Manual VM deployment for SAP NetWeaver on Windows

This guide shows you how to manually deploy and connect to a VM that is configured to run SAP NetWeaver on Microsoft Windows Server-based systems on Google Cloud Platform (GCP). To deploy a VM that is running Linux, see the Linux Deployment Guide.

These instructions give you the details for setting up a 2-tier system, with all the SAP components and the database running on a single VM. During deployment, you also install Google's monitoring agent and can validate that it is sending metrics to SAP. This guide also includes considerations for migrating an existing system and for setting up a 3-tier scale-out system.

For more details on planning your implementation, see the Planning Guide. For an overview of IT ops for your system, see the Operations Guide.

Creating a project

To create a project:

  1. Sign in to your Google Account.

    If you don't already have one, sign up for a new account.

  2. Select or create a GCP project.

    Go to the Manage resources page

  3. Make sure that billing is enabled for your project.

    Learn how to enable billing

Configuring the gcloud command environment

These instructions use Cloud Shell to enter gcloud commands that deploy or configure your GCP resources. Cloud Shell is accessed through the GCP console in your browser.

Cloud Shell runs on a VM that GCP provisions each time you start Cloud Shell. The first time you use Cloud Shell, GCP also creates a persistent $HOME directory for you, which is restored each time you open Cloud Shell.

The provisioned VM includes the latest Cloud SDK, which provides the gcloud command-line interface. Therefore, the gcloud commands that you use in Cloud Shell are the same as those you would use in a locally installed instance of the Cloud SDK.

If you have the Cloud SDK installed, you can issue the gcloud commands that are used in these instructions from your local machine. However, with a locally installed Cloud SDK you must always make sure that you are using the latest version of the Cloud SDK.

Whether you use Cloud Shell or Cloud SDK, you can can set and change the properties of your gcloud command environment and save them as a configuration. Configurations are collections of key-value pairs that influence the behavior of the gcloud commands.

Some basic actions you can take with a configuration in Cloud Shell include:

  • Initialize a configuration with gcloud init

  • Check the settings of your current gcloud configuration with gcloud config list

  • Change the GCP project you are working in with gcloud config set project [PROJECT_ID]

  • Set a default region with gcloud config set compute/region [REGION]

  • Set a default zone with gcloud config set compute/zone [ZONE]

  • Create a new configuration with gcloud config configurations create [NAME]

For more information about working with configurations, see Managing SDK Configurations.

Creating a network

When you create a project, a default network is created for your project. However, for security purposes, you should create a new network and specify firewall rules to control who has access.

  1. Go to Cloud Shell.

    OPEN CLOUD SHELL

  2. Create a new network in the custom subnetworks mode:

    gcloud compute networks create [YOUR_NETWORK_NAME] --subnet-mode custom

    where:

    • [YOUR_NETWORK_NAME] is the name of the new network. The network name can contain only lowercase characters, digits, and the dash character (-).

    Make sure to specify the custom flag instead of using an automatic subnetwork. An automatic subnetwork always has the same assigned IP address range, which can cause issues if you have multiple subnetworks and want to use VPN.

  3. Create a subnetwork, and specify the region and IP range:

    gcloud compute networks subnets create [YOUR_SUBNETWORK_NAME] \
          --network [YOUR_NETWORK_NAME] --region [YOUR_REGION] --range [YOUR_RANGE]

    where:

    • [YOUR_SUBNETWORK_NAME] is the new subnetwork.
    • [YOUR_NETWORK_NAME] is the name of the network you created in the previous step.
    • [REGION] is the region where you want the subnetwork. Use a region that is supported for SAP NetWeaver.
    • [YOUR_RANGE] is the IP address range, specified in CIDR format, such as 10.1.0.0/24. If you plan to add more than one subnetwork, assign non-overlapping CIDR IP ranges for each subnetwork in the network. Note that each subnetwork and its internal IP ranges are mapped to a single region.
  4. Optionally, repeat the previous step and add additional subnetworks.

