This guide uses Deployment Manager to deploy all of the required Google Cloud resources to run SAP NetWeaver on Windows Server, including the Compute Engine virtual machine (VM), the Windows Server operating system, and the persistent disks. You define the values for the installation, such as machine type, resource names, disk sizes, and so forth, in a Deployment Manager configuration file template.
If your SAP NetWeaver installation requires more control over the deployment process than the Deployment Manager template provides, see Manual VM deployment for SAP NetWeaver on Windows.
To deploy a VM that is running Linux, see the Linux Deployment Guide.
VM configuration deployed by these instructions
The VM that is deployed by these instructions is for use in a 3-tier configuration, where SAP NetWeaver runs on one VM and the database server runs on another.
To set up a 2-tier configuration, where SAP NetWeaver runs on the same VM as the database server, you deploy the database server first and create the VM and the required disk drives for both the database server and for SAP NetWeaver at that time. You then install SAP NetWeaver on the same VM as the database server.
For instructions about deploying the VM for a database server, see the database deployment guide for your database server.
Google Cloud resources deployed by these instructions
The Google Cloud resources that are deployed by Deployment Manager include:
- A VM that uses an SAP-certified version of Windows Server.
- A persistent disk for SAP binaries.
- A persistent disk for the pagefile.
- The recommended APIs.
- Google's monitoring agent.
The following instructions use Cloud Shell, but if you prefer, you can use the Cloud SDK in your local terminal instead.
Creating a project
To create a project:
Sign in to your Google Account.
If you don't already have one, sign up for a new account.
In the Cloud Console, on the project selector page, select or create a Cloud project.
Make sure that billing is enabled for your Google Cloud project. Learn how to confirm billing is enabled for your project.
gcloud command environment
These instructions use
Cloud Shell to enter
gcloud commands that deploy or configure
your Google Cloud resources. Cloud Shell is accessed through the
Cloud Console in your browser.
Cloud Shell runs on a VM that Google Cloud provisions each time
you start Cloud Shell. The first time you use Cloud Shell,
Google Cloud also creates a persistent
$HOME directory for you,
which is restored each time you open Cloud Shell.
The provisioned VM includes the latest
which provides the
gcloud command-line interface. Therefore, the
commands that you use in Cloud Shell are the same as
those you would use in a locally installed instance of the Cloud SDK.
If you have the Cloud SDK installed, you can issue the
commands that are used in these instructions from your local machine. However,
with a locally installed Cloud SDK you must always make sure that you
are using the latest version of the Cloud SDK.
Whether you use Cloud Shell or Cloud SDK, you can
can set and change the properties of your
gcloud command environment and save
them as a configuration. Configurations are collections of key-value pairs
that influence the behavior of the
Some basic actions you can take with a configuration in Cloud Shell include:
Initialize a configuration with
Check the settings of your current gcloud configuration with
gcloud config list.
Change the Google Cloud project you are working in with
gcloud config set project [PROJECT_ID]where
[PROJECT_ID]represents your Google Cloud project.
Set a default region with
gcloud config set compute/region [REGION]where
[REGION]represents a Google Cloud region.
Set a default zone with
gcloud config set compute/zone [ZONE]where
[ZONE]represents a Google Cloud zone.
Create a new configuration with
gcloud config configurations create [NAME]where
[NAME]represents the name for the configuration.
For more information about working with configurations, see Managing Cloud SDK configurations.
Creating a network
For security purposes, create a new network. You control who has access by adding firewall rules or by using another access control method.
If your project has a default VPC network, don't use it. Instead, create your own VPC network so that the only firewall rules in effect are those that you create explicitly.
Go to Cloud Shell.
Create a new network in the custom subnetworks mode:
gcloud compute networks create [YOUR_NETWORK_NAME] --subnet-mode custom
[YOUR_NETWORK_NAME]is the name of the new network. The network name can contain only lowercase characters, digits, and the dash character (-).
--subnet-mode customto avoid using the default auto mode, which automatically creates a subnet in each Compute Engine region. For more information, see Subnet creation mode.
Create a subnetwork, and specify the region and IP address range:
gcloud compute networks subnets create [YOUR_SUBNETWORK_NAME] \ --network [YOUR_NETWORK_NAME] --region [YOUR_REGION] --range [YOUR_RANGE]
[YOUR_SUBNETWORK_NAME]is the new subnetwork.
[YOUR_NETWORK_NAME]is the name of the network you created in the previous step.
