您现在访问的是微软AZURE全球版技术文档网站,若需要访问由世纪互联运营的MICROSOFT AZURE中国区技术文档网站,请访问 https://docs.azure.cn.

SAP HANA(大型实例)网络体系结构SAP HANA (Large Instances) network architecture

Azure 网络服务的体系结构是在 HANA 大型实例上成功部署 SAP 应用程序的关键组件。The architecture of Azure network services is a key component of the successful deployment of SAP applications on HANA Large Instance. 通常,Azure 上的 SAP HANA(大型实例)部署具有较大的 SAP 布局和多种不同的 SAP 解决方案,其中具有可变的数据库大小、CPU 资源消耗和内存利用。Typically, SAP HANA on Azure (Large Instances) deployments have a larger SAP landscape with several different SAP solutions with varying sizes of databases, CPU resource consumption, and memory utilization. 可能并非所有 IT 系统都已位于 Azure 中。It's likely that not all IT systems are located in Azure already. 你的 SAP 布局通常也是混合的,它从 DBMS 点和 SAP 应用程序的角度来看,同时使用 NetWeaver 和 S/4HANA 以及 SAP HANA 与其他 DBMS。Your SAP landscape is often hybrid as well from a DBMS point and SAP application point of view using a mixture of NetWeaver, and S/4HANA and SAP HANA and other DBMS. Azure 提供了不同的服务,可让你在 Azure 中运行不同的 DBMS、NetWeaver 和 S/4HANA 系统。Azure offers different services that allow you to run the different DBMS, NetWeaver, and S/4HANA systems in Azure. Azure 还提供网络技术,使 Azure 看起来像虚拟数据中心,以实现本地软件部署Azure also offers you network technology to make Azure look like a virtual data center to your on-premises software deployments

除非你的完整 IT 系统托管在 Azure 中。Unless your complete IT systems are hosted in Azure. Azure 网络功能用于将本地环境连接到 Azure 资产,使 Azure 看起来像你的虚拟数据中心。Azure networking functionality is used to connect the on-premises world with your Azure assets to make Azure look like a virtual datacenter of yours. 使用的 Azure 网络功能是:The Azure network functionality used is:

  • Azure 虚拟网络连接到连接到本地网络资产的 ExpressRoute 线路。Azure virtual networks are connected to the ExpressRoute circuit that connects to your on-premises network assets.
  • 将本地连接到 Azure 的 ExpressRoute 线路的最小带宽应为 1 Gbps 或更高An ExpressRoute circuit that connects on-premises to Azure should have a minimum bandwidth of 1 Gbps or higher. 规定这个最小带宽是为了确保在本地系统与在 VM 上运行的系统之间传输数据。This minimal bandwidth allows adequate bandwidth for the transfer of data between on-premises systems and systems that run on VMs. 此外,还能提供足够的带宽从本地最终用户到 Azure 系统的连接。It also allows adequate bandwidth for connection to Azure systems from on-premises users.
  • 在虚拟网络中设置 Azure 中的所有 SAP 系统以相互通信。All SAP systems in Azure are set up in virtual networks to communicate with each other.
  • 本地托管的 Active Directory 和 DNS 通过 ExpressRoute 从本地扩展到 Azure,或者在 Azure 中运行已完成。Active Directory and DNS hosted on-premises are extended into Azure through ExpressRoute from on-premises, or are running complete in Azure.

对于将 HANA 大型实例集成到 Azure 数据中心网络结构的特定情况,还将使用 Azure ExpressRoute 技术For the specific case of integrating HANA Large Instances into the Azure data center network fabric, Azure ExpressRoute technology is used as well

备注

仅一个 Azure 订阅只能链接到特定 Azure 区域中 HANA 大型实例标记中的一个租户。Only one Azure subscription can be linked to only one tenant in a HANA Large Instance stamp in a specific Azure region. 相反,单个 HANA 大型实例戳记租户只能链接到一个 Azure 订阅。Conversely, a single HANA Large Instance stamp tenant can be linked to only one Azure subscription. 此要求与 Azure 中的任何其他计费对象一致。This requirement is consistent with other billable objects in Azure.

如果在 Azure 上 SAP HANA (大型实例) 部署在多个不同的 Azure 区域中,则在 HANA 大型实例模具中部署单独的租户。If SAP HANA on Azure (Large Instances) is deployed in multiple different Azure regions, a separate tenant is deployed in the HANA Large Instance stamp. 可在同一 Azure 订阅下运行这两个实例,只要这些实例属于同一 SAP 布局即可。You can run both under the same Azure subscription as long as these instances are part of the same SAP landscape.

重要

) SAP HANA Azure (大型实例仅支持 Azure 资源管理器部署方法。Only the Azure Resource Manager deployment method is supported with SAP HANA on Azure (Large Instances).

其他虚拟网络信息Additional virtual network information

若要将虚拟网络连接到 ExpressRoute,必须创建 Azure ExpressRoute 网关。To connect a virtual network to ExpressRoute, an Azure ExpressRoute gateway must be created. 有关详细信息,请参阅 关于 expressroute 的 expressroute 网关For more information, see About Expressroute gateways for ExpressRoute.

