This guide shows you how to manually deploy and connect to a VM that is configured to run SAP NetWeaver on Microsoft Windows Server-based systems on Google Cloud. To deploy a VM that is running Linux, see the Linux Deployment Guide.
These instructions give you the details for setting up a 2-tier system, with all the SAP components and the database running on a single VM. During deployment, you also install Google Cloud's Agent for SAP and can validate that it is sending metrics to SAP. This guide also includes considerations for migrating an existing system and for setting up a 3-tier scale-out system.
For more details on planning your implementation, see the Planning Guide. For an overview of IT ops for your system, see the Operations Guide.
Creating a project
To create a project:
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
Configuring the gcloud
command environment
These instructions use
Cloud Shell to enter gcloud
commands that deploy or configure
your Google Cloud resources. Cloud Shell is accessed through the
Google Cloud console in your browser.
Cloud Shell runs on a VM that Google Cloud provisions each time
you start Cloud Shell. The first time you use Cloud Shell,
Google Cloud also creates a persistent $HOME
directory for you,
which is restored each time you open Cloud Shell.
The provisioned VM includes the latest
Google Cloud CLI.
Therefore, the gcloud
commands that you use in Cloud Shell are the same as
those you would use in a locally installed instance of the gcloud CLI.
If you have the gcloud CLI installed, you can issue the gcloud
commands that are used in these instructions from your local machine. However,
with a locally installed gcloud CLI you must always make sure that you
are using the latest version of the gcloud CLI.
Whether you use Cloud Shell or gcloud CLI, you
can set and change the properties of your gcloud
command environment and save
them as a configuration. Configurations are collections of key-value pairs
that influence the behavior of the gcloud
commands.
Some basic actions you can take with a configuration in Cloud Shell include:
Initialize a configuration:
gcloud init
Check the settings of your current gcloud configuration:
gcloud config list
Switch to the required Google Cloud project. Replace
PROJECT_ID
with your Google Cloud project ID.gcloud config set project PROJECT_ID
Set a default region. Replace
REGION
with a Google Cloud region.gcloud config set compute/region REGION
Set a default zone. Replace
ZONE
with a Google Cloud zone.gcloud config set compute/zone ZONE
Create a new configuration. Replace
NAME
with the name for the configuration.gcloud config configurations create NAME
For more information about working with configurations, see Managing gcloud CLI configurations.
Creating a network
For security purposes, create a new network. You can control who has access by adding firewall rules or by using another access control method.
If your project has a default VPC network, don't use it. Instead, create your own VPC network so that the only firewall rules in effect are those that you create explicitly.
During deployment, VM instances typically require access to the internet to download Google Cloud's Agent for SAP. If you are using one of the SAP-certified Linux images that are available from Google Cloud, the VM instance also requires access to the internet in order to register the license and to access OS vendor repositories. A configuration with a NAT gateway and with VM network tags supports this access, even if the target VMs do not have external IPs.
To set up networking:
Console
- In the Google Cloud console, go to the VPC networks page.
- Click Create VPC network.
- Enter a Name for the network.
The name must adhere to the naming convention. VPC networks use the Compute Engine naming convention.
- For Subnet creation mode, choose Custom.
- In the New subnet section, specify the following configuration parameters for a
subnet:
- Enter a Name for the subnet.
- For Region, select the Compute Engine region where you want to create the subnet.
- For IP stack type, select IPv4 (single-stack) and then enter an IP
address range in the
CIDR format,
such as
10.1.0.0/24
.This is the primary IPv4 range for the subnet. If you plan to add more than one subnet, then assign non-overlapping CIDR IP ranges for each subnetwork in the network. Note that each subnetwork and its internal IP ranges are mapped to a single region.
- Click Done.
- To add more subnets, click Add subnet and repeat the preceding steps. You can add more subnets to the network after you have created the network.
- Click Create.
gcloud
- Go to Cloud Shell.
