SAP ASE deployment guide for Windows

This deployment guide shows you how to deploy and connect to a Compute Engine virtual machine (VM) that is ready for the installation of SAP Adaptive Server Enterprise (ASE) on a Windows Server operating system.

The instructions in this guide use Cloud Deployment Manager to deploy and configure the VM, the Windows Server operating system, and the required disk volumes for SAP ASE.

For details on planning your deployment, see the SAP ASE planning guide.


If you do not already have a Google Cloud project with billing enabled, you must create one before you can deploy a VM for your SAP ASE installation.

To create a project:

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
  2. In the Google Cloud Console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Cloud project. Learn how to confirm that billing is enabled for your project.

Configuring the gcloud command environment

These instructions use Cloud Shell to enter gcloud commands that deploy or configure your Google Cloud resources. Cloud Shell is accessed through the Cloud Console in your browser.

Cloud Shell runs on a VM that Google Cloud provisions each time you start Cloud Shell. The first time you use Cloud Shell, Google Cloud also creates a persistent $HOME directory for you, which is restored each time you open Cloud Shell.

The provisioned VM includes the latest Cloud SDK, which provides the gcloud command-line interface. Therefore, the gcloud commands that you use in Cloud Shell are the same as those you would use in a locally installed instance of the Cloud SDK.

If you have the Cloud SDK installed, you can issue the gcloud commands that are used in these instructions from your local machine. However, with a locally installed Cloud SDK you must always make sure that you are using the latest version of the Cloud SDK.

Whether you use Cloud Shell or Cloud SDK, you can can set and change the properties of your gcloud command environment and save them as a configuration. Configurations are collections of key-value pairs that influence the behavior of the gcloud commands.

Some basic actions you can take with a configuration in Cloud Shell include:

  • Initialize a configuration with gcloud init.

  • Check the settings of your current gcloud configuration with gcloud config list.

  • Change the Google Cloud project you are working in with gcloud config set project [PROJECT_ID] where [PROJECT_ID] represents your Google Cloud project.

  • Set a default region with gcloud config set compute/region [REGION] where [REGION] represents a Google Cloud region.

  • Set a default zone with gcloud config set compute/zone [ZONE] where [ZONE] represents a Google Cloud zone.

  • Create a new configuration with gcloud config configurations create [NAME] where [NAME] represents the name for the configuration.

For more information about working with configurations, see Managing Cloud SDK configurations.

Creating a network

For security purposes, create a new network. You can control who has access by adding firewall rules or by using another access control method.

If your project has a default VPC network, don't use it. Instead, create your own VPC network so that the only firewall rules in effect are those that you create explicitly.

During deployment, VM instances typically require access to the internet to download Google's monitoring agent. If you are using one of the SAP-certified Linux images that are available from Google Cloud, the VM instance also requires access to the internet in order to register the license and to access OS vendor repositories. A configuration with a NAT gateway and with VM network tags supports this access, even if the target VMs do not have external IPs.

To set up networking:

  1. Go to Cloud Shell.

    Go to Cloud Shell

  2. To create a new network in the custom subnetworks mode, run:

    gcloud compute networks create [YOUR_NETWORK_NAME] --subnet-mode custom

    where [YOUR_NETWORK_NAME] is the name of the new network. The network name can contain only lowercase characters, digits, and the dash character (-).

    Specify --subnet-mode custom to avoid using the default auto mode, which automatically creates a subnet in each Compute Engine region. For more information, see Subnet creation mode.

  3. Create a subnetwork, and specify the region and IP range:

    gcloud compute networks subnets create [YOUR_SUBNETWORK_NAME] \
            --network [YOUR_NETWORK_NAME] --region [YOUR_REGION] --range [YOUR_RANGE]


    • [YOUR_SUBNETWORK_NAME] is the new subnetwork.
    • [YOUR_NETWORK_NAME] is the name of the network you created in the previous step.
    • [REGION] is the region where you want the subnetwork. If you are using SAP ASE with SAP NetWeaver, use a region that is supported for SAP NetWeaver.
    • [YOUR_RANGE] is the IP address range, specified in CIDR format, such as If you plan to add more than one subnetwork, assign non-overlapping CIDR IP ranges for each subnetwork in the network. Note that each subnetwork and its internal IP ranges are mapped to a single region.
  4. Optionally, repeat the previous step and add additional subnetworks.