[REGION]is the region where you want the subnetwork. Use a region that is supported for SAP NetWeaver.
[YOUR_RANGE]is the IP address range, specified in CIDR format, such as
10.1.0.0/24.If you plan to add more than one subnetwork, assign non-overlapping CIDR IP address ranges for each subnetwork in the network. Note that each subnetwork and its internal IP address ranges are mapped to a single region.
Optionally, repeat the previous step and add additional subnetworks.
Setting up a NAT gateway
If you intend to create a VM without a public IP address, you must create a NAT gateway so that your VM can access the internet to download Google's monitoring agent. If you intend to assign an external public IP address to your VM, you can skip this procedure.
Create a VM to act as the NAT gateway in the subnet you just created:
gcloud compute instances create [YOUR_VM_NAME] --can-ip-forward \ --zone [YOUR_ZONE] --image-family [YOUR_IMAGE_FAMILY] \ --image-project [YOUR_IMAGE_PROJECT] --machine-type=[YOUR_MACHINE_TYPE] \ --subnet [YOUR_SUBNETWORK_NAME] \ --metadata startup-script="sysctl -w net.ipv4.ip_forward=1; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE" \ --tags [YOUR_VM_TAG]
[YOUR_VM_NAME]is the name of the VM you are creating that you want to use for the NAT gateway.
[YOUR_ZONE]is the zone where you want the VM.
[YOUR_IMAGE_PROJECT]specify the image you want to use for the NAT gateway VM.
[YOUR_MACHINE_TYPE]is any supported machine type. If you expect high network traffic, choose a machine type with that has at least 8 virtual CPUs.
[YOUR_SUBNETWORK_NAME]is the name of the subnetwork where you want the VM.
[YOUR_VM_TAG]is the tag that is applied to the VM you are creating. If you will also use this VM as a bastion host, this tag is used to apply the firewall rule only to this VM.
Create a route that is tagged so that traffic passes through the NAT VM instead of the default internet gateway:
gcloud compute routes create [YOUR_ROUTE_NAME] --network [YOUR_NETWORK_NAME] \ --destination-range 0.0.0.0/0 --next-hop-instance [YOUR_VM_NAME] \ --next-hop-instance-zone [YOUR_ZONE] --tags [YOUR_TAG_NAME] --priority 800
[YOUR_ROUTE_NAME]is the name of the route you are creating.
[YOUR_NETWORK_NAME]is the network you created.
[YOUR_VM_NAME]is the VM you are using for your NAT gateway.
[YOUR_ZONE]is the zone where the VM is located.
[YOUR_TAG_NAME]is the tag on the route that directs traffic through the NAT VM.
If you also want to use the NAT Gateway VM as a bastion host, run the following command to allow inbound SSH access to this instance from the internet:
gcloud compute firewall-rules create allow-ssh --network [YOUR_NETWORK_NAME] \ --allow tcp:22 --source-ranges 0.0.0.0/0 --target-tags "[YOUR_VM_TAG]"
[YOUR_NETWORK_NAME]is the network you created.
[YOUR_VM_TAG]is the tag you specified when you created the NAT gateway VM. This tag is used so this firewall rule applies only to the VM that hosts the NAT gateway, and not to all VMs in the network.
Adding firewall rules
By default, incoming connections from outside your Google Cloud network are blocked. To allow incoming connections, set up a firewall rule for your VM. Firewall rules regulate only new incoming connections to a VM. After a connection is established with a VM, traffic is permitted in both directions over that connection.
You can create a firewall rule to allow access to specified ports, or to allow access between VMs on the same subnetwork.
Create firewall rules to allow access for such things as:
- The default ports used by SAP NetWeaver, as documented in TCP/IP Ports of All SAP Products.
- Connections from your computer or your corporate network environment to your Compute Engine VM instance. If you are unsure of what IP address to use, talk to your company's network admin.
- Communication between VMs in a 3-tier or scaleout configuration. For example, if you are deploying a 3-tier system, you will have at least 2 VMs in your subnetwork: the VM for SAP NetWeaver, and another VM for the database server. To enable communication between the two VMs, you must create a firewall rule to allow traffic that originates from the subnetwork.
- RDP connections to your VM instance through port
- PowerShell connections to your VM instance through port
To create a firewall rule:
In the Cloud Console, go to the Firewall Rules page.
At the top of the page, click Create firewall rule.
- In the Network field, select the network where your VM is located.
