Azure region

Azure subscription Azure subscription

Interne central hub SAP production
t
SAProuter traffic
communication
BTP - TLS tunnel

Https inbound
Hub virtual network SAP perimeter – spoke virtual network
SNC

SAP perimeter network application subnet

Public IP address
Virtual
Public IP address network
peering
SAProuter Cloud
SAP Connector

Gateway Azure Firewall

subnet subnet
SAP production - spoke virtual network

On-premises Application subnet Database

subnet
network Firewall Virtual
Application network
Gateway peering
subnet
Virtual Machine Virtual Machine Virtual Machine

replication
Gateway

Database
ExpressRou
te Zone- AppGw/WAF
redundant
gateway Network Security
Shared services
Groups
subnet App
VirtualWD
Machine Virtual Machine
ASCS Databas
server Private Azure
e
SAP Web SAP ASCS and endpoint Files
Dispatcher VMs application server VMs NFS
AD / DNS
Network Security Network Security
Network Security Groups
Groups
Groups
 Azure region

Azure subscription Azure subscription

Interne central hub SAP production
BTP - TLS tunnel

t
SAProuter traffic
communication
SAP production - spoke virtual network
Public IP address
SNC

Public IP address
SAP perimeter network application Application Gateway
Hub virtual network subnet subnet

Public IP address
SAP NAT
SAProuter Cloud
Gateway Azure Firewall Gatewa Application Gateway
subnet subnet y Connector
Web Application
Network Security Firewall Network Security
Groups Groups

Virtual Database
On-premises Firewall Application subnet
networ subnet
network k
Shared services
subnet peering

Gatewa Virtual Machine

Virtual Machine Virtual Machine

replication
ExpressRout

Database
y e Zone- Active
redundant Directory/DNS
gateway Network Security
Azure Bastion
Groups
subnet
App Databas Azure
WD ASCS server Private
e Files
SAP Web endpoint
SAP (A)SCS and NFS
Dispatcher
application server VMs
VMs
Network Security Network Security
Network Security
Groups Groups
Groups