Before you begin

Before you begin, ensure that you have:

• Completed the planning steps in Deploying infrastructure for SAP workloads on Power Virtual Server
• Sufficient IBM Cloud® Identity and Access Management (IAM) permissions to create and manage VPC resources
• An SSH key pair for authentication. For more information, see SSH keys
• A network design with non-overlapping IP address ranges for VPC subnets, Power Virtual Server networks, and on-premises networks

Create the VPC

Create a IBM Cloud VPC without default address prefixes to host the management services for your SAP landscape.

1. Log in to the IBM Cloud console.
2. Go to VPC Infrastructure > VPCs.
3. Click Create.
4. Enter a name for your VPC, such as sap-management-vpc.
5. Select a resource group.
6. Optionally, add tags for organization.
7. In the Default address prefixes section, clear the checkbox for Create a default prefix for each zone to prevent automatic creation of address prefixes.
8. Click Create virtual private cloud.

For detailed instructions, see Creating a VPC and subnet.

Create address prefixes

Create address prefixes that define the IP address ranges for your VPC. These prefixes are used when creating subnets.

The following table shows the recommended address prefixes:

1. In your VPC details page, go to Address prefixes.
2. Click Create.
3. Create the first address prefix for VPN services:
   • Enter a name, such as vpn-prefix.
   • Select an availability zone.
   • Enter an IP address range, such as 10.30.10.0/24.
   • Click Create.
4. Create the second address prefix for management services:
   • Enter a name, such as management-prefix.
   • Select an availability zone.
   • Enter an IP address range, such as 10.30.20.0/24.
   • Click Create.
5. Create the third address prefix for VPE services:
   • Enter a name, such as vpe-prefix.
   • Select an availability zone.
   • Enter an IP address range, such as 10.30.30.0/24.
   • Click Create.
6. Create the fourth address prefix for network services:
   • Enter a name, such as network-services-prefix.
   • Select an availability zone.
   • Enter an IP address range, such as 10.30.40.0/24.
   • Click Create.

Create subnets from address prefixes

Create subnets from the address prefixes you created. You need at least three subnets: one for VPN server, one for the access host, and one for network services.

The following table shows the recommended subnet layout:

1. In your VPC details page, go to Subnets.
2. Click Create.
3. Create the VPN subnet from the VPN address prefix:
   • Enter a name, such as vpn-subnet.
   • Select the same availability zone as the VPN address prefix.
   • Select the address prefix vpn-prefix (10.30.10.0/24).
   • Leave the public gateway detached.
   • Click Create subnet
4. Create the management subnet from the management address prefix:
   • Enter a name, such as management-subnet.
   • Select the same availability zone as the management address prefix.
   • Select the address prefix management-prefix (10.30.20.0/24).
   • Leave the public gateway detached.
   • Click Create subnet
5. Create the VPE subnet from the VPE address prefix:
   • Enter a name, such as vpe-subnet.
   • Select the same availability zone as the VPE address prefix.
   • Select the address prefix vpe-prefix (10.30.30.0/24).
   • Leave the public gateway detached.
   • Click Create subnet.
6. Create the network services subnet from the network services address prefix:
   • Enter a name, such as network-services-subnet.
   • Select the same availability zone as the network services address prefix.
   • Select the address prefix network-services-prefix (10.30.40.0/24).
   • Attach a public gateway to enable internet access for software updates.
   • Click Create subnet.

Configure security groups

Create security groups to control traffic to your virtual server instances, VPEs, and other resources. Security groups act as virtual firewalls that control inbound and outbound traffic.

Deploy the bastion or access host

Create a virtual server instance that serves as the access host (bastion) for your SAP landscape.

1. Go to VPC Infrastructure > Virtual server instances.
2. Click Create.
3. Configure the virtual server instance:
   • Enter a name, such as sap-access-host.
   • Select your VPC.
   • Select the management subnet.
   • Select a Linux operating system image (RHEL 8.4 or later, or SLES 15 SP3 or later).
   • Select the smallest profile (for example, nxf-1x2)
   • Add your SSH key.
4. In the Network interfaces section, click Edit on the primary network interface:
   • Deselect the default security group.
   • Select the management-sg security group.
   • Click Save.
5. Click Create virtual server instance.
6. Wait for the instance status to change to Running.

Enable floating IP for bastion or access host

Reserve and attach a floating IP address to the access host to enable external SSH access.

1. In the access host instance details page, go to Network interfaces.
2. Click Reserve next to Floating IP.
3. Configure the floating IP:
   • Enter a name, such as access-host-fip.
   • Click Reserve.
4. Note the floating IP address for SSH access.

For more information, see Reserving a floating IP address.

Verify access to the bastion/access host

Test SSH access to the access host using the floating IP address.

1. Open a terminal on your local machine.

2. Run the following SSH command (replace <access_host_floating_ip> with your floating IP address):

   ssh -A -o ServerAliveInterval=60 -o ServerAliveCountMax=600 root@<access_host_floating_ip>
   

3. Verify that you can successfully log in to the access host.

The ServerAliveInterval and ServerAliveCountMax parameters help maintain a stable SSH connection.

