Automated VM deployment for SAP NetWeaver on Linux

This guide uses Cloud Deployment Manager to deploy all of the required Google Cloud Platform resources to run SAP NetWeaver on Linux, including the Compute Engine virtual machine (VM), the Linux operating system, and the persistent disks. You define the values for the installation, such as machine type, resource names, disk sizes, and so forth, in a Cloud Deployment Manager configuration file template.

If your SAP NetWeaver installation requires more control over the deployment process than the Cloud Deployment Manager template provides, see Manual VM deployment for SAP NetWeaver on Linux.

To deploy a VM that is running Windows, see the Windows Deployment Guide.

VM configuration deployed by these instructions

The VM that is deployed by these instructions is for use in a 3-tier configuration, where SAP NetWeaver runs on one VM and the database server runs on another.

To set up a 2-tier configuration, where SAP NetWeaver runs on the same VM as the database server, you deploy the database server first and create the VM and the required disk drives for both the database server and for SAP NetWeaver at that time. You then install SAP NetWeaver on the same VM as the database server.

For instructions about deploying the VM for a database server, see the database deployment guide for your database server.

GCP resources deployed by these instructions

The GCP resources that are deployed by Cloud Deployment Manager include:

  • A VM that uses an SAP-certified version of Linux.
  • A persistent disk for the boot disk.
  • A persistent disk for SAP binaries.
  • A persistent disk for swap space.
  • The recommended APIs.
  • Google's monitoring agent.

The following instructions use Cloud Shell, but if you prefer, you can use the Cloud SDK in your local terminal instead.

For more details on planning your implementation, see the Planning Guide. For an overview of IT ops for your system, see the Operations Guide.

Creating a project

To create a project:

  1. Sign in to your Google Account.

    If you don't already have one, sign up for a new account.

  2. Select or create a GCP project.

    Go to the Manage resources page

  3. Make sure that billing is enabled for your project.

    Learn how to enable billing

Configuring the gcloud command environment

These instructions use Cloud Shell to enter gcloud commands that deploy or configure your GCP resources. Cloud Shell is accessed through the GCP console in your browser.

Cloud Shell runs on a VM that GCP provisions each time you start Cloud Shell. The first time you use Cloud Shell, GCP also creates a persistent $HOME directory for you, which is restored each time you open Cloud Shell.

The provisioned VM includes the latest Cloud SDK, which provides the gcloud command-line interface. Therefore, the gcloud commands that you use in Cloud Shell are the same as those you would use in a locally installed instance of the Cloud SDK.

If you have the Cloud SDK installed, you can issue the gcloud commands that are used in these instructions from your local machine. However, with a locally installed Cloud SDK you must always make sure that you are using the latest version of the Cloud SDK.

Whether you use Cloud Shell or Cloud SDK, you can can set and change the properties of your gcloud command environment and save them as a configuration. Configurations are collections of key-value pairs that influence the behavior of the gcloud commands.

Some basic actions you can take with a configuration in Cloud Shell include:

  • Initialize a configuration with gcloud init

  • Check the settings of your current gcloud configuration with gcloud config list

  • Change the GCP project you are working in with gcloud config set project [PROJECT_ID]

  • Set a default region with gcloud config set compute/region [REGION]

  • Set a default zone with gcloud config set compute/zone [ZONE]

  • Create a new configuration with gcloud config configurations create [NAME]

For more information about working with configurations, see Managing SDK Configurations.

Creating a network

When you create a project, a default network is created for your project. However, for security purposes, you should create a new network and specify firewall rules to control who has access.

  1. Go to Cloud Shell.

    OPEN Cloud Shell

  2. Create a new network in the custom subnetworks mode:

    gcloud compute networks create [YOUR_NETWORK_NAME] --subnet-mode custom

    where:

    • [YOUR_NETWORK_NAME] is the name of the new network. The network name can contain only lowercase characters, digits, and the dash character (-).

    Make sure to specify the custom flag instead of using an automatic subnetwork. An automatic subnetwork always has the same assigned IP address range, which can cause issues if you have multiple subnetworks and want to use VPN.