使用 Azure ExpressRoute 网关与 Azure 外部的基础结构或 Azure 大型实例标记。An Azure ExpressRoute gateway is used with ExpressRoute to an infrastructure outside of Azure or to an Azure Large Instance stamp. 可以将 Azure ExpressRoute 网关连接到最多四个不同的 ExpressRoute 线路,只要这些连接来自不同的 Microsoft 企业边缘路由器。You can connect the Azure ExpressRoute gateway to a maximum of four different ExpressRoute circuits as long as those connections come from different Microsoft enterprise edge routers. 有关详细信息,请参阅 Azure 上的 SAP HANA(大型实例)的基础结构和连接For more information, see SAP HANA (Large Instances) infrastructure and connectivity on Azure.

备注

对于 ExpressRoute 网关,可以使用 ExpressRoute 连接实现的最大吞吐量为 10 Gbps。The maximum throughput you can achieve with a ExpressRoute gateway is 10 Gbps by using an ExpressRoute connection. 在位于虚拟网络中的 VM 与本地系统之间复制文件(使用单一复制流)不会获得各种网关 SKU 的完整吞吐量。Copying files between a VM that resides in a virtual network and a system on-premises (as a single copy stream) doesn't achieve the full throughput of the different gateway SKUs. 若要利用 ExpressRoute 网关的完整带宽,请使用多个流。To leverage the complete bandwidth of the ExpressRoute gateway, use multiple streams. 或者,必须采用单一文件的并行流复制各个文件。Or you must copy different files in parallel streams of a single file.

HANA 大型实例的网络体系结构Networking architecture for HANA Large Instance

HANA 大型实例的网络体系结构可以分为四个不同的部分:The networking architecture for HANA Large Instance can be separated into four different parts:

  • 本地网络和到 Azure 的 ExpressRoute 连接。On-premises networking and ExpressRoute connection to Azure. 此部分是客户域,通过 ExpressRoute 连接到 Azure。This part is the customer's domain and is connected to Azure through ExpressRoute. 此 Expressroute 线路完全由你作为客户支付。This Expressroute circuit is fully paid by you as a customer. 带宽应该足够大,能够处理本地资产与连接到的 Azure 区域之间的网络流量。The bandwidth should be large enough to handle the network traffic between your on-premises assets and the Azure region you are connecting against. 请参阅下图右下方。See the lower right in the following figure.
  • 如前所述,Azure 网络服务与虚拟网络一起讨论,后者又需要添加 ExpressRoute 网关。Azure network services, as previously discussed, with virtual networks, which again need ExpressRoute gateways added. 此部件是需要根据应用程序要求以及安全性和符合性要求找到合适设计的区域。This part is an area where you need to find the appropriate designs for your application requirements, security, and compliance requirements. 使用 HANA 大型实例是另一个考虑点,需要考虑到虚拟网络数以及可供选择的 Azure 网关 SKU。Whether you use HANA Large Instance is another point to consider in terms of the number of virtual networks and Azure gateway SKUs to choose from. 请参阅下图右上方。See the upper right in the figure.
  • 通过 ExpressRoute 技术将 HANA 大型实例连接到 Azure 中。Connectivity of HANA Large Instance through ExpressRoute technology into Azure. 此部件已部署,由 Microsoft 处理。This part is deployed and handled by Microsoft. 你只需提供一些 IP 地址范围,在将资产部署到 HANA 大型实例中后,再将 ExpressRoute 线路连接到虚拟网络。All you need to do is provide some IP address ranges after the deployment of your assets in HANA Large Instance connect the ExpressRoute circuit to the virtual networks. 有关详细信息,请参阅 Azure 上的 SAP HANA(大型实例)的基础结构和连接For more information, see SAP HANA (Large Instances) infrastructure and connectivity on Azure. 对于 Azure 数据中心网络结构与 HANA 大型实例单位之间的连接,客户不需要支付额外的费用。There is no additional fee for you as a customer for the connectivity between the Azure data center network fabric and HANA Large Instance units.
  • HANA 大型实例戳记中的网络,这对您来说是透明的。Networking within the HANA Large Instance stamp, which is mostly transparent for you.

连接到了 Azure 上的 SAP HANA(大型实例)和本地的虚拟网络

使用 HANA 大型实例这一事实并不会改变将本地资产通过 ExpressRoute 连接到 Azure 这一要求,The requirement that your on-premises assets must connect through ExpressRoute to Azure doesn't change because you use HANA Large Instance. 也不会改变使用一个或多个虚拟网络这一要求。虚拟网络运行的 Azure VM 托管应用层,该层连接到托管在 HANA 大型实例单位中的 HANA 实例。The requirement to have one or multiple virtual networks that run the VMs, which host the application layer that connects to the HANA instances hosted in HANA Large Instance units, also doesn't change.