- In the Targets field, select All instances in the network.
- In the Source filter field, select one of the following:
- IP ranges to allow incoming traffic from specific IP addresses. Specify the range of IP addresses in the Source IP ranges field.
- Subnets to allow incoming traffic from a particular subnetwork. Specify the subnetwork name in the following subnets field. You can use this option to allow access between the VMs in a 3-tier or scaleout configuration.
- In the Protocols and ports section, select Specified protocols and
ports and specify
Click Create to create your firewall rule.
Deploying a VM for SAP NetWeaver on Windows with Deployment Manager
The following instructions use Google Cloud Console, Cloud Shell, and Deployment Manager to deploy a VM instance with Windows Server and all of the persistent disks that SAP NetWeaver requires.
About Deployment Manager
In these instructions, you define the resource options for your installation in a Deployment Manager configuration file template.
Deployment Manager treats all of the resources that are created for your SAP system as a single entity called a deployment. You can view and work with all of the deployments for your project on the Deployments page in the Cloud Console.
Be aware of the following behaviors when using Deployment Manager:
- Deleting a deployment deletes all of the resources associated with the deployment, including the VMs, the persistent disks, and any SAP systems that are installed on the VM.
By default, Deployment Manager uses the
ACQUIREresource creation policy. If you specify a VM name that is already in use by another VM in your project, Deployment Manager doesn't create a new VM, but instead adds the existing VM to your new deployment. If your original VM was created by a previous run of Deployment Manager, the VM is associated with two deployments.
If you then delete the new deployment, the acquired VM is deleted from the deployment that originally created it. To avoid such a scenario, either set the Deployment Manager resource policy to
CREATE, or make sure that you use unique resource names in your new deployment.
For information about the policies you can use while creating resources with Deployment Manager and how to specify them, see the Deployment Manager documentation.
Open Cloud Shell.
template.yamlconfiguration file template to your working directory:
Optionally, rename the
template.yamlfile to identify the configuration it defines. For example,
template.yamlfile in Cloud Shell code editor.
To open Cloud Shell code editor, click the pencil (edit) icon in the upper right corner of Cloud Shell terminal window.
template.yamlfile, update the following property values by replacing the brackets and their contents with the values for your installation.
Property Data type Description
String The name of the VM instance on which SAP NetWeaver is installed. The name must be 13 characters or less and be specified in lowercase letters, numbers, or hyphens. Use a name that is unique within your project.
String The type of Compute Engine virtual machine that you need. If you need a custom VM type, specify a small predefined VM type and, after deployment is complete, customize the VM as needed.
String The zone in which you are deploying SAP NetWeaver. It must be in the same region that you selected for your subnetwork.
String The name of the subnetwork that you created in a previous step. If you are deploying to a shared VPC, specify this value as [SHAREDVPC_PROJECT]/[SUBNETWORK]. For example, myproject/network1.
String The name of the Windows operating-system image or image family that you are using with SAP NetWeaver. To specify an image family, add the prefix family/ to the family name. For example, family/windows-2012-r2. For the list of available image families, see the Images page in the Cloud console.
String The Google Cloud project that contains the image you are going to use. This project might be your own project or a Google Cloud image project, such as windows-cloud. For a list of Google Cloud image projects, see the Images page in the Compute Engine documentation.
Integer The size of the SAP binaries disk. The minimum size is 8 GB. In the deployed VM, this volume is labeled SAP (S:).
Integer The size of the pagefile volume. The minimum size is 1 GB. In the deployed VM, this volume is labeled Pagefile (P:).
String Optional. A network tag that represents your VM instance for firewall or routing purposes. If you specify
publicIP: Noand do not specify a network tag, be sure to provide another means of access to the internet.
Boolean Optional. Determines whether a public IP address is added to your VM instance. The default is
The following configuration file creates a VM that is configured to run SAP NetWeaver. The configuration file directs Deployment Manager to deploy the
n1-standard-16VM that is running a Windows Server 2016 operating system. The VM includes all of the directories that are required in order to run SAP NetWeaver.
imports: ‐ path: https://storage.googleapis.com/sapdeploy/dm-templates/sap_nw-win/sap_nw-win.py resources: ‐ name: sap-nw-win type: https://storage.googleapis.com/sapdeploy/dm-templates/sap_nw-win/sap_nw-win.py properties: instanceName: ex-vm-nw-win instanceType: n1-standard-16 zone: us-central1-f subnetwork: example-sub-network-sap windowsImage: family/windows-2016 windowsImageProject: windows-cloud usrsapSize: 15 swapSize: 24
Deploy the VM:
gcloud deployment-manager deployments create [DEPLOYMENT-NAME] --config [TEMPLATE-NAME].yaml
The above command invokes Deployment Manager, which deploys the VM, all according to the specifications in your
template.yamlfile. The process may take a few minutes. To check the progress of your deployment, follow the steps in the next section.
