Preparing IBM Power Virtual Server workspaces for SAP workloads

In this tutorial, you will learn how to create and configure an IBM® Power® Virtual Server workspace to host SAP workloads. This workspace provides the compute, network, and storage resources for your SAP HANA databases and SAP NetWeaver application servers.

Power Virtual Server infrastructure for SAP
Power Virtual Server infrastructure for SAP

Before you begin

Before you create a Power Virtual Server workspace, ensure that you meet the following prerequisites:

  • You have an IBM Cloud account with the permissions required to create Power Virtual Server resources
  • You completed the VPC infrastructure setup for management services
  • You have an SSH key pair ready for authentication to virtual server instances
  • You planned your network layout to avoid IP address conflicts between VPC and Power Virtual Server subnets

Understanding Power Virtual Server workspaces

A Power Virtual Server workspace is a regional environment that provides compute, network, and storage resources. Resources that you create in a workspace are isolated to that workspace. You cannot move or share these resources with other workspaces. Each workspace is associated with a single data center.

Deploy all SAP HANA and SAP application server instances within the designated Power Virtual Server workspace. The workspace connects to your VPC management services through IBM Cloud Transit Gateway, which enables secure communication between the two environments.

Colocated regions

Create the Power Virtual Server workspace in the same region as your IBM Cloud edge VPC. Power Virtual Server data centers are colocated with VPC regions to enable low-latency connectivity through IBM Cloud® Transit Gateway.

For the most current list of colocated regions and data centers, see Colocation of Power Virtual Server and VPC.

Create a Power Virtual Server workspace

Create a workspace in the same region as your VPC infrastructure.

  1. Log in to the IBM Cloud console.
  2. Navigate to Catalog > Compute > Power Virtual Server.
  3. Click Create.
  4. Enter a unique name for your workspace.
  5. Select the resource group where you want to create the workspace.
  6. Select the region and data center location that matches your VPC region.
  7. Review the pricing information.
  8. Click Create to provision the workspace.

Creating the workspace takes a few minutes. After the workspace is created, you can access it from the Power Virtual Server dashboard.

For more information, see Creating a Power Virtual Server workspace.

Create an SSH key

Create an SSH key in your workspace to authenticate to virtual server instances.

  1. Open the Power Virtual Server console and select your workspace.
  2. In the navigation menu, click SSH keys under Compute section.
  3. Click Create SSH key.
  4. Enter a unique name for the SSH key.
  5. Select the access level:
    • Account level: The key is visible across all workspaces in your account (traditional approach).
    • Workspace level: The key is restricted to this workspace only. This option is recommended for isolation.
  6. Optional: Add a description for the key.
  7. Paste your SSH public key in the SSH key field.
  8. Click Add SSH key.

SSH keys can exist at either the account level or the workspace level. Workspace-scoped keys provide isolation between environments and are restricted to a single workspace. This approach is recommended for production environments.

Create a private network subnet

Create a private network subnet for your SAP workloads.

  1. In your Power Virtual Server workspace, click Subnets in the navigation menu.
  2. Click Create subnet.
  3. Configure the subnet:
    • In the Name field, enter sap-net.
    • In the CIDR notation field, enter the subnet range, for example, 10.51.0.0/24.
    • Select Private as the subnet type.
    • Set MTU to 9000 to use jumbo frames for optimal performance.
    • Click Create subnet.

Always configure subnets with MTU 9000 to use jumbo frames for SAP workloads. This setting provides optimal network performance and is required for SAP HANA deployments.

Ensure that the IP address range for the Power Virtual Server subnet does not overlap with your VPC subnets or on-premises networks.

For more information, see Configuring and adding a private network subnet.

Connect workspace to IBM Cloud Transit Gateway

Connect your Power Virtual Server workspace to the IBM Cloud Transit Gateway to enable communication with VPC management services.

  1. Navigate to Interconnectivity > IBM Cloud Transit Gateway in the IBM Cloud console.
  2. Select your existing IBM Cloud Transit Gateway that was created during VPC setup, or create a new one.
  3. Click Add connection.
  4. Select Power Virtual Server as the network connection type.
  5. Select your region.
  6. Select your Power Virtual Server workspace from the list.
  7. Enter a name for the connection.
  8. Click Add to create the connection.

The connection may take a few minutes to become active. After the connection is established, you can ping the Power Virtual Server private network IP addresses from the access host that is deployed in VPC.

For more information, see Adding a connection.

Verify connectivity

Verify that you can reach the Power Virtual Server subnets from your VPC access host.