Azure 中 SAP 部署的差别如下:The differences to SAP deployments in Azure are:

  • 客户租户的 HANA 大型实例单位通过另一 ExpressRoute 线路连接到虚拟网络中。The HANA Large Instance units of your customer tenant are connected through another ExpressRoute circuit into your virtual networks. 为了隔离负载条件,本地到 Azure 虚拟网络 ExpressRoute 线路和 Azure 虚拟网络与 HANA 大型实例之间的线路不共享相同的路由器。To separate load conditions, the on-premises to Azure virtual network ExpressRoute circuits and the circuits between Azure virtual networks and HANA Large Instances don't share the same routers.
  • 在 SAP 应用层和 HANA 大型实例之间的工作负荷配置文件在本质上不同于包含多个小型请求的迸发型数据传输(结果集),后者是从 SAP HANA 传输到应用层中。The workload profile between the SAP application layer and the HANA Large Instance is of a different nature, with many small requests and bursts like data transfers (result sets) from SAP HANA into the application layer.
  • 与数据在本地和 Azure 之间交换的典型方案相比,SAP 应用程序体系结构对网络延迟更为敏感。The SAP application architecture is more sensitive to network latency than typical scenarios where data is exchanged between on-premises and Azure.
  • Azure ExpressRoute 网关具有至少两个 ExpressRoute 连接。The Azure ExpressRoute gateway has at least two ExpressRoute connections. 一个从本地连接的线路,另一个从 HANA 大型实例连接的线路。One circuit that is connected from on-premises and one that is connected from HANA Large Instances. 这只是为了使不同 Msee 中的另一条额外线路连接到 ExpressRoute 网关。This leaves only room for another two additional circuits from different MSEEs to connect to on ExpressRoute Gateway. 此限制与 ExpressRoute 快速路径的使用无关。This restriction is independent of the usage of ExpressRoute Fast Path. 所有连接的线路均共享 ExpressRoute 网关传入数据的最大带宽。All the connected circuits share the maximum bandwidth for incoming data of the ExpressRoute gateway.

在 HANA 大型实例戳记的修订版3中,Vm 与 HANA 大型实例单元之间经历的网络延迟可能高于典型的 VM 到 VM 网络往返延迟。With Revision 3 of HANA Large Instance stamps, the network latency experienced between VMs and HANA Large Instance units can be higher than a typical VM-to-VM network round-trip latency. 测量到的值可能超过 0.7 毫秒的往返延迟,具体取决于 Azure 区域。而在 SAP 说明 #1100926 - 常见问题解答:网络性能中,0.7 毫秒被归类为低于平均值。Dependent on the Azure region, the values measured can exceed the 0.7-ms round-trip latency classified as below average in SAP Note #1100926 - FAQ: Network performance. 依赖于 Azure 区域和工具来测量 Azure VM 和 HANA 大型实例单元之间的网络往返延迟,所测量的延迟可以达到或大约 2 毫秒。Dependent on Azure Region and tool to measure network round-trip latency between an Azure VM and HANA Large Instance unit, the measured latency can be up to and around 2 milliseconds. 尽管如此,客户在 SAP HANA 大型实例上部署基于 SAP HANA 的生产型 SAP 应用程序很成功。Nevertheless, customers deploy SAP HANA-based production SAP applications successfully on SAP HANA Large Instance. 请确保在 Azure HANA 大型实例中对自己的业务流程进行彻底的测试。Make sure you test your business processes thoroughly in Azure HANA Large Instance. 新功能称为 ExpressRoute 快速路径,可减少 Azure 中 HANA 大型实例和应用程序层 Vm 之间的网络延迟, (参见下面) 。A new functionality, called ExpressRoute Fast Path, is able to reduce the network latency between HANA Large Instances and application layer VMs in Azure substantially (see below).

在版本为 HANA 大型实例标记的情况下,如 SAP 说明 #1100926-常见问题解答:如果配置了 Azure ExpressRoute Fast 路径,则在 SAP 说明-常见问题解答:网络性能 (如果已配置 Azure ExpressRoute 快速路径 (请参阅下) 中所述)与在 Hana 大型实例戳记附近部署的 Azure vm 之间的网络延迟。With Revision 4 of HANA Large Instance stamps, the network latency between Azure VMs that are deployed in proximity to the HANA Large Instance stamp, is experienced to meet the average or better than average classification as documented in SAP Note #1100926 - FAQ: Network performance if Azure ExpressRoute Fast Path is configured (see below). 若要部署接近于版本4的 HANA 大型实例单元的 Azure Vm,需利用 Azure 邻近性放置组In order to deploy Azure VMs in close proximity to HANA Large Instance units of Revision 4, you need to leverage Azure Proximity Placement Groups. 对于 sap 应用程序的最佳网络延迟,Azure 邻近性放置组中介绍了如何使用近程放置组来查找同一 azure 数据中心内的 sap 应用程序层(如修订版4托管 HANA 大型实例单位)。The way how proximity placement groups can be used to locate the SAP application layer in the same Azure datacenter as Revision 4 hosted HANA Large Instance units is described in Azure Proximity Placement Groups for optimal network latency with SAP applications.

