryption method and click Create.
-
Under Networking, select the Virtual Private Cloud (VPC) to attach the virtual server.
-
By default, the virtual network interface option will be selected. This is the suggested option.
-
Under Network attachments, click Edit to change the Security Group, thus the Inbound/Outbound rules. This can also be done later, after the VSI is provisioned.
-
Review the costs for your VSI resource and click Create virtual server.