Setting up a NAT gateway

If you intend to create a VM without a public IP address, you must create a NAT gateway so that your VM can access the internet to download Google's monitoring agent. If you intend to assign an external public IP address to your VM, you can skip this procedure.

  1. Create a VM to act as the NAT gateway in the subnet you just created:

    gcloud compute instances create [YOUR_VM_NAME] --can-ip-forward \
        --zone [YOUR_ZONE] --image-family [YOUR_IMAGE_FAMILY] \
        --image-project [YOUR_IMAGE_PROJECT] --machine-type=[YOUR_MACHINE_TYPE] \
        --subnet [YOUR_SUBNETWORK_NAME] \
        --metadata startup-script="sysctl -w net.ipv4.ip_forward=1; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE" \
        --tags [YOUR_VM_TAG]

    where:

    • [YOUR_VM_NAME] is the name of the VM you are creating that want to use for the NAT gateway.
    • [YOUR_ZONE] is the zone where you want the VM.
    • [YOUR_IMAGE_FAMILY] and [YOUR_IMAGE_PROJECT] specify the image you want to use for the NAT gateway VM.
    • [YOUR_MACHINE_TYPE] is any supported machine type. If you expect high network traffic, choose a machine type with that has at least 8 virtual CPUs.
    • [YOUR_SUBNETWORK_NAME] is the name of the subnetwork where you want the VM.
    • [YOUR_VM_TAG] is the tag that is applied to the VM you are creating. If you will also use this VM as a bastion host, this tag is used to apply the firewall rule only to this VM.
  2. Create a route that is tagged so that traffic passes through the NAT VM instead of the default internet gateway:

    gcloud compute routes create [YOUR_ROUTE_NAME] --network [YOUR_NETWORK_NAME] \
         --destination-range 0.0.0.0/0 --next-hop-instance [YOUR_VM_NAME] \
         --next-hop-instance-zone [YOUR_ZONE] --tags [YOUR_TAG_NAME] --priority 800

    where:

    • [YOUR_ROUTE_NAME] is the name of the route you are creating.
    • [YOUR_NETWORK_NAME] is the network you created.
    • [YOUR_VM_NAME] is the VM you are using for your NAT gateway.
    • [YOUR_ZONE] is the zone where the VM is located.
    • [YOUR_TAG_NAME] is the tag on the route that directs traffic through the NAT VM.
  3. If you also want to use the NAT Gateway VM as a bastion host, run the following command to allow inbound SSH access to this instance from the internet:

    gcloud compute firewall-rules create allow-ssh --network [YOUR_NETWORK_NAME] \
          --allow tcp:22 --source-ranges 0.0.0.0/0 --target-tags "[YOUR_VM_TAG]"

    where:

    • [YOUR_NETWORK_NAME] is the network you created.
    • [YOUR_VM_TAG] is the tag you specified when you created the NAT gateway VM. This tag is used so this firewall rule applies only to the VM that hosts the NAT gateway, and not to all VMs in the network.

Adding firewall rules

By default, incoming connections from outside your GCP network are blocked. To allow incoming connections, set up a firewall rule for your VM. Firewall rules regulate only new incoming connections to a VM. After a connection is established with a VM, traffic is permitted in both directions over that connection.

You can create a firewall rule to allow access to specified ports, or to allow access between VMs on the same subnetwork.

Create firewall rules to allow access for such things as:

  • The default ports used by SAP NetWeaver, as documented in TCP/IP Ports of All SAP Products.
  • Connections from your computer or your corporate network environment to your Compute Engine VM instance. If you are unsure of what IP address to use, talk to your company's network administrator.
  • Communication between VMs in a 3-tier or scaleout configuration. For example, if you are deploying a 3-tier system, you will have at least 2 VMs in your subnetwork: the VM for SAP NetWeaver, and another VM for the database server. To enable communication between the two VMs, you must create a firewall rule to allow traffic that originates from the subnetwork.
  • RDP connections to your VM instance through port 3389.
  • PowerShell connections to your VM instance through port 5986.