若要在 Vm 和 HANA 大型实例之间提供确定性网络延迟,请选择 ExpressRoute 网关 SKU。To provide deterministic network latency between VMs and HANA Large Instance, the choice of the ExpressRoute gateway SKU is essential. 不同于本地与 VM 之间的流量模式,VM 与 HANA 大型实例之间的流量模式可能是这样的:一开始流量很小,但随着要传输的请求和数据量的增多,可能会出现流量突然增高的迸发现象。Unlike the traffic patterns between on-premises and VMs, the traffic pattern between VMs and HANA Large Instance can develop small but high bursts of requests and data volumes to be transmitted. 为了应对这种迸发现象,我们强烈建议使用 UltraPerformance 网关 SKU。To handle such bursts well, we highly recommend the use of the UltraPerformance gateway SKU. 对于类型 II 类 HANA 大型实例 Sku,将 UltraPerformance 网关 SKU 用作 ExpressRoute 网关是必需的。For the Type II class of HANA Large Instance SKUs, the use of the UltraPerformance gateway SKU as a ExpressRoute gateway is mandatory.

重要

假定所有的网络流量都位于 SAP 应用层与数据库层之间,则仅支持使用虚拟网络的 HighPerformance 或 UltraPerformance 网关 SKU 来连接到 Azure 上的 SAP HANA(大型实例)。Given the overall network traffic between the SAP application and database layers, only the HighPerformance or UltraPerformance gateway SKUs for virtual networks are supported for connecting to SAP HANA on Azure (Large Instances). 对于 HANA 大型实例类型 II Sku,只支持使用 UltraPerformance 网关 SKU 作为 ExpressRoute 网关。For HANA Large Instance Type II SKUs, only the UltraPerformance gateway SKU is supported as a ExpressRoute gateway. 使用 ExpressRoute 快速路径 (如下所示) Exceptions apply when using ExpressRoute Fast Path (see below)

ExpressRoute 快速路径ExpressRoute Fast Path

为了降低延迟,为托管 SAP 应用程序 Vm 的 Azure 虚拟网络提供了在5月2019的特定连接中引入和发布的 ExpressRoute 快速路径。To lower the latency, ExpressRoute Fast Path got introduced and released in May 2019 for the specific connectivity of HANA Large Instances to Azure virtual networks that host the SAP application VMs. 到目前为止,解决方案的主要差异在于: Vm 与 HANA 大型实例之间的数据流动不再通过 ExpressRoute 网关路由。The major difference to the solution rolled out so far, is, that the data flows between VMs and HANA Large Instances are not routed through the ExpressRoute gateway anymore. 相反,Azure 虚拟网络的子网 (s) 中分配的 Vm 会直接与专用企业边缘路由器进行通信。Instead the VMs assigned in the subnet(s) of the Azure virtual network are directly communicating with the dedicated enterprise edge router.

重要

ExpressRoute 快速路径功能要求运行 SAP 应用程序 Vm 的子网位于连接到 HANA 大型实例的同一 Azure 虚拟网络中。The ExpressRoute Fast Path functionality requires that the subnets running the SAP application VMs are in the same Azure virtual network that got connected to the HANA Large Instances. 位于 Azure 虚拟网络中的 Vm 与通过 Azure 虚拟网络直接连接到 HANA 大型实例单元对等互连VMs located in Azure virtual networks that are peered with the Azure virtual network connected directly to the HANA Large Instance units are not benefiting from ExpressRoute Fast Path. 作为典型的中心和辐射虚拟网络设计,在这种情况下,ExpressRoute 线路连接到中心虚拟网络和包含 SAP 应用程序层的虚拟网络 (轮辐) 正在对等互连,因此,通过 ExpressRoute 快速路径进行的优化将无法工作。As a result typical hub and spoke virtual network designs, where the ExpressRoute circuits are connecting against a hub virtual network and virtual networks containing the SAP application layer (spokes) are getting peered, the optimization by ExpressRoute Fast Path will not work. 在除了中,ExpressRoute 快速路径不支持用户定义的路由规则 (UDR) 。In addtion, ExpressRoute Fast Path does not support user defined routing rules (UDR) today. 有关详细信息,请参阅 ExpressRoute 虚拟网络网关和 FastPathFor more information, see ExpressRoute virtual network gateway and FastPath.

有关如何配置 ExpressRoute 快速路径的更多详细信息,请参阅将 虚拟网络连接到 HANA 大型实例的文档。For more details on how to configure ExpressRoute Fast Path, read the document Connect a virtual network to HANA large instances.

备注

需要 UltraPerformance ExpressRoute 网关才能使用 ExpressRoute 快速路径An UltraPerformance ExpressRoute gateway is required to have ExpressRoute Fast Path working

单个 SAP 系统Single SAP system

上面所示的本地基础结构通过 ExpressRoute 连接到 Azure。The on-premises infrastructure previously shown is connected through ExpressRoute into Azure. ExpressRoute 线路连接到 Microsoft 企业边缘路由器 (MSEE) 。The ExpressRoute circuit connects into a Microsoft enterprise edge router (MSEE). 有关详细信息,请参阅 ExpressRoute 技术概述For more information, see ExpressRoute technical overview. 建立路由后,它会连接到 Azure 主干。After the route is established, it connects into the Azure backbone.