- To create a new network in the custom subnetworks mode, run:
gcloud compute networks create NETWORK_NAME --subnet-mode custom
Replace
NETWORK_NAME
with the name of the new network. The name must adhere to the naming convention. VPC networks use the Compute Engine naming convention.Specify
--subnet-mode custom
to avoid using the default auto mode, which automatically creates a subnet in each Compute Engine region. For more information, see Subnet creation mode. - Create a subnetwork, and specify the region and IP range:
gcloud compute networks subnets create SUBNETWORK_NAME \ --network NETWORK_NAME --region REGION --range RANGE
Replace the following:
SUBNETWORK_NAME
: the name of the new subnetworkNETWORK_NAME
: the name of the network you created in the previous stepREGION
: the region where you want the subnetworkRANGE
: the IP address range, specified in CIDR format, such as10.1.0.0/24
If you plan to add more than one subnetwork, assign non-overlapping CIDR IP ranges for each subnetwork in the network. Note that each subnetwork and its internal IP ranges are mapped to a single region.
- Optionally, repeat the previous step and add additional subnetworks.
Setting up a NAT gateway
If you need to create one or more VMs without public IP addresses, you need to use network address translation (NAT) to enable the VMs to access the internet. Use Cloud NAT, a Google Cloud distributed, software-defined managed service that lets VMs send outbound packets to the internet and receive any corresponding established inbound response packets. Alternatively, you can set up a separate VM as a NAT gateway.
To create a Cloud NAT instance for your project, see Using Cloud NAT.
After you configure Cloud NAT for your project, your VM instances can securely access the internet without a public IP address.
Adding firewall rules
By default, incoming connections from outside your Google Cloud network are blocked. To allow incoming connections, set up a firewall rule for your VM. Firewall rules regulate only new incoming connections to a VM. After a connection is established with a VM, traffic is permitted in both directions over that connection.
You can create a firewall rule to allow access to specified ports, or to allow access between VMs on the same subnetwork.
Create firewall rules to allow access for such things as:
- The default ports used by SAP NetWeaver, as documented in TCP/IP Ports of All SAP Products.
- Connections from your computer or your corporate network environment to your Compute Engine VM instance. If you are unsure of what IP address to use, talk to your company's network admin.
- Communication between VMs in a 3-tier, scaleout, or high-availability configuration. For example, if you are deploying a 3-tier system, you will have at least 2 VMs in your subnetwork: the VM for SAP NetWeaver, and another VM for the database server. To enable communication between the two VMs, you must create a firewall rule to allow traffic that originates from the subnetwork.
- RDP connections to your VM instance through port
3389
. - PowerShell connections to your VM instance through port
5986
.
To create a firewall rule:
In the Google Cloud console, go to the VPC network Firewall page.
At the top of the page, click Create firewall rule.
- In the Network field, select the network where your VM is located.
- In the Targets field, select All instances in the network.
- In the Source filter field, select one of the following:
- IP ranges to allow incoming traffic from specific IP addresses. Specify the range of IP addresses in the Source IP ranges field.
- Subnets to allow incoming traffic from a particular subnetwork. Specify the subnetwork name in the following subnets field. You can use this option to allow access between the VMs in a 3-tier or scaleout configuration.
- In the Protocols and ports section, select Specified protocols and
ports and specify
tcp:PORT_NUMBER;
.
Click Create to create your firewall rule.
Deploying a VM manually
The following instructions show you how to deploy a VM for an example 2-tier SAP system running Microsoft Windows and Microsoft SQL Server, SAP ASE, or IBM Db2 for Linux, UNIX, and Windows (IBM Db2). All the SAP NetWeaver components and the central database run on one VM.
For general considerations for a 3-tier system, see Deploying a 3-tier scale-out system.
Before you begin, ensure that you have consulted the Planning Guide and, if you are going to use Microsoft SQL Server, that you have decided how you want to install the SQL Server database from the following options:
- Use a Google Cloud image that includes the database.
- Install it using installation media.
Creating and setting up a VM
When you create a VM, you can specify several options, including the operating system, region, machine type, and persistent disks. Later, after the VM is deployed, you must also install Google Cloud's Agent for SAP on the VM.
To create a VM:
Go to the Images page in Compute Engine:
Choose a public image that contains a version of Microsoft Windows Server that is supported by SAP.