  1. Log in to your VPC access host:

    ssh -A -o ServerAliveInterval=60 -o ServerAliveCountMax=600 root@<access_host_floating_ip>

  2. Ping an IP address in your Power Virtual Server management subnet:

    ping <powervs_subnet_ip>

  3. If the ping is successful, the Transit Gateway connection is working correctly.

If you cannot reach the Power Virtual Server subnets, verify that the Transit Gateway connection is in Available state and that the subnets are configured correctly .

Optional: Configure network security groups

Network security groups provide an additional layer of security for your Power Virtual Server instances by controlling inbound and outbound traffic at the instance level. Network security groups are similar to security groups in VPC but are specific to Power Virtual Server.

Understanding network security groups

Network security groups allow you to do the following tasks:

  • Control traffic to and from individual Power Virtual Server instances
  • Define rules based on IP addresses, ports, and protocols
  • Apply different security policies to different instances in the same subnet
  • Enhance security by implementing defense-in-depth strategies

Create a IBM® Network Security Groups

  1. In your Power Virtual Server workspace, click Network security groups in the navigation menu.
  2. Click Create network security group.
  3. Enter a name for the security group, for example, sap-hana-nsg.
  4. Optional: Add a description.
  5. Click Create.

Add rules to a Network Security Groups

After you create the Network Security Groups, add inbound and outbound rules to control traffic.

  1. Select the network security group that you created.
  2. In the Inbound rules section, click Add rule.
  3. Configure the rule:
    • Protocol: Select TCP, UDP, ICMP, or All.
    • Port range: Specify the port or port range, for example, 22 for SSH, 3200-3299 for SAP.
    • Source: Enter the source IP address or CIDR block.
    • Description: Add a description for the rule.
  4. Click Add to create the rule.
  5. Repeat these steps to add additional inbound rules.
  6. Add outbound rules by following the same process in the Outbound rules section.

Example rules for SAP HANA:

Example Network Security Groups rules for SAP HANA
Direction Protocol Port range Source or destination Description
Inbound TCP 22 10.30.20.0/24 SSH from VPC management subnet
Inbound TCP 3200-3299 10.51.0.0/24 SAP instance communication
Inbound TCP 30013-30015 10.51.0.0/24 SAP HANA database ports
Outbound All All 0.0.0.0/0 Allow all outbound traffic

Optional: Configure network address groups

Network address groups simplify the management of network security group rules by allowing you to group IP addresses and CIDR blocks into reusable objects. Instead of specifying individual IP addresses in each rule, you can reference a network address group.

Understanding network address groups

Network address groups provide the following benefits:

  • Simplify network security group rule management by grouping related IP addresses
  • Enable reuse of address groups across multiple network security group rules
  • Simplify updates to security policies by modifying the network address groups instead of individual rules
  • Improve readability of security rules by using descriptive group names

Create a network address group

  1. In your Power Virtual Server workspace, click Network address groups in the navigation menu.
  2. Click Create network address group.
  3. Enter a name for the address group, for example, vpc-management-hosts.
  4. Optional: Add a description.
  5. Add IP addresses or CIDR blocks:
    • Click Add address.
    • Enter an IP address or CIDR block, for example, 10.30.20.0/24.
    • Optional: Add a description for the address.
    • Click Add
  6. Repeat these steps to add more addresses to the group.
  7. Click Create to save the network address group.

Use network address groups in network security group rules

After you create a network address group, you can reference it in your network security group rules.

  1. Navigate to Network security groups in your workspace.
  2. Select the network security group where you want to use the network address group.
  3. Click Add rule.
  4. Configure the rule:
    • Protocol: Select the protocol.
    • Port range: Specify the port or port range.
    • Source type: Select Network address group.
    • Source: Select the network address group from the dropdown list.
    • Description: Add a description.
  5. Click Add to create the rule.

Example network address groups for SAP environments:

Example network address groups for SAP environments
Network address group name IP addresses or CIDR blocks Purpose
vpc-management-hosts 10.30.20.0/24 VPC management subnet for SSH access
sap-application-servers 10.51.0.10, 10.51.0.11, 10.51.0.12 SAP application server instances
sap-hana-databases 10.51.0.20, 10.51.0.21 SAP HANA database instances
backup-servers 10.40.20.0/24 Backup network subnet

For more information, see Network address groups.

Next steps

After you complete the Power Virtual Server workspace setup, you can proceed with deploying SAP instances:

Terraform automation

Terraform automates all the preceding steps. The automation is available as a Deployable Architecture solution in the IBM Cloud catalog.

For more information, see GitHub repository solution Power Virtual Server Workspace.