备注

若要在 Azure 中运行 SAP 布局,请连接到距离 SAP 布局中的 Azure 区域最近的企业边缘路由器。To run SAP landscapes in Azure, connect to the enterprise edge router closest to the Azure region in the SAP landscape. HANA 大型实例戳通过专用企业边缘路由器设备进行连接,以最大限度地减少 Azure IaaS 中 Vm 与 HANA 大型实例标记之间的网络延迟。HANA Large Instance stamps are connected through dedicated enterprise edge router devices to minimize network latency between VMs in Azure IaaS and HANA Large Instance stamps.

托管 SAP 应用程序实例的 Vm 的 ExpressRoute 网关连接到一个连接到本地的 ExpressRoute 线路。The ExpressRoute gateway for the VMs that host SAP application instances are connected to one ExpressRoute circuit that connects to on-premises. 同一虚拟网络连接到一个专门用于连接大型实例模具的单独企业边缘路由器。The same virtual network is connected to a separate enterprise edge router dedicated to connecting to Large Instance stamps. 使用 ExpressRoute 快速路径,从 HANA 大型实例到 SAP 应用程序层 Vm 的数据流将不再通过 ExpressRoute 网关路由,从而减少网络往返延迟。Using ExpressRoute Fast Path, the data flow from HANA Large Instances to the SAP application layer VMs are not routed through the ExpressRoute gateway anymore and with that reduce the network round-trip latency.

此系统是单个 SAP 系统的直观示例。This system is a straightforward example of a single SAP system. SAP 应用层承载在 Azure 中。The SAP application layer is hosted in Azure. SAP HANA 数据库在 Azure 上的 SAP HANA(大型实例)上运行。The SAP HANA database runs on SAP HANA on Azure (Large Instances). 假设有 2 Gbps 或 10 Gbps 吞吐量的 ExpressRoute 网关带宽不表示瓶颈。The assumption is that the ExpressRoute gateway bandwidth of 2-Gbps or 10-Gbps throughput doesn't represent a bottleneck.

多个 SAP 系统或大型 SAP 系统Multiple SAP systems or large SAP systems

如果部署了多个 SAP 系统或大型 SAP 系统来连接到 Azure 上的 SAP HANA (大型实例) ,ExpressRoute 网关的吞吐量可能会成为瓶颈。If multiple SAP systems or large SAP systems are deployed to connect to SAP HANA on Azure (Large Instances), the throughput of the ExpressRoute gateway might become a bottleneck. 或者,需要在不同的 Azure 虚拟网络中隔离生产和非生产系统。Or you want to isolate production and non-production systems in different Azure virtual networks. 在这种情况下,请将应用层拆分成多个虚拟网络。In such a case, split the application layers into multiple virtual networks. 还可以针对以下案例创建用于连接到 HANA 大型实例的特殊虚拟网络:You also might create a special virtual network that connects to HANA Large Instance for cases such as:

  • 为承载 NFS 共享的 Azure 中的 VM 直接从 HANA 大型实例中的 HANA 实例执行备份Performing backups directly from the HANA instances in HANA Large Instance to a VM in Azure that hosts NFS shares.
  • 将从 HANA 大型实例单位大的备份或其他文件复制到在 Azure 中管理的磁盘空间。Copying large backups or other files from HANA Large Instance units to disk space managed in Azure.

使用独立的虚拟网络来托管 Vm,这些 Vm 用于管理存储,以便在 HANA 大型实例和 Azure 之间批量传输数据。Use a separate virtual network to host VMs that manage storage for mass transfer of data between HANA Large Instances and Azure. 这种安排避免了在为运行 SAP 应用程序层的 Vm 提供服务的 ExpressRoute 网关上,将大型文件或数据从 HANA 大型实例传输到 Azure 的影响。This arrangement avoids the effects of large file or data transfer from HANA Large Instance to Azure on the ExpressRoute gateway that serves the VMs that run the SAP application layer.

要获得缩放性更好的网络体系结构,请采取以下措施:For a more scalable network architecture:

  • 对于单个较大的 SAP 应用层,使用多个虚拟网络。Leverage multiple virtual networks for a single, larger SAP application layer.

  • 为所部署的每个 SAP 系统部署一个单独的虚拟网络,而不是将这些 SAP 系统集中放置在同一虚拟网络中的各个子网中。Deploy one separate virtual network for each SAP system deployed, compared to combining these SAP systems in separate subnets under the same virtual network.

    适用于 Azure 上的 SAP HANA(大型实例)的缩放性更好的网络体系结构:A more scalable networking architecture for SAP HANA on Azure (Large Instances):

跨多个虚拟网络部署 SAP 应用层

根据规则和限制,你希望在托管不同 SAP 系统的虚拟机的不同虚拟网络之间进行应用,你应该对这些虚拟网络对等互连。Dependent on the rules and restrictions, you want to apply between the different virtual networks hosting VMs of different SAP systems, you should peer those virtual networks. 有关虚拟网络对等互连的详细信息,请参阅虚拟网络对等互连For more information about virtual network peering, see Virtual network peering.