If you are using Microsoft SQL Server as your database, you can migrate your existing license to Google Cloud or use a Compute Engine Windows Server image that has SQL Server preinstalled. For more information about the SQL Server images provided by Google Cloud, see Windows on Compute Engine.
For the versions of Windows Server and SQL Server that are supported by SAP on Google Cloud, see SAP Note 2456432 - SAP Applications on Google Cloud: Supported Products and Google Cloud machine types .
Click the Create instance button.
Enter a name for the VM.
Limit your name to 13 characters, because this is the maximum supported by SAP. For more information, see SAP Note 611361: Hostnames of SAP servers.
Select the region and zone for your VM based on the location of your internal resources and users, and based on the CPU platform you want to use.
For more details on the zones supported for SAP NetWeaver, see the following guides and SAP Notes:
Under Machine type, select a pre-defined
n1-standard
orn1-highmem
machine type or customize a VM to more precisely match the VM's vCPUs and memory to your expected workload.To compare the supported machine types and their persistent-disk limitations, see the Planning Guide.
Optionally, in the Boot disk section, click Change to adjust the size of your boot disk. Ensure that the boot disk is at least 50 GB.
Under Service account, select a service account that appropriately limits access to Google Cloud resources from the VM.
If you haven't created a service account, you can use the default service account, but it is usually too permissive for most enterprise users. For more information about service accounts, see IAM for SAP programs.
Under Access Scopes:
- If you are using the Compute Engine default service account, select Set access for each API.
- If you are using a custom service account that limits access to Google Cloud resources, select Allow full access to all APIs.
Compute Engine recommends configuring your VM instances to allow full access to all Cloud APIs and using only the IAM permissions of the instance service account to control access to Google Cloud resources. For more information, see Create a VM that uses a user-managed service account.
If you selected Set access for each API, to ensure that your VM instance can interact with Compute Engine and Cloud Monitoring and that Google Cloud's Agent for SAP functions correctly, the following API access scopes are recommended for the service account:
API Access Cloud Source Repositories Read Write Compute Engine Read Write Service Control Enabled Service Management Read Only Cloud Logging API Full Cloud Monitoring API Full Cloud Trace Write Only Storage Full Expand the Management, disks, networking, sole tenancy section.
If you are using a NAT gateway, in the Networking tab, under Network tags, add the tag that you specified as
[YOUR_TAG_NAME]
when you set up the route that directs traffic through the gateway.In the Management tab, under Availability policy, ensure that you leave the following default settings:
- To ensure availability of your SAP systems, keep the Preemptibility setting Off (recommended).
- To ensure that your VM can restart if there's a maintenance or failure event, keep the Automatic restart setting On (recommended).
- To ensure that your VM is migrated to other hardware during infrastructure maintenance, keep the On host maintenance setting on Migrate VM instance (recommended).
Optionally, in the Disks tab, under Boot disk > Deletion rule, deselect the Delete boot disk when instance is deleted checkbox.
In the Disks tab, under Additional disks, click Add new disk to add persistent disks for storage.
For NetWeaver, add disks for the SAP NetWeaver binaries and the pagefile disk. For the database server, you also need disks for things like the database data and logs. For information about the types of persistent disks that you can choose, see Persistent disk storage.
Optionally, specify a name in the Name field.
In the Create a disk window, under Disk Type select the disk type.
Under Source type, select Blank disk.
Specify the size of your disk.
For the pagefile disk, size the disk according to your needs. The minimum recommended size is 24 GB. For larger instances, you might need more. For more information on calculating the size required for the page file, see SAP Note 1518419: Page file and virtual memory required by the SAP system.
Add more disks if needed.
If you want to sustain the maximum throughput rates mentioned in the Planning Guide, ensure that you have at least 834 GB of space for the database data.
Click Done to save your disk settings.
Repeat these steps for each disk you need to add to your system.
In the Networking tab, under Network interfaces, click the pencil icon to edit the selected network interface. Select the network that you created previously.
Click Create to create and start the instance.
At the bottom of the page, you can click REST or command line
to see the equivalent REST and gcloud
commands for the instance you are
creating. These can be useful for creating additional VMs.