  3. Create a subnetwork, and specify the region and IP range:

    gcloud compute networks subnets create [YOUR_SUBNETWORK_NAME] \
          --network [YOUR_NETWORK_NAME] --region [YOUR_REGION] --range [YOUR_RANGE]

    where:

    • [YOUR_SUBNETWORK_NAME] is the new subnetwork.
    • [YOUR_NETWORK_NAME] is the name of the network you created in the previous step.
    • [REGION] is the region where you want the subnetwork. Use a region that is supported for SAP NetWeaver.
    • [YOUR_RANGE] is the IP address range, specified in CIDR format, such as 10.1.0.0/24. If you plan to add more than one subnetwork, assign non-overlapping CIDR IP ranges for each subnetwork in the network. Note that each subnetwork and its internal IP ranges are mapped to a single region.
  4. Optionally, repeat the previous step and add additional subnetworks.

Setting up a NAT gateway

If you intend to create a VM without a public IP address, you must create a NAT gateway so that your VM can access the internet to download Google's monitoring agent. If you intend to assign an external public IP address to your VM, you can skip this procedure.

  1. Create a VM to act as the NAT gateway in the subnet you just created:

    gcloud compute instances create [YOUR_VM_NAME] --can-ip-forward \
        --zone [YOUR_ZONE] --image-family [YOUR_IMAGE_FAMILY] \
        --image-project [YOUR_IMAGE_PROJECT] --machine-type=[YOUR_MACHINE_TYPE] \
        --subnet [YOUR_SUBNETWORK_NAME] \
        --metadata startup-script="sysctl -w net.ipv4.ip_forward=1; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE" \
        --tags [YOUR_VM_TAG]

    where:

    • [YOUR_VM_NAME] is the name of the VM you are creating that you want to use for the NAT gateway.
    • [YOUR_ZONE] is the zone where you want the VM.
    • [YOUR_IMAGE_FAMILY] and [YOUR_IMAGE_PROJECT] specify the image you want to use for the NAT gateway VM. If you are using SUSE Linux Enterprise Server (SLES) for your SAP NetWeaver components, you must specify a SLES VM for your gateway as well. However, if you are using Red Hat Enterprise Linux (RHEL), then you don't have to select a premium image for your gateway. For example, to select the latest version of Debian, specify --image-family debian and --image-project debian-cloud.
    • [YOUR_MACHINE_TYPE] is any supported machine type. If you expect high network traffic, choose a machine type with that has at least 8 virtual CPUs.
    • [YOUR_SUBNETWORK_NAME] is the name of the subnetwork where you want the VM.
    • [YOUR_VM_TAG] is the tag that is applied to the VM you are creating. If you will also use this VM as a bastion host, this tag is used to apply the firewall rule only to this VM.
  2. Create a route that is tagged so that traffic passes through the NAT VM instead of the default internet gateway:

    gcloud compute routes create [YOUR_ROUTE_NAME] --network [YOUR_NETWORK_NAME] \
         --destination-range 0.0.0.0/0 --next-hop-instance [YOUR_VM_NAME] \
         --next-hop-instance-zone [YOUR_ZONE] --tags [YOUR_TAG_NAME] --priority 800

    where:

    • [YOUR_ROUTE_NAME] is the name of the route you are creating.
    • [YOUR_NETWORK_NAME] is the network you created.
    • [YOUR_VM_NAME] is the VM you are using for your NAT gateway.
    • [YOUR_ZONE] is the zone where the VM is located.
    • [YOUR_TAG_NAME] is the tag on the route that directs traffic through the NAT VM.
  3. If you also want to use the NAT Gateway VM as a bastion host, run the following command to allow inbound SSH access to this instance from the internet:

    gcloud compute firewall-rules create allow-ssh --network [YOUR_NETWORK_NAME] \
          --allow tcp:22 --source-ranges 0.0.0.0/0 --target-tags "[YOUR_VM_TAG]"

    where:

    • [YOUR_NETWORK_NAME] is the network you created.
    • [YOUR_VM_TAG] is the tag you specified when you created the NAT gateway VM. This tag is used so this firewall rule applies only to the VM that hosts the NAT gateway, and not to all VMs in the network.

Adding firewall rules

By default, incoming connections from outside your GCP network are blocked. To allow incoming connections, set up a firewall rule for your VM. Firewall rules regulate only new incoming connections to a VM. After a connection is established with a VM, traffic is permitted in both directions over that connection.

You can create a firewall rule to allow access to specified ports, or to allow access between VMs on the same subnetwork.