After the VM instance deploys, if you need Compute Engine to save the boot disk in the event the VM instance is deleted:
- Go to VM instances in the Cloud Console.
- Open VM instance details for your VM instance by clicking the name of the VM instance.
- Under Boot disk and local disks, clear Delete boot disk when instance is deleted.
The following steps use Logging, which might incur charges. For more information, see Stackdriver pricing.
Open Stackdriver Logging to check for errors and monitor the progress of the installation.
On the Resources tab, select Global as your logging resource. If
INSTANCE DEPLOYMENT COMPLETEis displayed for a VM, Deployment Manager processing is complete for the VM.
After the VM instance deploys, connect to your VM as described in Connecting to your VM to confirm that all of the required data volumes exist and that they have the expected capacities. The
Pagefiledrive should be almost full.
If any of the validation steps show that the installation failed:
- Correct the error.
- On the Deployments page, delete the deployment to clean up the VMs and persistent disks from the failed installation.
- Rerun your deployment.
Connecting to your VM
To connect to a Windows-based VM, you must first generate a password for the VM. You can then connect to the VM using RDP or PowerShell.
Go to the VM instances page.
Click the name of the VM instance for which you need a new password.
On the instance details page, click the Set Windows Password button. A password is generated for you. Copy the password and store it in a secure place.
If you have defined a firewall rule that allows access on port 3389, you can use RDP to connect to a Windows instance and start a Remote Desktop session. Alternatively, you can connect to Windows instances using the PowerShell terminal.
Connect to the remote desktop on Windows instances using one of the following methods:
- Use a Chrome browser that has the Chrome RDP for Google Cloud extension installed and establish an RDP connection from the Cloud Console.
Download the RDP file and manually connect through the Windows Remote Desktop Connection client or a third-party client.
If the Chrome RDP for Google Cloud extension is not installed already in your Chrome browser, install it now.
To check for the Chrome RDP for Google Cloud Platform extension, enter
chrome://extensions/in your browser address bar and look for the extension under Chrome Apps on the Extensions page of your Chrome browser.
Go to the VM instances page in the in the Cloud Console.
Click the RDP button next to the instance that you want to connect to. A new browser window opens with the Chrome RDP for Google Cloud extension.
Enter your username and password. If this is your first time connecting to this instance, or if you have forgotten your password, create or reset your Windows password.
Click OK to connect.
Install an RDP client. If you don't have a preference, install the Chrome RDP for Google Compute Engine Engine extension.
Get your Windows VM's external IP address. Go to the VM instances page in the Cloud Console or run
gcloud compute instances listto see a list of your instances with their external IP values.
In your RDP client, provide your VM's external IP address as the IP address to connect to. For example, in the Chrome RDP extension, you would enter the IP address in the following format:
Enter your sign-in information and leave the Domain field blank. If this is your first time connecting to this VM, or if you have forgotten your password, create or reset your Windows password.
If you have not created a username and password on the Windows VM yet, create your Windows password.
On your local workstation, open the PowerShell terminal.
Optionally, initialize a variable to hold your user credentials so you do not need to enter them each time you connect to the instance. If you skip this step, you receive a prompt for your username and password later.
$credentials = Get-Credential
Use the Enter-PSSession command to start a remote PowerShell session and include the flags to use SSL and skip credentials checks.
Enter-PSSession -ComputerName [IP_ADDRESS] -UseSSL -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) -Credential $credentials
Setting up the database
If you haven't yet deployed your database on Google Cloud, follow the instructions for setting up your database in both the Google Cloud deployment guide for your database, and in the database documentation that is provided by your database vendor.
Google Cloud provides deployment guides for the following SAP-certified databases:
- SAP HANA guides: when SAP NetWeaver is running on Windows, SAP HANA is supported only in 3-tier architectures.
- SAP ASE guides
- SAP MaxDB guides
- IBM Db2 guides
- Windows SQL Server guide
When SAP NetWeaver and the database server are running on different VMs in a 3-tier architecture, make sure that your firewall rules are defined to allow communication between the VMs.If you used the Google Cloud-provided Windows image that contains SQL Server, you must change the collation to use the SAP collation.