Connecting to your VM
To connect to a Windows-based VM, you must first generate a password for the VM. You can then connect to the VM using RDP or PowerShell.
Generating passwords
Go to the VM instances page.
Click the name of the VM instance for which you need a new password.
On the instance details page, click the Set Windows Password button. A password is generated for you.
Using RDP
If your firewall rule allows access
on port 3389
, you can use RDP to connect to a Windows instance and start a
Remote Desktop session. Alternatively, you can
connect to Windows instances using the PowerShell terminal.
Connect to the remote desktop on Windows instances by manually connecting through the Windows Remote Desktop Connection client or a third-party client:
- If you don't already have an RDP client, install one now. For information from Microsoft about available RDP clients, see Remote Desktop clients.
- Get your Windows VM's external IP address. To find the VM IP address, you
can use either of the following methods:
- In the Google Cloud console, go to the VM Instances page.
- Use the gcloud CLI to run
gcloud compute instances list
to list your VM instances with their external IP addresses.
- In your RDP client, provide your VM's external IP address as the IP address to connect to.
- Enter your sign-in information and leave the Domain field blank. If this is your first time connecting to this VM, or if you have forgotten your password, create or reset your Windows password.
Using PowerShell
If you have not created a username and password on the Windows VM yet, create your Windows password.
Add a firewall rule or edit your existing firewall rule to open port 5986 on the Google Cloud network where your Windows Server VM is located.
On your local workstation, open the PowerShell terminal.
Optionally, you can initialize a variable to hold your user credentials so you do not need to enter them each time you connect to the instance. If you skip this step, you receive a prompt for your username and password later.
$credentials = Get-Credential
Use the Enter-PSSession command to start a remote PowerShell session and include the flags to use SSL and skip credentials checks.
Enter-PSSession -ComputerName [IP_ADDRESS] -UseSSL -SessionOption (New-PSSessionOption -SkipCACheck -SkipCNCheck) -Credential $credentials
Formatting and mounting disk drives
After you have connected to your Windows VM, format your disks so that you can begin using them. You also configure the Windows pagefile.
From the Windows Start menu, search for and open the Server Manager.
Select File and Storage Services and then select Disks.
In the Disks dialog box, right-click the first disk, and then select New Volume. The New Volume Wizard opens.
Optionally, on the Drive Letter or Folder panel, select a drive letter for the disk. For example,
S
for the SAP disk, orP
for the pagefile disk. You can accept all other defaults.On the File System Settings panel, enter a volume label that describes the disk with a meaningful name, such as
SAP
orPagefile
.Accept all other defaults.
Repeat these steps for the additional disks.
Preparing the operating system
After you have created your VM, configure the operating system:
- If your configuration calls for it, join the Windows Server OS to a domain.
- Configure the High Performance power plan.
- Add Windows firewall rules to enable access to SAP NetWeaver from a remote connection.
- Calculate the page file size referencing SAP Note 1518419: Page file and virtual memory required by the SAP system and configure the Windows Pagefile.
Setting up the database
If you haven't yet deployed your database on Google Cloud, follow the instructions for setting up your database in both the Google Cloud deployment guide for your database, and in the database documentation that is provided by your database vendor.
Google Cloud provides deployment guides for the following SAP-certified databases:
- SAP HANA guides: when SAP NetWeaver is running on Windows, SAP HANA is supported only in 3-tier architectures.
- SAP ASE guides
- SAP MaxDB guides
- IBM Db2 guides
- Windows SQL Server guide
When SAP NetWeaver and the database server are running on different VMs in a 3-tier architecture, make sure that your firewall rules are defined to allow communication between the VMs.
If you used the Google Cloud-provided Windows image that contains SQL Server, you must change the collation to use the SAP collation.Configuring the Google Cloud Microsoft SQL Server image
If you selected the Google-provided SQL Server Enterprise operating system image
when you created your VM, you must configure SQL Server to use the SAP
collation
(SQL_Latin1_General_CP850_BIN2
) so that SQL Server is compatible with SAP
systems. The default collation in the Google Cloud-provided SQL Server
image is (SQL_Latin1_General_CP1_CI_AS
).
To change the collation after the VM is deployed:
- Connect to your Windows instance by using either RDP or remote PowerShell.