To create a firewall rule:

  1. In the GCP Console, go to the Firewall Rules page.

    OPEN FIREWALL RULES

  2. At the top of the page, click Create firewall rule.

    • In the Network field, select the network where your VM is located.
    • In the Targets field, select All instances in the network.
    • In the Source filter field, select one of the following:
      • IP ranges to allow incoming traffic from specific IP addresses. Specify the range of IP addresses in the Source IP ranges field.
      • Subnets to allow incoming traffic from a particular subnetwork. Specify the subnetwork name in the following subnets field. You can use this option to allow access between the VMs in a 3-tier or scaleout configuration.
    • In the Protocols and ports section, select Specified protocols and ports and specify tcp:[PORT_NUMBER];.
  3. Click Create to create your firewall rule.

Deploying a VM manually

The following instructions show you how to deploy a VM for an example 2-tier SAP system running Microsoft Windows and Microsoft SQL Server, SAP ASE, or IBM Db2 for Linux, UNIX, and Windows (IBM Db2). All the SAP NetWeaver components and the central database run on one VM.

For general considerations for a 3-tier system, see Deploying a 3-tier scale-out system.

Before you begin, ensure that you have consulted the Planning Guide and, if you are going to use Microsoft SQL Server, that you have decided how you want to install the SQL Server database from the following options:

  • Use a GCP image that includes the database.
  • Install it using installation media.

Creating and setting up a VM

When you create a VM, you can specify several options, including the operating system, region, machine type, and persistent disks. You must also specify a start-up script to install Google's monitoring agent on the VM.

To create a VM:

  1. Go to the Images page in Compute Engine:

    Go to the Images page

  2. Choose a public image that contains a version of Microsoft Windows Server that is supported by SAP.

    If you are using Microsoft SQL Server as your database, you can migrate your existing license to GCP or use a Compute Engine Windows Server image that has SQL Server preinstalled. For more information about the SQL Server images provided by GCP, see Windows on Compute Engine.

    For the versions of Windows Server and SQL Server that are supported by SAP on GCP, see SAP Note 2456432: SAP Applications on Google Cloud Platform: Supported Products and Google VM types.

  3. Click the Create instance button.

  4. Enter a name for the VM.

    Limit your name to 13 characters, because this is the maximum supported by SAP. For more information, see SAP Note 611361: Hostnames of SAP servers.

  5. Select the region and zone for your VM based on the location of your internal resources and users, and based on the CPU platform you want to use.

    For more details on the zones supported for SAP NetWeaver, see the following guides and SAP Notes:

  6. Under Machine type, select a pre-defined n1-standard or n1-highmem machine type or customize a VM to more precisely match the VM's vCPUs and memory to your expected workload.

    To compare the supported machine types and their persistent-disk limitations, see the Planning Guide.

  7. Optionally, in the Boot disk section, click Change to adjust the size of your boot disk. Ensure that the boot disk is at least 50 GB.

  8. Under Access Scope, for the Compute Engine default service account, select Set access for each API.

    To ensure that your VM instance can interact with Compute Engine and Stackdriver and that the Google monitoring agent functions correctly, the following API access for the service account are recommended:

    API Access
    Cloud Source Repositories Read Write
    Compute Engine Read Write
    Service Control Enabled
    Service Management Read Only
    Stackdriver Logging API Full
    Stackdriver Monitoring API Full
    Stackdriver Trace Write Only
    Storage Full

  9. Expand the Management, disks, networking, sole tenancy section.

  10. If you are using a NAT gateway, in the Networking tab, under Network tags, add the tag that you specified as [YOUR_TAG_NAME] when you set up the route that directs traffic through the gateway.

  11. In the Management tab, under Automation > Metadata, specify the following text in the Key and Value boxes to run the startup script that installs the Google monitoring agent:

    • Key:
      sysprep-specialize-script-url
    • Value:
      https://storage.googleapis.com/sap-netweaver-on-gcp/installer.ps1

    Windows runs the script as administrator.