Create firewall rules to allow access for such things as:

  • The default ports used by SAP NetWeaver, as documented in TCP/IP Ports of All SAP Products.
  • Connections from your computer or your corporate network environment to your Compute Engine VM instance. If you are unsure of what IP address to use, talk to your company's network administrator.
  • Communication between VMs in a 3-tier or scaleout configuration. For example, if you are deploying a 3-tier system, you will have at least 2 VMs in your subnetwork: the VM for SAP NetWeaver, and another VM for the database server. To enable communication between the two VMs, you must create a firewall rule to allow traffic that originates from the subnetwork.
  • SSH connections to your VM instance, including SSH from the browser, through port 22.
  • Connections to your VM instance from third-party tools, such as a local terminal or PuTTY. Create a rule to allow access for the tool through your firewall. For more information, see Connecting using third-party tools.

To create a firewall rule:

  1. In the GCP Console, go to the Firewall Rules page.

    OPEN FIREWALL RULES

  2. At the top of the page, click Create firewall rule.

    • In the Network field, select the network where your VM is located.
    • In the Targets field, select All instances in the network.
    • In the Source filter field, select one of the following:
      • IP ranges to allow incoming traffic from specific IP addresses. Specify the range of IP addresses in the Source IP ranges field.
      • Subnets to allow incoming traffic from a particular subnetwork. Specify the subnetwork name in the following subnets field. You can use this option to allow access between the VMs in a 3-tier or scaleout configuration.
    • In the Protocols and ports section, select Specified protocols and ports and specify tcp:[PORT_NUMBER];.
  3. Click Create to create your firewall rule.

Deploying a Linux VM for SAP NetWeaver with Cloud Deployment Manager

The following instructions use Google Cloud Platform Console, Cloud Shell, and Cloud Deployment Manager to deploy a VM instance with Linux and all of the persistent disks that SAP NetWeaver requires.

About Cloud Deployment Manager

You define the resource options for your installation in a Cloud Deployment Manager configuration file template.

Cloud Deployment Manager treats all of the resources that are created for your SAP system as a single entity called a deployment. You can view and work with all of the deployments for your project on the Deployments page in the GCP Console.

Be aware of the following behaviors when using Cloud Deployment Manager:

  • Deleting a deployment deletes all of the resources associated with the deployment, including the VMs, the persistent disks, and any SAP systems that are installed on the VM.
  • By default, Cloud Deployment Manager uses the ACQUIRE resource creation policy. If you specify a VM name that is already in use by another VM in your project, Cloud Deployment Manager does not create a new VM, but instead adds the existing VM to your new deployment. If your original VM was created by a previous run of Cloud Deployment Manager, the VM will be associated with two deployments.

    If you then delete the new deployment, the acquired VM is deleted from the deployment that originally created it. To avoid such a scenario, either set the Cloud Deployment Manager resource policy to CREATE, or make sure that you use unique resource names in your new deployment.

    For information about the policies you can use while creating resources with Cloud Deployment Manager and how to specify them, see the Deployment Manager documentation.

Deployment procedure

  1. Open Cloud Shell.

    Go to Cloud Shell

  2. Download the template.yaml configuration file template to your working directory:

    wget https://storage.googleapis.com/sapdeploy/dm-templates/sap_nw/template.yaml

  3. Optionally, rename the template.yaml file to identify the configuration it defines. For example, nw-sles12sp3.yaml.

  4. Open the template.yaml file in Cloud Shell code editor.

    To open Cloud Shell code editor, click the pencil icon in the upper right corner of Cloud Shell terminal window.

  5. In the template.yaml file, update the following property values by replacing the brackets and their contents with the values for your installation.