- Sign in to Windows as an admin and stop the
MSSQLSERVER
service. - Go to the directory that contains the binaries for your SQL Server
instance, for example,
C:\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\Binn
. From an elevated command prompt, change the collation by running:
sqlservr -m -T4022 -T3659 -s"[SQL_SERVER_INSTANCE_NAME]" -q"SQL_Latin1_General_CP850_BIN2"
where:
- The parameter
-m
starts the SQL Server instance in single-user mode. - The trace flag
4022
forces SQL Server to skip any stored startup procedures. - The trace flag
3659
allows all errors to be logged to the SQL Server logs. - The parameter
-s
specifies the name of the SQL Server instance to start. Replace[SQL_SERVER_INSTANCE_NAME]
with your SQL Server instance name. - The parameter
-q
rebuilds all databases and objects to the specified SAP collation, without reinstalling the instance or rebuilding system databases.
- The parameter
Restart the SQL Server Service
MSSQLSERVER
after the collation is changed.Confirm your change in the most recent SQL Server
ERRORLOG
or the server's collation properties.
For more information about the configuration of SQL Server for SAP, see:
- Upgrade to and Installation of SQL Server 2016 in an SAP Environment
- SAP Note 2201060 - Setting up Microsoft SQL Server 2016
Installing the Cloud Logging agent
The Cloud Logging agent provides you with a solution for Google Cloud system-activity logging, including operating system events and, if you are using SAP HANA, SAP HANA events. The Cloud Logging agent is an optional but recommended component. See the SAP NetWeaver on Google Cloud operations guide for more information about Google Cloud logging.
To install the Cloud Logging agent in your new VM, see the instructions for Linux and Windows in Installing the agent.
Install Google Cloud's Agent for SAP
Google Cloud's Agent for SAP is required for SAP support of SAP systems running on Google Cloud, including SAP NetWeaver, SAP HANA, SAP ASE, SAP MaxDB, and others.
When you install Google Cloud's Agent for SAP on a Compute Engine VM instance, for SAP Host Agent metrics, the agent combines monitoring data from Cloud Monitoring and the Compute Engine APIs and provides that data to the SAP Host Agent.
If you use the following RHEL or SLES "for SAP" OS images that Google Cloud provides, then Google Cloud's Agent for SAP is packaged with the OS images:
- RHEL: all "for SAP" images
- SLES: SLES 15 SP4 for SAP and later versions
For information about the operating systems supported by Google Cloud's Agent for SAP, see Supported operating systems.
Before you install Google Cloud's Agent for SAP, you need to ensure that the following prerequisites are met.
Set the required IAM roles
At a minimum, the
service account
that Google Cloud's Agent for SAP uses must include the
Compute Viewer (roles/compute.viewer
),
Monitoring Viewer (roles/monitoring.viewer
),
and Workload Manager Insights Writer (roles/workloadmanager.insightWriter
)
roles.
To add a required role to your service account, follow these steps:
In the Google Cloud console, go to the IAM page.
Select your Google Cloud project.
Identify the service account to which you want to add a role.
- If the service account isn't already on the principals list, then it doesn't have any roles assigned to it. Click Add and enter the email address of the service account.
- If the service account is already on the principals list, then it has existing roles. Click the Edit button for the service account that you want to edit.
Select the required role from the list of available roles:
- Compute Engine > Compute Viewer
- Monitoring > Monitoring Viewer
- Workload Manager > Workload Manager Insights Writer
Click Add or Save to apply the roles to the service account.
Enable access to Google Cloud APIs
Compute Engine recommends configuring your VM instances to allow all access scopes to all Cloud APIs and using only the IAM permissions of the instance service account to control access to Google Cloud resources. For more information, see Create a VM that uses a user-managed service account.
If you do limit access to the Cloud APIs, then Google Cloud's Agent for SAP requires the following minimum Cloud API access scopes on the host VM instance:
- Cloud Platform: Enabled
- Compute Engine: Read Only
- Stackdriver Monitoring API: Read Only
If you are running SAP applications on a VM instance that does not have an external IP address, then you need to enable Private Google Access on the VM's subnet so that Google Cloud's Agent for SAP can access Google APIs and services. To enable Private Google Access on a subnet, see Configuring Private Google Access.