Setting up a NAT gateway

If you need to create one or more VMs without public IP addresses, you need to use network address translation (NAT) to enable the VMs to access the internet. Use Cloud NAT, a Google Cloud distributed, software-defined managed service that lets VMs send outbound packets to the internet and receive any corresponding established inbound response packets. Alternatively, you can set up a separate VM as a NAT gateway.

To create a Cloud NAT instance for your project, see Using Cloud NAT.

After you configure Cloud NAT for your project, your VM instances can securely access the internet without a public IP address.

Adding firewall rules

By default, an implied firewall rule blocks incoming connections from outside your Virtual Private Cloud (VPC) network. To allow incoming connections, set up a firewall rule for your VM. After an incoming connection is established with a VM, traffic is permitted in both directions over that connection.

You can also create a firewall rule to allow external access to specified ports, or to restrict access between VMs on the same network. If the default VPC network type is used, some additional default rules also apply, such as the default-allow-internal rule, which allows connectivity between VMs on the same network on all ports.

Depending on the IT policy that is applicable to your environment, you might need to isolate or otherwise restrict connectivity to your database host, which you can do by creating firewall rules.

Depending on your scenario, you can create firewall rules to allow access for:

  • ASE network listener for client connections. The default ASE port number is 5000.
  • The ports required by SAP ASE Cockpit. For a list of ports that ASE Cockpit uses, see the SAP ASE Cockpit documentation in the SAP Help Portal.
  • The default SAP ports that are listed in TCP/IP of All SAP Products.
  • Connections from your computer or your corporate network environment to your Compute Engine VM instance. If you are unsure of what IP address to use, talk to your company's network administrator.
  • Communication between VMs in the SAP HANA subnetwork, including communication between nodes in an SAP HANA scale-out system or communication between the database server and application servers in a 3-tier architecture. You can enable communication between VMs by creating a firewall rule to allow traffic that originates from within the subnetwork.
  • RDP connections to your VM instance. The default RDP port number is 3389.
  • PowerShell connections to your VM instance. The default RDP port number is 5986.

To create a firewall rule:


  1. In the Cloud Console, go to the Firewall rules page.


  2. At the top of the page, click Create firewall rule.

    • In the Network field, select the network where your VM is located.
    • In the Targets field, specify the resources on Google Cloud that this rule applies to. For example, specify All instances in the network. Or to to limit the rule to specific instances on Google Cloud, enter tags in Specified target tags.
    • In the Source filter field, select one of the following:
      • IP ranges to allow incoming traffic from specific IP addresses. Specify the range of IP addresses in the Source IP ranges field.
      • Subnets to allow incoming traffic from a particular subnetwork. Specify the subnetwork name in the following Subnets field. You can use this option to allow access between the VMs in a 3-tier or scaleout configuration.
    • In the Protocols and ports section, select Specified protocols and ports and enter tcp:[PORT_NUMBER].
  3. Click Create to create your firewall rule.


Create a firewall rule by using the following command:

$ gcloud compute firewall-rules create firewall-name
--direction=INGRESS --priority=1000 \
--network=network-name --action=ALLOW --rules=protocol:port \
--source-ranges ip-range --target-tags=network-tags

Deploying a Windows VM for SAP ASE with Deployment Manager

The following instructions use Deployment Manager to deploy a VM instance with Windows and all of the persistent disks that SAP ASE requires. You define the values for the installation in a Deployment Manager configuration file template.

Deployment Manager treats all of the resources that are created for the SAP ASE system as a single entity called a deployment. You can view all of the deployments for your GCP project on the Deployments page in the Cloud Console.

The following instructions use Cloud Shell, but if you prefer, you can use the Cloud SDK in your local terminal instead.

  1. Open the Cloud Shell.

    Go to the Cloud Shell

  2. Download the template.yaml configuration file template to your working directory by entering the following command in the Cloud Shell:

  3. Optionally, rename the template.yaml file to identify the configuration it defines.

  4. Open the template.yaml file in Cloud Shell code editor.

    To open the Cloud Shell code editor, click the pencil icon in the upper-right corner of the Cloud Shell terminal window.

  5. In the template.yaml file, update the following property values by replacing the brackets and their contents with the values for your installation.