    The Google monitoring agent runs as a Windows service named GCP Metrics Provider. Do not delete or modify this service. It is required for the continuous operation of Google's monitoring agent.

    The Google monitoring agent, which sends data to the SAP monitoring system, must be installed and running to get support from SAP.

    For more information about the Google monitoring agent, see the Operations Guide.

  12. In the Management tab, under Availability policy, ensure that you leave the following default settings:

    • To ensure availability of your SAP systems, keep the Preemptibility setting Off (recommended).
    • To ensure that your VM can restart if there's a maintenance or failure event, keep the Automatic restart setting On (recommended).
    • To ensure that your VM is migrated to other hardware during infrastructure maintenance, keep the On host maintenance setting on Migrate VM instance (recommended).
  13. Optionally, in the Disks tab, under Boot disk > Deletion rule, deselect the Delete boot disk when instance is deleted checkbox.

  14. In the Disks tab, under Additional disks, click Add new disk to add persistent disks for storage. For NetWeaver, add disks for the SAP NetWeaver binaries and the pagefile disk. For the database server, you also need disks for things like the database data and logs.

    1. Optionally, specify a name in the Name field.

    2. In the Create a disk window, under Disk Type select the disk type. In most cases, select a standard persistent disk (HDD). Depending on your performance objectives, you can use solid-state drive (SSD) disk instead.

    3. Under Source type, select Blank disk.

    4. Specify the size of your disk.

    5. Click Done to save your disk settings.

    6. Repeat these steps for each disk you need to add to your system.

  15. In the Networking tab, under Network interfaces, click the pencil icon to edit the selected network interface. Select the network that you created previously.

  16. Click Create to create and start the instance.

At the bottom of the page, you can click REST or command line to see the equivalent REST and gcloud commands for the instance you are creating. These can be useful for creating additional VMs.

Connecting to your VM

To connect to a Windows-based VM, you must first generate a password for the VM. You can then connect to the VM using RDP or PowerShell.

Generating passwords
  1. Go to the VM instances page.

    OPEN VM INSTANCES

  2. Click the name of the VM instance for which you need a new password.

  3. On the instance details page, click the Set Windows Password button. A password is generated for you.

Using RDP

If you have defined a firewall rule that allows access on port 3389, you can use RDP to connect to a Windows instance and start a Remote Desktop session. Alternatively, you can connect to Windows instances using the PowerShell terminal.

Connect to the remote desktop on Windows instances using one of the following methods:

  • Use a Chrome browser that has the Chrome RDP for Google Cloud Platform extension installed and establish an RDP connection from GCP Console.
  • Download the RDP file and manually connect through the Windows Remote Desktop Connection client or a third-party client.

Console

  1. If the Chrome RDP for Google Cloud Platform extension is not installed already in your Chrome browser, install it now.

    To check for the Chrome RDP for Google Cloud Platform extension, enter chrome://extensions/ in your browser address bar and look for the extension under Chrome Apps on the Extensions page of your Chrome browser.

  2. Go to the VM instances page in GCP Console.

    OPEN VM INSTANCES

  3. Click the RDP button next to the instance that you want to connect to. A new browser window opens with the Chrome RDP for Google Compute Engine extension.

  4. Enter your username and password. If this is your first time connecting to this instance, or if you have forgotten your password, create or reset your Windows password.

  5. Click OK to connect.

RDP Client

  1. Install an RDP client. If you don't have a preference, install the Chrome RDP for Google Compute Engine Engine extension.

  2. Get your Windows VM's external IP address. Go to the VM instances page in GCP Console or run gcloud compute instances list to see a list of your instances with their external IP values.

  3. In your RDP client, provide your VM's external IP address as the IP address to connect to. For example, in the Chrome RDP extension, you would enter the IP address in the following format:

    Screenshot of the instance creation window with the required options
set

  4. Enter your sign-in information and leave the Domain field blank. If this is your first time connecting to this VM, or if you have forgotten your password, create or reset your Windows password.