    Property Data type Description
    instanceName String The name of the VM instance on which SAP NetWeaver will be installed. The name must be 13 characters or less and be specified in lowercase letters, numbers, or hyphens. Use a name that is unique within your project.
    instanceType String The type of Compute Engine virtual machine on which SAP NetWeaver will be installed. For more information about the VMs that SAP NetWeaver supports, see the SAP NetWeaver Planning Guide.
    zone String The zone in which you are deploying your SAP NetWeaver. It must be in the same region that you selected for your subnetwork.
    subnetwork String The name of the subnetwork that you created in a previous step. If you are deploying to a shared VPC, specify this value as [SHAREDVPC_PROJECT]/[SUBNETWORK]. For example, myproject/network1.
    linuxImage String The name of the Linux operating-system image or image family that you are using with SAP NetWeaver. To specify an image family, add the prefix family/ to the family name. For example, family/rhel-7-sap-hana. For the list of available image families, see the Images page in the GCP Console.
    linuxImageProject String The GCP project that contains the image you are going to use. This project might be your own project or a GCP image project, such as rhel-sap-cloud or suse-sap-cloud. For a list of GCP image projects, see the Images page in the Compute Engine documentation.
    usrsapSize Integer The size of the /usr/sap disk. The minimum size is 8 GB. If omitted or set to 0, no disk is created.
    sapmntSize Integer The size of the /sapmnt disk. The minimum size is 8 GB. If omitted or set to 0, no disk is created.
    swapSize Integer The size of the swap volume. The minimum size is 1 GB. If omitted or set to 0, no disk is created.
    networkTag String Optional. A network tag that represents your VM instance for firewall or routing purposes. If you specify publicIP: No and do not specify a network tag, be sure to provide another means of access to the internet.
    publicIP Boolean Optional. Determines whether a public IP address is added to your VM instance. The default is Yes.
    sap_deployment_debug Boolean Optional. If this value is set to Yes, the deployment generates verbose deployment logs. Do not turn this setting on unless a Google support engineer asks you to enable debugging.

    The following configuration file creates a VM that is configured to run SAP NetWeaver. The configuration file directs Cloud Deployment Manager to deploy the n1-standard-16 VM that is running a SLES 12 SP2 operating system. The VM includes all of the directories that are required in order to run SAP NetWeaver.

    imports:
     - path: https://storage.googleapis.com/sapdeploy/dm-templates/sap_nw/sap_nw.py

    resources: - name: sap_nw type: https://storage.googleapis.com/sapdeploy/dm-templates/sap_nw/sap_nw.py properties: instanceName: ex-vm-nw-lin instanceType: n1-standard-16 zone: us-central1-f subnetwork: example-sub-network-sap linuxImage: family/sles-12-sp2-sap linuxImageProject: suse-sap-cloud usrsapSize: 15 sapmntSize: 15 swapSize: 24

  6. Create the VM instance:

    gcloud deployment-manager deployments create [DEPLOYMENT-NAME] --config [TEMPLATE-NAME].yaml

    The above command invokes the Cloud Deployment Manager, which deploys the VM according to the specifications in your template.yaml file. The process may take a few minutes. To check the progress of your deployment, follow the steps in the next section.

  7. After the VM instance deploys, if you need Compute Engine to save the boot disk in the event the VM instance is deleted:

    1. Go to VM instances in the GCP Console.
    2. Open VM instance details for your VM instance by clicking the name of the VM instance.
    3. Under Boot disk and local disks, deselect Delete boot disk when instance is deleted.

Verifying deployment

The following steps use Logging, which might incur charges. For more information, see Stackdriver pricing.

  1. Open Stackdriver Logging to check for errors and monitor the progress of the installation.

    Go to Logging

  2. On the Resources tab, select Global as your logging resource. If INSTANCE DEPLOYMENT COMPLETE is displayed for a VM, Cloud Deployment Manager processing is complete for the VM.

    Logging display

  3. After the VM instance deploys, connect to your VM by using SSH.

    1. If you have not already done so, create a firewall rule to allow an SSH connection on port 22.
    2. From the Compute Engine VM instances page, you can click the SSH button for your VM instance, or you can use your preferred SSH method.

    SSH button on Compute Engine VM instances page.

  4. Change to the root user.

    sudo su -

  5. At the command prompt, enter df -h. Ensure that you see output similar to the following, such as the //sybase/[DBSID]/sapdata directory.

    Data volumes created by the script.

  6. Confirm that the swap directory was created:

    cat /proc/meminfo | grep Swap

    You should see results similar to the following example:

    Example of terminal output when the swap directory exits.

If any of the validation steps show that the installation failed:

  1. Correct the error.
  2. On the Deployments page, delete the deployment to clean up the VMs and persistent disks from the failed installation.
  3. Rerun your deployment.

Connecting to your VM

If you have defined a firewall rule that allows access on port 22, you can connect to a Linux VM using common SSH tools.

GCP provides two easy connection methods. You can connect with a click of a button through the GCP Console or you can connect from a terminal by using a gcloud command.

Console

To SSH directly from your web browser in the Google Cloud Platform Console:

  1. In the GCP Console, go to the VM Instances page.

    Go to the VM Instances page

  2. In the list of virtual machine instances, click SSH in the row of the instance that you want to connect to.

gcloud

The gcloud command-line tool manages your SSH keys for you by generating and applying new project-wide SSH keys when you need them.