Azure 中的路由Routing in Azure

默认情况下,部署的三个网络路由注意事项对于 Azure 上的 SAP HANA (大型实例) 非常重要:By default deployment, three network routing considerations are important for SAP HANA on Azure (Large Instances):

  • SAP HANA Azure (大型实例,) 只能通过 Azure Vm 和专用 ExpressRoute 连接进行访问,而不是直接从本地访问。SAP HANA on Azure (Large Instances) can be accessed only through Azure VMs and the dedicated ExpressRoute connection, not directly from on-premises. 在 Microsoft 向你提供 HANA 大型实例单元后,不能立即从本地直接访问。Direct access from on-premises to the HANA Large Instance units, as delivered by Microsoft to you, isn't possible immediately. 传递路由限制是用于 SAP HANA 大型实例的当前 Azure 网络体系结构造成的。The transitive routing restrictions are due to the current Azure network architecture used for SAP HANA Large Instance. 需要进行直接访问的某些管理客户端和任何应用程序(例如在本地运行的 SAP Solution Manager)都无法连接到 SAP HANA 数据库。Some administration clients and any applications that need direct access, such as SAP Solution Manager running on-premises, can't connect to the SAP HANA database. 有关异常,请检查 "直接路由到 HANA 大型实例" 部分。For exceptions check the section 'Direct Routing to HANA Large Instances'.

  • 如果在两个不同的 Azure 区域部署了 HANA 大型实例单元用于进行灾难恢复,则会在过去应用相同的暂时性路由限制。If you have HANA Large Instance units deployed in two different Azure regions for disaster recovery, the same transient routing restrictions applied in the past. 换言之,一个区域中的 HANA 大型实例单元的 IP 地址 (例如,美国西部) 未路由到部署在另一个区域中的 HANA 大型实例单元 (例如,美国东部) 。In other words, IP addresses of a HANA Large Instance unit in one region (for example, US West) were not routed to a HANA Large Instance unit deployed in another region (for example, US East). 此限制独立于跨区域使用 Azure 网络对等互连,或者跨连接 ExpressRoute 线路(将 HANA 大型实例单元连接到虚拟网络)。This restriction was independent of the use of Azure network peering across regions or cross-connecting the ExpressRoute circuits that connect HANA Large Instance units to virtual networks. 有关图形表示形式,请参阅“在多个区域使用 HANA 大型实例单位”部分中的插图。For a graphic representation, see the figure in the section "Use HANA Large Instance units in multiple regions." 此限制在已部署的体系结构的基础上,禁止立即将 HANA 系统复制用作灾难恢复功能。This restriction, which came with the deployed architecture, prohibited the immediate use of HANA System Replication as disaster recovery functionality. 对于最近的更改,查找 "在多个区域使用 HANA 大型实例单元" 一节。For recent changes, look up the section 'Use HANA Large Instance units in multiple regions'.

  • Azure 上的 SAP HANA (大型实例) 单位具有从服务器 IP 池地址范围分配的 IP 地址,该地址是在请求 HANA 大型实例部署时提交的。SAP HANA on Azure (Large Instances) units have an assigned IP address from the server IP pool address range that you submitted when requesting the HANA Large Instance deployment. 有关详细信息,请参阅 Azure 上的 SAP HANA(大型实例)的基础结构和连接For more information, see SAP HANA (Large Instances) infrastructure and connectivity on Azure. 可以通过将 Azure 虚拟网络连接到 HANA 大型实例的 Azure 订阅和线路来访问此 IP 地址。This IP address is accessible through the Azure subscriptions and circuit that connects Azure virtual networks to HANA Large Instances. 从该服务器 IP 池地址范围中分配的 IP 地址将直接分配给硬件单元,The IP address assigned out of that server IP pool address range is directly assigned to the hardware unit. 而不会经过 NAT 转换,在此解决方案的第一个部署中也存在这种情况。It's not assigned through NAT anymore, as was the case in the first deployments of this solution.

直接路由到 HANA 大型实例Direct Routing to HANA Large Instances

默认情况下,在以下情况下,可传递路由不起作用:By default, the transitive routing does not work in these scenarios:

  • 在 HANA 大型实例单元和本地部署之间。Between HANA Large Instance units and an on-premises deployment.

  • 在两个不同区域中部署的 HANA 大型实例路由之间。Between HANA Large Instance routing that are deployed in two different regions.