Install the Google Cloud's Agent for SAP
To install the agent on a VM instance, follow these steps:
- Use RDP to connect to the VM instance.
- As an administrator, run the following command from PowerShell:
googet addrepo google-cloud-sap-agent https://packages.cloud.google.com/yuck/repos/google-cloud-sap-agent-windows googet install google-cloud-sap-agent
After you install Google Cloud's Agent for SAP and the SAP Host Agent, validate the installation of Google Cloud's Agent for SAP, as described in Validate your installation of the agent.
Installing SAP NetWeaver
For instructions on installing SAP NetWeaver on your new VM, see the SAP help portal and the SAP NetWeaver Master Guide.
After you install SAP NetWeaver:
Update the SAP kernel to the minimum supported patch level.
For details on the supported SAP kernel patch levels, see SAP Note 2456953 - Windows on Google Cloud (IaaS): Adaptation of your SAP License.
Install your permanent SAP NetWeaver license.
For more information from SAP about managing your SAP NetWeaver licenses, see SAP Licensing Procedure.
Installing the SAP Host Agent
The SAP Host Agent has been enhanced for running on Google Cloud. Ensure that you run at least the minimum SAP Host Agent version required for the Google Cloud environment.
For details, refer to the following SAP Notes:
- SAP Note 1409604 - Virtualization on Windows: Enhanced Monitoring.
- To update your SAP Host Agent by default on a regular basis, see SAP Note 1473974 - Using the SAP Host Agent Auto Upgrade Feature.
Validate your installation of Google Cloud's Agent for SAP
After you have deployed a VM and installed your SAP system, validate that Google Cloud's Agent for SAP is functioning properly.
Verify that Google Cloud's Agent for SAP is running
To verify that the agent is running, follow these steps:
Use RDP to connect to the VM instance.
As an administrator, run the following command from PowerShell:
$(Get-Service -Name 'google-cloud-sap-agent' -ErrorAction Ignore).Status
If the agent is running, then the status showsRunning
.
If the agent isn't running, then restart the agent.
Verify that SAP Host Agent is receiving metrics
To verify that the infrastructure metrics are collected by Google Cloud's Agent for SAP and sent correctly to the SAP Host Agent, follow these steps:
- In your SAP system, enter transaction
ST06
. In the overview pane, check the availability and content of the following fields for the correct end-to-end setup of the SAP and Google monitoring infrastructure:
- Cloud Provider:
Google Cloud Platform
- Enhanced Monitoring Access:
TRUE
- Enhanced Monitoring Details:
ACTIVE
- Cloud Provider:
Deploying a 3-tier scale-out system
The steps to deploy each VM in a 3-tier system are very similar to the steps for deploying the example system. In a 3-tier scale-out system, you deploy several VMs, all in the same zone:
- A primary VM that runs the SAP NetWeaver application server (AS) and ABAP central services. This VM also hosts a shared file system that contains the shared profile and must be accessible from each VM that runs SAP NetWeaver in the system.
- Some number of additional VMs that run the AS, for scaling purposes.
- A VM that is dedicated to the central database.
The high-level steps are as follows:
Create the VM that hosts the database and then install the database. If you used a Compute Engine image that includes SQL Server, the database is already installed.
Create the primary instance.
- Run SWPM on the first VM that you want to run SAP NetWeaver.
- Install central services.
- Install the AS.
- Point to the existing database.
Create additional instances.
- Run SWPM on each additional VM that you want to run SAP NetWeaver.
- Install the AS.
- Point to the existing database.
- Point to the network share that contains the profiles and is managed by the primary instance.
Troubleshooting
This section contains information about how to correct common issues.
Troubleshooting communication problems to the database server
If you are setting up a 3-tier SAP system and having connection issues between your VMs, ensure that you have created a firewall rule to allow traffic between VMs on your subnetwork.
Troubleshooting Google Cloud's Agent for SAP
To troubleshoot Google Cloud's Agent for SAP, see the Google Cloud's Agent for SAP troubleshooting guide.