Connect to your VM instance:

gcloud compute --project "[VM-GCP-PROJECT]" ssh --zone "[VM-ZONE]" "[VM-NAME]"

where:

  • [VM-CGP-PROJECT] is the name of the GCP project in which you have created your VM.
  • [VM-ZONE] is the zone in which you have located your VM
  • [VM-NAME] is the name of your VM instance

After you submit this command, the terminal is connected to your VM on GCP and you can run commands on your Linux VM. When you are done, use the exit command to disconnect from the VM.

You can also generate a new key-pair for your Linux VM and apply it to your project, which allows you to connect using third-party tools such as PuTTY on Windows workstations. For more details, see Creating a new SSH key pair.

Other connection options, which are not discussed here, are also possible.

For more detailed information about connecting to a Linux VM on GCP, see Connecting to Linux instances.

Setting up the database

If you have not yet deployed your database on GCP, follow the instructions for setting up your database in both the GCP deployment guide for your database, and in the database documentation that is provided by your database vendor.

GCP provides deployment guides for the following SAP-certified databases:

When SAP NetWeaver and the database server are running on different VMs in a 3-tier architecture, make sure that your firewall rules are defined to allow communication between the VMs.

Installing the Stackdriver Logging agent

The Stackdriver Logging agent provides you with a solution for GCP system-activity logging, including operating system events and, if you are using SAP HANA, SAP HANA events. The Stackdriver Logging agent is an optional but recommended component. See the SAP NetWeaver on GCP Operations Guide for more information about GCP logging.

To install the Stackdriver Logging agent in your new VM, see the instructions for Linux and Windows in Installing the Agent.

Installing SAP NetWeaver

For instructions on installing SAP NetWeaver on your new VM, see the SAP help portal and the SAP NetWeaver Master Guide.

After you install SAP NetWeaver:

  1. Update the SAP kernel to the minimum supported patch level.

    For details on the supported SAP kernel patch levels, see SAP Note 2446441 - Linux on Google Cloud Platform (IaaS): Adaptation of your SAP License.

  2. Install your permanent SAP NetWeaver license.

    For more information from SAP about managing your SAP NetWeaver licenses, see SAP Licensing Procedure.

Installing the SAP Host Agent

The SAP Host Agent has been enhanced for running on GCP. Ensure that you run at least the minimum SAP Host Agent version required for the GCP environment.

For details, refer to the following SAP Notes:

Validating your installation of the monitoring agent

After you have deployed a VM and installed SAP NetWeaver, validate that Google's monitoring agent is functioning properly with SAP's enhanced monitoring.

Verifying that Google's monitoring agent is running

You can check whether the monitoring agent is running by polling for a health check from the server. Follow these steps:

  1. In the GCP Console, open Cloud Shell.

    OPEN CLOUD SHELL

  2. Connect to the VM instance you want to monitor. For details on how to connect, see Connecting to your VM.

  3. At the command prompt, enter the following command:

    curl http://localhost:18181/health

If the monitoring agent is functioning properly, the value for status should be UP. For example:

{"status":"UP","diskSpace":{"status":"UP","total":105552769024,"free":103920615424,"threshold":10485760}}

If the monitoring agent isn't running, see the Operations Guide section about restarting Google's monitoring agent.

Verifying that SAP NetWeaver is receiving metrics

To check whether the connection between Google's monitoring agent and SAP NetWeaver works as intended, enter transaction ST06 in your SAP NetWeaver ABAP system. In the overview pane, check the availability and content of the following fields for the correct end-to-end setup of the SAP and Google monitoring infrastructure:

  • Cloud Provider: Google Cloud Platform
  • Enhanced Monitoring Access: TRUE
  • Enhanced Monitoring Details: ACTIVE

Troubleshooting

This section contains information about how to correct common issues.

Troubleshooting communication problems to the database server

If you are setting up a 3-tier SAP system and having connection issues between your VMs, ensure that you have created a firewall rule to allow traffic between VMs on your subnetwork.

Troubleshooting connecting to your VM

If you are having issues connecting to your VM through SSH, ensure that you have created a firewall rule to open port 22 on the GCP network you are using.

For other possible issues, see Known issues for SSH from the browser.

Troubleshooting Google's monitoring agent

To troubleshoot the monitoring agent, see the Operations Guide.

Was this page helpful? Let us know how we did:

Send feedback about...