    Screenshot of the instance creation window with the required options
set

Using PowerShell
  1. If you have not created a username and password on the Windows VM yet, create your Windows password.

  2. Add a firewall rule or edit your existing firewall rule to open port 5986 on the GCP network where your Windows Server VM is located.

  3. On your local workstation, open the PowerShell terminal.

  4. Optionally, you can initialize a variable to hold your user credentials so you do not need to enter them each time you connect to the instance. If you skip this step, you receive a prompt for your username and password later.

    $credentials = Get-Credential

  5. Use the Enter-PSSession command to start a remote PowerShell session and include the flags to use SSL and skip credentials checks.

    Enter-PSSession -ComputerName [IP_ADDRESS] -UseSSL -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) -Credential $credentials

Formatting and mounting disk drives

After you have connected to your Windows VM, format your disks so that you can begin using them. You also configure the Windows pagefile.

  1. From the Windows Start menu, search for and open the Server Manager.

  2. Select File and Storage Services and then select Disks.

    Server Manager

  3. In the Disks dialog box, right-click the first disk, and then select New Volume. The New Volume Wizard opens.

  4. Optionally, on the Drive Letter or Folder panel, select a drive letter for the disk. For example, S for the SAP disk, or P for the pagefile disk. You can accept all other defaults.

  5. On the File System Settings panel, enter a volume label that describes the disk with a meaningful name, such as SAP or Pagefile.

    New Volume Wizard

  6. Accept all other defaults.

  7. Repeat these steps for the additional disks.

Preparing the operating system

After you have created your VM, configure the operating system:

Setting up the database

If you have not yet deployed your database on GCP, follow the instructions for setting up your database in both the GCP deployment guide for your database, and in the database documentation that is provided by your database vendor.

GCP provides deployment guides for the following SAP-certified databases:

  • SAP ASE guides
  • SAP MaxDB guides
  • IBM Db2 guides
  • Windows SQL Server guide
  • When SAP NetWeaver and the database server are running on different VMs in a 3-tier architecture, make sure that your firewall rules are defined to allow communication between the VMs.

    If you used the GCP-provided Windows image that contains SQL Server, you must change the collation to use the SAP collation.

    Configuring the GCP Microsoft SQL Server image

    If selected the Google-provided SQL Server Enterprise operating system image when you created your VM, you must configure SQL Server to use the SAP collation (SQL_Latin1_General_CP850_BIN2) so that SQL Server is compatible with SAP systems. The default collation in the GCP-provided SQL Server image is (SQL_Latin1_General_CP1_CI_AS).

    To change the collation after the VM is deployed:

    1. Connect to your Windows instance by using either RDP or remote PowerShell.
    2. Sign in to Windows as administrator and stop the MSSQLSERVER service.
    3. Navigate to the directory that contains the binaries for your SQL Server instance, for example, C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn.
    4. From an elevated command prompt, change the collation by running:

      sqlservr -m -T4022 -T3659 -s"[SQL_SERVER_INSTANCE_NAME]" -q"SQL_Latin1_General_CP850_BIN2"

      where:

      • The parameter -m starts the SQL Server instance in single-user mode.
      • The trace flag 4022 forces SQL Server to skip any stored startup procedures.
      • The trace flag 3659 allows all errors to be logged to the SQL Server logs.
      • The parameter -s specifies the name of the SQL Server instance to start. Replace [SQL_SERVER_INSTANCE_NAME] with your SQL Server instance name.
      • The parameter -q rebuilds all databases and objects to the specified SAP collation, without reinstalling the instance or rebuilding system databases.
    5. Restart the SQL Server Service MSSQLSERVER after the collation is changed.