在这些情况下,可通过三种方式启用可传递路由:There are three ways to enable transitive routing in those scenarios:

  • 来回路由数据的反向代理。A reverse-proxy to route data, to and from. 例如,在连接到 HANA 大型实例并连接到本地作为虚拟防火墙/流量路由解决方案的 Azure 虚拟网络中,F5 大 IP、带有流量管理器的 NGINX。For example, F5 BIG-IP, NGINX with Traffic Manager deployed in the Azure virtual network that connects to HANA Large Instances and to on-premises as a virtual firewall/traffic routing solution.
  • 在 Linux VM 中使用 IPTables 规则在本地位置与 HANA 大型实例单元之间,或者在不同区域中的 HANA 大型实例单元之间实现路由。Using IPTables rules in a Linux VM to enable routing between on-premises locations and HANA Large Instance units, or between HANA Large Instance units in different regions. 需要将运行 IPTables 的 VM 部署到连接到 HANA 大型实例和本地的 Azure 虚拟网络中。The VM running IPTables needs to be deployed in the Azure virtual network that connects to HANA Large Instances and to on-premises. VM 需要相应调整大小,因此,VM 的网络吞吐量足以满足预期的网络流量。The VM needs to be sized accordingly, so, that the network throughput of the VM is sufficient for the expected network traffic. 有关 VM 网络带宽的详细信息,请参阅 Azure 中 Linux 虚拟机的大小一文。For details on VM network bandwidth, check the article Sizes of Linux virtual machines in Azure.
  • Azure 防火墙 将是另一种解决方案,用于在本地与 HANA 大型实例单元之间实现直接通信。Azure Firewall would be another solution to enable direct traffic between on-premises and HANA Large instance units.

这些解决方案的所有流量都将通过 Azure 虚拟网络进行路由,因此流量可能会被使用或由 Azure 网络安全组使用的软设备额外限制,因此,可能会阻止本地的某些 IP 地址或 IP 地址范围,也无法显式允许访问 HANA 大型实例。All the traffic of these solutions would be routed through an Azure virtual network and as such the traffic could be additionally restricted by the soft appliances used or by Azure Network Security Groups, so, that certain IP addresses or IP address ranges from on-premises could be blocked or explicitly allowed accessing HANA Large Instances.

备注

请注意,Microsoft 不实现也不支持涉及第三方网络设备或 IPTables 的自定义解决方案。Be aware that implementation and support for custom solutions involving third-party network appliances or IPTables isn't provided by Microsoft. 必须由所用组件的供应商或集成者提供支持。Support must be provided by the vendor of the component used or the integrator.

Express Route Global ReachExpress Route Global Reach

Microsoft 引入了新功能,称为 ExpressRoute Global ReachMicrosoft introduced a new functionality called ExpressRoute Global Reach. 在两个方案中,Global Reach 可用于 HANA 大型实例:Global Reach can be used for HANA Large Instances in two scenarios:

  • 启用从本地到部署在不同区域中的 HANA 大型实例单元的直接访问Enable direct access from on-premises to your HANA Large Instance units deployed in different regions
  • 在部署在不同区域中的 HANA 大型实例单元之间实现直接通信Enable direct communication between your HANA Large Instance units deployed in different regions
从本地直接访问Direct Access from on-premises

在提供 Global Reach 的 Azure 区域中,你可以请求为 ExpressRoute 线路启用 Global Reach 功能,将本地网络连接到连接到 HANA 大型实例单元的 Azure 虚拟网络。In the Azure regions where Global Reach is offered, you can request enabling the Global Reach functionality for your ExpressRoute circuit that connects your on-premises network to the Azure virtual network that connects to your HANA Large Instance units as well. ExpressRoute 线路的本地端有一些成本含义。There are some cost implications for the on-premises side of your ExpressRoute circuit. 对于价格,请查看 Global Reach 外接程序的价格。For prices, check the prices for Global Reach Add-On. 与将 HANA 大型实例 (单元连接到 Azure) 的线路相关的额外成本没有额外的费用。There are no additional costs for you related to the circuit that connects the HANA Large Instance unit(s) to Azure.

重要

如果使用 Global Reach 在 HANA 大型实例单元和本地资产之间启用直接访问,则 不会通过 Azure 虚拟网络路由 网络数据和控制流,而直接通过 Microsoft 企业 exchange 路由器进行路由。In case of using Global Reach for enabling direct access between your HANA Large Instance units and on-premises assets, the network data and control flow is not routed through Azure virtual networks, but directly between the Microsoft enterprise exchange routers. 因此,在 Azure 虚拟网络中部署的任何 NSG 或 ASG 规则或任何类型的防火墙、NVA 或代理都不会受到接触。As a result any NSG or ASG rules, or any type of firewall, NVA, or proxy you deployed in an Azure virtual network, are not getting touched. 如果你使用 ExpressRoute Global Reach 允许从本地到 HANA 大型实例单元的直接访问限制和访问 HANA 大型实例单位的权限,则需要在本地端的防火墙中定义。If you use ExpressRoute Global Reach to enable direct access from on-premises to HANA Large instance units restrictions and permissions to access HANA large Instance units need to be defined in firewalls on the on-premises side

连接不同 Azure 区域中的 HANA 大型实例Connecting HANA Large Instances in different Azure regions

同样,与 ExpressRoute Global Reach 可用于将本地连接到 HANA 大型实例单元时,可以使用它来连接两个在两个不同区域中为你部署的 HANA 大型实例租户。In the same way, as ExpressRoute Global Reach can be used for connecting on-premises to HANA Large Instance units, it can be used to connect two HANA Large Instance tenants that are deployed for you in two different regions. 隔离是 HANA 大型实例租户用于连接到 Azure 中两个区域的 ExpressRoute 线路。The isolation is the ExpressRoute circuits that your HANA Large Instance tenants are using to connect to Azure in both regions. 连接两个不同区域中部署的两个 HANA 大型实例租户不会产生额外费用。There are no additional charges for connecting two HANA Large Instance tenants that are deployed in two different regions.