    Property Data type Description
    type String

    Specifies the location, type, and version of the Deployment Manager template to use during deployment.

    The YAML file includes two type specifications, one of which is commented out. The type specification that is active by default specifies the template version as latest. The type specification that is commented out specifies a specific template version with a timestamp.

    If you need all of your deployments to use the same template version, use the type specification that includes the timestamp.

    instanceName String The name of the VM instance on which SAP ASE will be installed. The name must be 13 characters or less and be specified in lowercase letters, numbers, or hyphens.
    instanceType String The type of Compute Engine virtual machine on which SAP ASE will be installed. If you are running SAP ASE with SAP NetWeaver on the same VM, select a machine type that includes enough CPUs and memory to support both systems. See the SAP NetWeaver Planning Guide.
    zone String The zone in which you are deploying your SAP ASE. It must be in the same region that you selected for your subnetwork.
    subnetwork String The name of the subnetwork that you created in a previous step. If you are deploying to a shared VPC, specify this value as [SHAREDVPC_PROJECT]/[SUBNETWORK]. For example, myproject/network1.
    windowsImage String The name of the Windows operating- system image or image family that you are using with SAP ASE. To specify an image family, add the prefix family/ to the family name. For example, family/windows-2012-r2. To specify a specific image, specify only the image name. For the list of available image families, see the Images page in the Cloud console.
    windowsImageProject String The Google Cloud project that contains the image you are going to use. This project might be your own project or a Google Cloud image project, such as windows-cloud. For a list of GCP image projects, see the Images page in the Compute Engine documentation.
    asesidSize Integer The size in GB of ASE (D:), which is the root directory of the database instance.
    asesaptempSize Integer The size of ASE Temp (T:), which holds the database temporary table space.
    asesapdataSize Integer The size of ASE Data (E:), which holds the database data files. In the deployed VM, this volume is labeled `ASE Data`.
    aselogSize Integer The size of ASE Log (L:), which holds the database transaction logs. In the deployed VM, this volume is labeled `ASE Log`.
    asebackupSize Integer The size of Backup (X:). If set to 0 or omitted, no disk is created. In the deployed VM, this volume is labeled `Backup`.
    asesapdataSSD boolean The SSD toggle for the data drive. If set to true, the data disk will be SSD.
    aselogSSD boolean The SSD toggle for the log drive. If set to true, the log disk will be SSD.
    usrsapSize Integer Required only if you are installing SAP ASE to run with SAP NetWeaver on the same VM instance. In the deployed VM, this volume is labeled SAP (S:).
    swapSize Integer Required only if you are installing SAP ASE to run with SAP NetWeaver on the same VM instance. In the deployed VM, this volume is labeled Pagefile (P:).

    The following configuration file creates a VM that is configured to run both the SAP ASE database server and SAP NetWeaver. The configuration file directs Deployment Manager to deploy an n1-standard-16 virtual that is running a Windows Server 2012 operating system. The VM includes all of the directories that are required to run SAP ASE with NetWeaver.

    - name: sap_ase-win
      # By default, this configuration file uses the latest release of the deployment
      # scripts for SAP on Google Cloud.  To fix your deployments to a specific release
      # of the scripts, comment out the type property above and uncomment the type property below.
      # type:
        instanceName: ex-vm-ase-win
        instanceType: n1-standard-16
        zone: us-central1-f
        subnetwork: example-sub-network
        windowsImage: family/windows-2012-r2
        windowsImageProject: windows-cloud
        asesidSize: 10
        asesaptempSize: 20
        asesapdataSize: 50
        aselogSize: 30
        asebackupSize: 100
        asesapdataSSD: Yes
        aselogSSD: Yes
        usrsapSize: 15
        swapSize: 24
  6. Deploy the VM:

    gcloud deployment-manager deployments create [DEPLOYMENT-NAME] --config [TEMPLATE-NAME].yaml

    The above command invokes the Deployment Manager, which deploys the VM, all according to the specifications in your template.yaml file. The process might take a few minutes. To check the progress of your deployment, follow the steps in the next section.

Verifying deployment

  1. Open Cloud Logging to check for errors and monitor the progress of the installation.

    Go to Cloud Logging

  2. On the Resources tab, select Global as your logging resource. If "INSTANCE DEPLOYMENT COMPLETE" is displayed for a VM, Deployment Manager processing is complete for the VM.