    6. Confirm your change in the most recent SQL Server ERRORLOG or the server's collation properties.

    For more information about the configuration of SQL Server for SAP, see:

    Installing the Stackdriver Logging agent

    The Stackdriver Logging agent provides you with a solution for GCP system-activity logging, including operating system events and, if you are using SAP HANA, SAP HANA events. The Stackdriver Logging agent is an optional but recommended component. See the SAP NetWeaver on GCP Operations Guide for more information about GCP logging.

    To install the Stackdriver Logging agent in your new VM, see the instructions for Linux and Windows in Installing the Agent.

    Installing SAP NetWeaver

    For instructions on installing SAP NetWeaver on your new VM, see the SAP help portal and the SAP NetWeaver Master Guide.

    After you install SAP NetWeaver:

    1. Update the SAP kernel to the minimum supported patch level.

      For details on the supported SAP kernel patch levels, see SAP Note 2456953 - Windows on Google Cloud Platform (IaaS): Adaptation of your SAP License.

    2. Install your permanent SAP NetWeaver license.

      For more information from SAP about managing your SAP NetWeaver licenses, see SAP Licensing Procedure.

    Installing the SAP Host Agent

    The SAP Host Agent has been enhanced for running on GCP. Ensure that you run at least the minimum SAP Host Agent version required for the GCP environment.

    For details, refer to the following SAP Notes:

    Validating your installation of the monitoring agent

    After you have deployed a VM and installed SAP NetWeaver, validate that Google's monitoring agent is functioning properly with SAP's enhanced monitoring.

    Verifying that Google's monitoring agent is running

    You can check whether the monitoring agent is running by polling for a health check from the server. Follow these steps:

    1. Use RDP to connect to the VM instance you want to monitor.

    2. In a browser, visit http://localhost:18181/health.

    If the monitoring agent is functioning properly, the value for status should be UP. For example:

    {"status":"UP","diskSpace":{"status":"UP","total":105552769024,"free":103920615424,"threshold":10485760}}

    If the monitoring agent isn't running, see the Operations Guide section about restarting Google's monitoring agent.

    Verifying that SAP NetWeaver is receiving metrics

    To check whether the connection between Google's monitoring agent and SAP NetWeaver works as intended, enter transaction ST06 in your SAP NetWeaver ABAP system. In the overview pane, check the availability and content of the following fields for the correct end-to-end setup of the SAP and Google monitoring infrastructure:

    • Cloud Provider: Google Cloud Platform
    • Enhanced Monitoring Access: TRUE
    • Enhanced Monitoring Details: ACTIVE

    Deploying a 3-tier scale-out system

    The steps to deploy each VM in a 3-tier system are very similar to the steps for deploying the example system. In a 3-tier scale-out system, you deploy several VMs, all in the same zone:

    • A primary VM that runs the SAP NetWeaver application server (AS) and ABAP central services. This VM also hosts a shared file system that contains the shared profile and must be accessible from each VM that runs SAP NetWeaver in the system.
    • Some number of additional VMs that run the AS, for scaling purposes.
    • A VM that is dedicated to the central database.

    The high-level steps are as follows:

    1. Create the VM that hosts the database and then install the database. If you used a Compute Engine image that includes SQL Server, the database is already installed.

    2. Create the primary instance.

      • Run SWPM on the first VM that you want to run SAP NetWeaver.
      • Install central services.
      • Install the AS.
      • Point to the existing database.
    3. Create additional instances.

      • Run SWPM on each additional VM that you want to run SAP NetWeaver.
      • Install the AS.
      • Point to the existing database.
      • Point to the network share that contains the profiles and is managed by the primary instance.

    Troubleshooting

    This section contains information about how to correct common issues.

    Troubleshooting communication problems to the database server

    If you are setting up a 3-tier SAP system and having connection issues between your VMs, ensure that you have created a firewall rule to allow traffic between VMs on your subnetwork.

    Troubleshooting Google's monitoring agent

    To troubleshoot the monitoring agent, see the Operations Guide.

    Was this page helpful? Let us know how we did:

    Send feedback about...