Network connectivity requirements for SAP workloads on Bare Metal Servers for VPC in IBM Cloud VPC

Key networking concepts for VPC

Understanding the following VPC networking concepts is essential for planning your SAP landscape:

• Virtual Private Cloud (VPC): An isolated network environment within IBM Cloud where you deploy your resources.
• Subnets: Subdivisions of your VPC's IP address range, associated with specific availability zones.
• Availability zones: Geographically dispersed locations within a region that provide fault tolerance and high availability.
• Address prefixes: IP address ranges assigned to availability zones within your VPC.
• Security groups: Instance-level firewalls that control inbound and outbound traffic for bare metal servers.
• Network access control Lists (ACLs): Subnet-level firewalls that control traffic entering and leaving subnets.
• Floating IPs: Public IPv4 addresses that can be assigned to bare metal servers for internet access.
• Public gateways: Enable outbound internet connectivity for an entire subnet.
• Virtual Private Endpoints (VPE): Private connectivity to IBM Cloud services without traversing the public internet.

Bare metal-specific networking features

Bare Metal Servers for VPC provide additional networking capabilities beyond standard virtual server instances:

• PCI network interfaces: Bare metal servers support PCI network interfaces that provide direct hardware access for enhanced performance. Each PCI interface connects directly to the physical network adapter.
• VLAN tagging: Support for IEEE 802.1Q VLAN tagging enables network segmentation at the interface level. You can create multiple VLAN interfaces on a single PCI interface.
• Multiple network interfaces: Bare metal servers can be configured with multiple network interfaces for traffic separation and redundancy. The number of supported interfaces depends on the server profile.
• Higher bandwidth: Bare metal servers support higher network bandwidth compared to virtual server instances, suitable for demanding SAP HANA workloads. Network bandwidth scales with the server profile, with high-end profiles supporting up to 100 Gbps.
• Consistent network performance: Direct hardware access eliminates virtualization overhead, providing predictable network performance.
• Jumbo frames: Support for jumbo frames (MTU up to 9000 bytes) enables more efficient data transfer for large payloads, beneficial for SAP HANA replication and backup operations.
• Allowed IP addresses: You can configure additional IP addresses on network interfaces beyond the primary IP, useful for hosting multiple SAP instances or implementing virtual IP addresses for high availability clusters.

Network interfaces on bare metal servers

Bare Metal Servers for VPC support multiple types of network interfaces, which you can use to separate different types of network traffic:

Connectivity within and between VPCs

Resources within the same VPC communicate through the private network by default, subject to security group and ACL rules. For multi-VPC SAP landscapes, use IBM Cloud Transit Gateway for Hub-spoke network topologies or VPC peering for simple two-VPC connections. For more information, see Interconnectivity for VPC.

Connectivity to on-premises networks

Connecting an SAP landscape on Bare Metal Servers for VPC to on-premises systems is essential for hybrid cloud scenarios. IBM Cloud VPC provides multiple connectivity options:

Connectivity to IBM Cloud services

Use Virtual Private Endpoint (VPE) for VPC to connect privately to IBM Cloud services such as Object Storage, Cloud Databases, or Key Protect, without traversing the public internet. VPE for VPC provides enhanced security, no bandwidth charges, and keeps traffic on the private network. For more information, see About Virtual Private Endpoints for VPC and End-to-end private connectivity using VPE.

Internet connectivity

Floating IPs

Assign public IPv4 addresses to specific bare metal servers for direct inbound and outbound internet access.

Public gateways

Enable outbound-only internet connectivity for all resources in a subnet (for example, for software updates and patches).

Security groups

Security groups act as virtual firewalls that control inbound and outbound traffic at the network interface level.

Key characteristics:

• Applied to network interfaces on bare metal servers.
• Stateful firewall (return traffic is automatically allowed).
• Rules specify allowed traffic (default deny).
• Support for IP addresses, CIDR blocks, and other security groups as sources/destinations.
• Multiple security groups can be applied to a single network interface.

Best practices for SAP workloads:

• Create separate security groups for different SAP tiers (application, database, management).
• Use the principle of least privilege (allow only required traffic).
• Reference other security groups in rules to simplify management.
• Document the purpose of each security group and rule.
• Regularly review and update security group rules.

Example security group strategy:

• SAP application tier: Allow traffic from load balancers and SAP routers, allow outbound to database tier.
• SAP database tier: Allow traffic only from application tier, restrict outbound traffic.
• Management tier: Allow SSH/RDP from specific IP ranges, allow outbound for monitoring and updates.

For more information, see Security in your VPC.

Network access control lists (ACLs)

Network ACLs provide subnet-level firewall capabilities that control traffic entering and leaving subnets.

Key characteristics:

• Applied at the subnet level.
• Stateless firewall (return traffic must be explicitly allowed).
• Rules specify both allowed and denied traffic.
• Rules are evaluated in order (lowest number first).
• Provide an additional layer of security beyond security groups.

Best practices for SAP workloads:

• Use network ACLs for broad traffic filtering at the subnet level.
• Use security groups for fine-grained control at the instance level.
• Ensure ACL rules allow required traffic for SAP operations.
• Consider using ACLs to enforce network segmentation policies.
• Test ACL changes carefully to avoid disrupting SAP operations.

Traffic segregation

Segregating different types of network traffic enhances security and performance for SAP workloads.

Recommended traffic segregation strategies:

Production traffic: Separate subnets and network interfaces for production SAP application and database traffic.

Management traffic: Dedicated subnet for administrative access (SSH, RDP, SAP GUI).

Backup traffic: Separate network interface or VLAN for backup operations to avoid impacting production traffic.

Replication traffic: Dedicated network path for SAP HANA system replication or database replication.

Storage traffic: Separate network interface for storage access (if using network-attached storage).

Implementation approaches:

• Use multiple subnets with different security groups and ACLs.
• Configure multiple network interfaces on bare metal servers.
• Use VLAN tagging to separate traffic on the same physical interface.
• Implement routing policies to control traffic flow between segments.

Bandwidth and throughput

Bare Metal Servers for VPC provide high network bandwidth suitable for demanding SAP workloads:

• Network bandwidth scales with the bare metal server profile.
• Higher-end profiles support up to 100 Gbps network bandwidth.
• Multiple network interfaces can be used to aggregate bandwidth.
• Network performance is consistent due to dedicated hardware.