    Cloud Logging display.

  3. After the SAP ASE system deploys without errors, connect to your VM as described in the next section, Connecting to your VM, to confirm that all of the required data volumes exist and that they have the expected capacities. The Pagefile drive should be almost full.

    Disk drives created by Deployment Manager for ASE.

If any of the validation steps show that the installation failed:

  1. Correct the error.
  2. On the Deployments page, delete the deployment to clean up the VMs and persistent disks from the failed installation.
  3. Rerun your deployment.

Connecting to your VM

To connect to a Windows-based VM, you must first generate a password for the VM. After you have a password, you can connect to the VM using RDP or PowerShell.

Generating passwords

To generate or reset a password for a Windows VM on Google Cloud:

  1. Go to the VM instances page.


  2. Open the VM instance details page by clicking the name of the VM that you just created.

    VM name on the VM instances page.

  3. On the instance details page, click the Set Windows Password button. A password is generated for you. Copy the password and store it in a secure place.

    Set Windows password by clicking button on VM instance details page.

Using RDP

You can use RDP to connect to a Windows instance and start a Remote Desktop session. To connect to your VM by using PowerShell, see Using PowerShell.

Connect to the remote desktop on Windows instances using one of the following methods:

  • If you use the Chrome browser, you can connect through the Chrome RDP for Google Compute Engine extension from Fusion Labs. This extension allows you to connect through the Cloud Console.
  • Download the RDP file and manually connect through the Windows Remote Desktop Connection client or a third-party client.


  1. Go to the VM instances page in the in the Cloud Console.

    Go to the VM Instances pages

  2. Click the RDP button next to the instance that you want to connect to. A new browser window opens with the Chrome RDP for Google Compute Engine extension.

  3. Enter your username and password. If this is your first time connecting to this instance, or if you have forgotten your password, create or reset your Windows password.

  4. Click OK to connect.

RDP Client

  1. Install an RDP client. If you don't have a preference, install the Chrome RDP for Google Compute Engine extension.
  2. Get your Windows VM's external IP address. Go to the VM instances page in the Cloud Console or run gcloud compute instances list to see a list of your instances with their external IP values.
  3. In your RDP client, provide your VM's external IP address as the IP address to connect to. For example, in the Chrome RDP extension, you would enter the IP address in the following format:

    Screenshot of the instance creation window with the required options set

  4. Enter your sign-in information and leave the Domain field blank. If this is your first time connecting to this VM, or if you have forgotten your password, create or reset your Windows password.

    Screenshot of the instance creation window with the required options set

Using PowerShell

  1. If you have not created a username and password on the Windows VM yet, create your Windows password.
  2. Add a firewall rule or edit your existing firewall rule to open port 5986 on the GCP network where your Windows Server VM is located.
  3. On your local workstation, open the PowerShell terminal.
  4. Optionally, you can initialize a variable to hold your user credentials so you do not need to enter them each time you connect to the instance. If you skip this step, you receive a prompt for your username and password later.

    $credentials = Get-Credential
  5. Use the Enter-PSSession command to start a remote PowerShell session and include the flags to use SSL and skip credentials checks.

    Enter-PSSession -ComputerName [IP_ADDRESS] -UseSSL -SessionOption
    (New-PSSessionOption -SkipCACheck -SkipCNCheck) -Credential $credentials

Installing the database

Now that your Windows operating system is configured, you can install your SAP ASE database.

To install SAP ASE on your VM:

  1. Use RDP or Windows PowerShell to connect to your Windows-based VM.
  2. Download or copy your SAP ASE installation media from SAP to your VM.
  3. Prepare your SAP ASE SySAM license file or license server for use with the installation.
  4. Install the SAP ASE database. See the SAP ASE installation and upgrade guide for Windows for guidance.

If you are using the always-on HADR option, repeat the above steps for your standby server. For additional HADR installation and configuration details, see the SAP ASE HADR users guide.

Performing post-deployment tasks

Before using your SAP ASE instance, we recommend that you perform the following post-deployment steps:

  1. Update your SAP ASE software with the latest patches, if available.
  2. Install any additional components.
  3. Configure and back up your new SAP ASE database.

For additional post-deployment guidance, see the Post-installation Tasks section of the SAP ASE installation and upgrade guide for Windows.