重要

不同 HANA 大型实例租户之间的网络流量的数据流和控制流不会通过 azure 网络路由。The data flow and control flow of the network traffic between the different HANA Large instance tenants will not be routed through azure networks. 因此,不能使用 Azure 功能或 Nva 来强制实施两个 HANA 大型实例租户之间的通信限制。As a result you can't use Azure functionality or NVAs to enforce communication restrictions between your two HANA Large Instances tenants.

有关如何启用 ExpressRoute Global Reach 的更多详细信息,请参阅将 虚拟网络连接到 HANA 大型实例的文档。For more details on how to get ExpressRoute Global Reach enabled, read the document Connect a virtual network to HANA large instances.

HANA 大型实例的 Internet 连接Internet connectivity of HANA Large Instance

HANA 大型实例未建立直接 Internet 连接。HANA Large Instance does not have direct internet connectivity. 这会限制某些功能,例如,直接向 OS 供应商注册 OS 映像的功能。As an example, this limitation might restrict your ability to register the OS image directly with the OS vendor. 可能需要使用本地 SUSE Linux Enterprise Server 订阅管理工具服务器或 Red Hat Enterprise Linux 订阅管理器。You might need to work with your local SUSE Linux Enterprise Server Subscription Management Tool server or Red Hat Enterprise Linux Subscription Manager.

VM 与 HANA 大型实例之间的数据加密Data encryption between VMs and HANA Large Instance

在 HANA 大型实例与 VM 之间传输的数据不会加密。Data transferred between HANA Large Instance and VMs is not encrypted. 但是,仅仅是用于 HANA DBMS 端和基于 JDBC/ODBC 应用程序之间的交换,可以启用加密的流量。However, purely for the exchange between the HANA DBMS side and JDBC/ODBC-based applications, you can enable encryption of traffic. 有关详细信息,请参阅此 SAP 文档For more information, see this documentation by SAP.

在多个区域使用 HANA 大型实例单位Use HANA Large Instance units in multiple regions

若要实现灾难恢复集的使用,需要在多个 Azure 区域中 SHANA 大型实例单位。To realize disaster recovery set ups, you need to have SHANA Large Instance units in multiple Azure regions. 即使使用 Azure [全局 Vnet 对等互连],默认情况下,在两个不同区域中的 HANA 大型实例租户之间,传递的路由仍不起作用。Even with using Azure [Global Vnet Peering], the transitive routing by default is not working between HANA Large Instance tenants in two different regions. 但 Global Reach 会打开在两个不同区域中预配的 HANA 大型实例单元之间的通信路径。However, Global Reach opens up the communication path between the HANA Large Instance units you have provisioned in two different regions. ExpressRoute Global Reach 的这种使用方案启用:This usage scenario of ExpressRoute Global Reach enables:

  • HANA 系统复制,无需任何其他代理或防火墙HANA System Replication without any additional proxies or firewalls
  • 在两个不同的区域中的 HANA 大型实例单元之间复制备份,以执行系统副本或系统刷新Copying backups between HANA Large Instance units in two different regions to perform system copies or system refreshes

连接到了不同 Azure 区域中的 Azure 大型实例模具的虚拟网络

此图显示了两个区域中的不同虚拟网络如何连接到两个不同的 ExpressRoute 线路,这些线路用于连接到 Azure 上的 SAP HANA (大型实例,) 在两个 Azure 区域 (灰色行) 。The figure shows how the different virtual networks in both regions are connected to two different ExpressRoute circuits that are used to connect to SAP HANA on Azure (Large Instances) in both Azure regions (grey lines). 这两个交叉连接的原因是为了防止任何一侧的 Msee 中断。Reason for this two cross connections is to protect from an outage of the MSEEs on either side. 两个 Azure 区域中的两个虚拟网络之间的通信流应在两个不同区域中的两个虚拟网络的 全局对等互连 中进行处理 (蓝色虚线) 。The communication flow between the two virtual networks in the two Azure regions is supposed to be handled over the global peering of the two virtual networks in the two different regions (blue dotted line). 厚红线介绍 ExpressRoute Global Reach 连接,这允许两个不同区域中的租户的 HANA 大型实例单元彼此通信。The thick red line describes the ExpressRoute Global Reach connection, which allows the HANA Large Instance units of your tenants in two different regions to communicate with each other.

重要

如果使用了多个 ExpressRoute 线路,则应使用“AS 路径前追加”和“本地首选 BGP”设置来确保正确路由流量。If you used multiple ExpressRoute circuits, AS Path prepending and Local Preference BGP settings should be used to ensure proper routing of traffic.

后续步骤Next steps