Deploy the network services host

Create a virtual server instance that provides essential network services to Power Virtual Server instances.

1. Go to VPC Infrastructure > Virtual server instances.
2. Click Create.
3. Configure the virtual server instance:
   • Enter a name, such as sap-network-services.
   • Select your VPC.
   • Select the network services subnet.
   • Select a Linux operating system image (RHEL 9.4 or later).
   • Select a profile with at least 2 vCPUs and 4 GB memory.
   • Add your SSH key.
4. In the Network interfaces section, click Edit on the primary network interface:
   • Deselect the default security group.
   • Select the network-services-sg security group.
   • Click Save.
5. Click Create virtual server instance.
6. Wait for the instance status to change to Running.

Verify access to the network services host

Test SSH access to the network services host through the access host.

1. Open a terminal on your local machine.

2. Run the following SSH command (replace <access_host_floating_ip> and <network_services_host_private_ip> with your IP addresses):

   ssh -A -o ServerAliveInterval=60 -o ServerAliveCountMax=600 -o ProxyCommand="ssh -W %h:%p root@<access_host_floating_ip>" root@<network_services_host_private_ip>
   

3. Verify that you can successfully log in to the network services host.

Create Virtual Private Endpoint for IBM Cloud Object Storage

Create a Virtual Private Endpoint (VPE) for IBM Cloud Object Storage to enable secure, private access to Cloud Object Storage from your VPC and Power Virtual Server instances.

1. In the IBM Cloud console, go to VPC Infrastructure > Virtual private endpoints.
2. Click Create.
3. Configure the VPE gateway:
   • Enter a name, such as cos-vpe.
   • Select your VPC.
   • Select your resource group.
4. In the Service section:
   • For Service category, select Cloud Object Storage.
   • For Service offering, select Cloud Object Storage.
   • The service endpoint will be automatically populated.
5. In the Reserved IP section:
   • Click Attach to attach a reserved IP.
   • Select the vpe-subnet that you created earlier.
   • Select Auto-assign to automatically assign an IP address from the subnet.
   • Click Attach.
6. In the Security groups section:
   • Deselect the default security group.
   • Select the vpe-sg security group that you created earlier.
7. Click Create virtual private endpoint.
8. Wait for the VPE status to change to Stable.
9. Note the reserved IP address assigned to the VPE. This IP address will be used to access Cloud Object Storage from your Power Virtual Server instances.

For more information about Virtual Private Endpoints, see About Virtual Private Endpoints for VPC.

Configure SQUID proxy server

Configure the SQUID proxy server to enable Power Virtual Server instances to access the internet for software updates and package installations.

You can use the ibm.power_linux_sap Ansible collection to automate this configuration. For more information, see the Ansible automation section at the end of this tutorial.

1. Log in to the network services host using the SSH command from the previous step.
2. Install SQUID:

   yum update -y && yum install -y squid
   

3. Replace the contents of /etc/squid/squid.conf with the contents from SQUID configuration file.
4. Enable and start the SQUID service:

   systemctl enable squid
   systemctl restart squid
   systemctl status squid
   

Configure NTP service

Configure the NTP service to ensure time synchronization across all systems in your SAP landscape.

1. Log in to the network services host.
2. Install chrony:

   yum update -y && yum install -y chrony
   

3. Edit /etc/chrony.conf and add the following lines (replace <pvs_mgmt_cidr> with your Power Virtual Server management network CIDR, such as 10.51.0.0/24):

   local stratum 10
   manual
   allow <pvs_mgmt_cidr>
   

4. Enable and start the chrony service:

   systemctl enable chronyd
   systemctl start chronyd
   systemctl status chronyd
   

Configure DNS services

Configure DNS services for name resolution. You can choose between using IBM Cloud DNS service or configuring a DNS forwarder.

Automate with Ansible (optional)

You can automate the configuration of network services using the ibm.power_linux_sap Ansible collection.

1. Install the Ansible collection:

   ansible-galaxy collection install ibm.power_linux_sap
   

2. Update the variable file playbook/vars/sample-variables-configure-network-services-host.yml:

   server_config: {
     squid: { enable: true },
     ntp: { enable: true },
     dns: { enable: true, dns_servers: "161.26.0.7; 161.26.0.8; 9.9.9.9;" }
   }
   

3. Run the Ansible playbook:

   ansible-playbook --connection=local -i "localhost," playbooks/sample-configure-network-services-host.yml
   

Next steps

After you complete the VPC infrastructure setup, proceed with creating the Power Virtual Server workspace:

• Preparing Power Virtual Server workspaces for SAP workloads

Alternatively, you can use the automated Deployable Architecture solution available in the IBM Cloud catalog to deploy the complete VPC landing zone using Terraform and Ansible. For more information, see Deploying the VPC landing zone for Power Virtual Server.