Configuring the Google Cloud Microsoft SQL Server image
If you selected the Google-provided SQL Server Enterprise operating system image
when you created your VM, you must configure SQL Server to use the SAP
SQL_Latin1_General_CP850_BIN2) so that SQL Server is compatible with SAP
systems. The default collation in the Google Cloud-provided SQL Server
image is (
To change the collation after the VM is deployed:
- Connect to your Windows instance by using either RDP or remote PowerShell.
- Sign in to Windows as an admin and stop the
- Go to the directory that contains the binaries for your SQL Server
instance, for example,
C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn.
From an elevated command prompt, change the collation by running:
sqlservr -m -T4022 -T3659 -s"[SQL_SERVER_INSTANCE_NAME]" -q"SQL_Latin1_General_CP850_BIN2"
- The parameter
-mstarts the SQL Server instance in single-user mode.
- The trace flag
4022forces SQL Server to skip any stored startup procedures.
- The trace flag
3659allows all errors to be logged to the SQL Server logs.
- The parameter
-sspecifies the name of the SQL Server instance to start. Replace
[SQL_SERVER_INSTANCE_NAME]with your SQL Server instance name.
- The parameter
-qrebuilds all databases and objects to the specified SAP collation, without reinstalling the instance or rebuilding system databases.
- The parameter
Restart the SQL Server Service
MSSQLSERVERafter the collation is changed.
Confirm your change in the most recent SQL Server
ERRORLOGor the server's collation properties.
For more information about the configuration of SQL Server for SAP, see:
- Upgrade to and Installation of SQL Server 2016 in an SAP Environment
- SAP Note 2201060 - Setting up Microsoft SQL Server 2016
Installing the Stackdriver Logging agent
The Stackdriver Logging agent provides you with a solution for Google Cloud system-activity logging, including operating system events and, if you are using SAP HANA, SAP HANA events. The Stackdriver Logging agent is an optional but recommended component. See the SAP NetWeaver on Google Cloud operations guide for more information about Google Cloud logging.
To install the Stackdriver Logging agent in your new VM, see the instructions for Linux and Windows in Installing the agent.
Installing SAP NetWeaver
After you install SAP NetWeaver:
Update the SAP kernel to the minimum supported patch level.
For details on the supported SAP kernel patch levels, see SAP Note 2456953 - Windows on Google Cloud (IaaS): Adaptation of your SAP License.
Install your permanent SAP NetWeaver license.
For more information from SAP about managing your SAP NetWeaver licenses, see SAP Licensing Procedure.
Installing the SAP Host Agent
The SAP Host Agent has been enhanced for running on Google Cloud. Ensure that you run at least the minimum SAP Host Agent version required for the Google Cloud environment.
For details, refer to the following SAP Notes:
- SAP Note 1409604 - Virtualization on Windows: Enhanced Monitoring.
- To update your SAP Host Agent by default on a regular basis, see SAP Note 1473974 - Using the SAP Host Agent Auto Upgrade Feature.
Validating your installation of the monitoring agent
After you have deployed a VM and installed SAP NetWeaver, validate that Google's monitoring agent is functioning properly with SAP's enhanced monitoring.
Verifying that Google's monitoring agent is running
You can check whether the monitoring agent is running by polling for a health check from the server. Follow these steps:
Use RDP to connect to the VM instance you want to monitor.
In a browser, visit
If the monitoring agent is functioning properly, the value for
If the monitoring agent isn't running, see the Operations Guide section about restarting Google's monitoring agent.
Verifying that SAP NetWeaver is receiving metrics
To check whether the connection between Google's monitoring agent and SAP
NetWeaver works as intended, enter transaction
ST06 in your SAP NetWeaver ABAP
system. In the overview pane, check the availability and content of the
following fields for the correct end-to-end setup of the SAP and Google
- Cloud Provider:
Google Cloud Platform
- Enhanced Monitoring Access:
- Enhanced Monitoring Details:
This section contains information about how to correct common issues.
Troubleshooting communication problems to the database server
If you are setting up a 3-tier SAP system and having connection issues between your VMs, ensure that you have created a firewall rule to allow traffic between VMs on your subnetwork.
Troubleshooting Google's monitoring agent
To troubleshoot the monitoring agent, see the Operations guide.