AWS sap documentation change
Summary
Restructured documentation by removing detailed implementation sections and replacing them with links to dedicated pages for VPN, Direct Connect, SD-WAN connectivity, and implementation steps. Simplified role descriptions and removed redundant content.
Security assessment
The changes primarily reorganize content architecture without introducing new security concepts or addressing vulnerabilities. While encryption methods like IPsec are mentioned in removed sections, this is standard networking documentation rather than security-specific guidance. No evidence of patching vulnerabilities or responding to security incidents.
Diff
diff --git a/sap/latest/general/rise-connection-on-premises.md b/sap/latest/general/rise-connection-on-premises.md index 80b3d15f8..9ac0fe649 100644 --- a//sap/latest/general/rise-connection-on-premises.md +++ b//sap/latest/general/rise-connection-on-premises.md @@ -5,2 +4,0 @@ -Connecting to RISE with SAP VPC using AWS VPNConnecting to RISE with SAP VPC using AWS Direct ConnectConnecting to RISE with SAP VPC using SD-WANImplementation steps for connectivity between RISE and your on-premises networks - @@ -13,348 +11 @@ Connectivity to RISE with SAP on AWS from on-premises is supported using AWS VPN - * Connecting to RISE with SAP VPC using AWS VPN - - * Connecting to RISE with SAP VPC using AWS Direct Connect - - * Connecting to RISE with SAP VPC using SD-WAN - - * Implementation steps for connectivity between RISE and your on-premises networks - - - - -## Connecting to RISE with SAP VPC using AWS VPN - -Enable access to your remote network from RISE with SAP VPC using [AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html). Traffic between AWS cloud and your on-premises location is encrypted via Internet Protocol security (IPsec) and transferred through a secure tunnel on internet. This option is efficient, and faster to implement when compared to AWS Direct Connect. For more information, see [Connect your VPC to remote networks using AWS Virtual Private Network](https://docs.aws.amazon.com/vpc/latest/userguide/vpn-connections.html). - -You can get a maximum bandwidth of up to 1.25 Gbps per VPN tunnel. For more information, see [Site-to-Site VPN quotas](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-limits.html). - -To scale beyond the default maximum limit of 1.25 Gbps throughput of a single VPN tunnel, see [How can I achieve ECMP routing with multiple Site-to-Site VPN tunnels that are associated with a transit gateway?](https://repost.aws/knowledge-center/transit-gateway-ecmp-multiple-tunnels) - -When using this option, SAP requires the following details: - - * BGP ASN - - * IP address of your device - - - - -You can obtain these details from your AWS VPN device on-premises. - -When connecting your remote network directly to RISE using AWS Site-to-Site AWS VPN, the cost for the AWS VPN Connection and the cost for data transfer out are included in the RISE subscription. - -For more information see: [AWS Site-to-Site AWS VPN Pricing](https://aws.amazon.com/vpn/pricing/). - -Note: Because the cost associated with the lifecycle and operation of a "Customer gateway device" (a physical device or software application on your side of the Site-to-Site AWS VPN connection) varies, this is not taken into consideration in this document. - -## Connecting to RISE with SAP VPC using AWS Direct Connect - -Use AWS Direct Connect if you require a higher throughput or more consistent network experience than an internet-based connection. AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. You can create different types of virtual interfaces (VIFs) to connect with various AWS services. For example, you can create a Public VIF to communicate with public services like Amazon S3 or a Private/Transit VIF for private resources such as Amazon VPC, while bypassing the internet service providers in your network path. For more information, see [AWS Direct Connect connections](https://docs.aws.amazon.com/directconnect/latest/UserGuide/WorkingWithConnections.html). - -You can choose from a dedicated connection of 1 Gbps, 10 Gbps, 100 or 400 Gbps or an AWS Direct Connect Partner’s hosted connection where the Partner has an established network link with AWS cloud. Hosted connections are available from 50 Mbps. 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, and 25 Gbps. You can order hosted connections from an AWS Direct Connect Delivery Partner approved to support this model. For more information, see [AWS Direct Connect Delivery Partners](https://aws.amazon.com/directconnect/partners/). - -To connect, use a virtual private gateway in AWS account managed by SAP or a Direct Connect gateway in your AWS account associated with a virtual private gateway in AWS account managed by SAP. For more information, see [Direct Connect gateways](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html). Direct Connect gateway can also connect to a AWS Transit Gateway. For more information, see [Connecting to RISE using your single AWS account](./rise-accounts.html#rise-connection-accounts). - -You must acquire a _Letter of Authorization_ from SAP to setup a AWS Direct Connect dedicated connection in the AWS account managed by SAP. - -When connecting your remote network directly to RISE using AWS Direct Connect, the cost for data transfer out (egress) is included in the RISE subscription. Costs associated to the capacity (the maximum rate that data can be transferred through a network connection) and the port hours (the time that a port is provisioned for your use with AWS or an [AWS Direct Connect Delivery Partners](https://aws.amazon.com/directconnect/partners/)) are not included in the RISE subscription. AWS Direct Connect does not have setup charges, and you may cancel at any time, however, services provided by your [AWS Direct Connect Delivery Partners](https://aws.amazon.com/directconnect/partners/) or other local service provider may have other terms and conditions that apply. - -For more information, see: [AWS Direct Connect Pricing](https://aws.amazon.com/directconnect/pricing/) - -## Connecting to RISE with SAP VPC using SD-WAN - -**What is SD-WAN** - -[Software-Defined Wide Area Networking (SD-WAN)](https://en.wikipedia.org/wiki/SD-WAN) is a networking technology that uses software to manage and route traffic across different networks such as Multi-Path Label Switching (MPLS), public internet, or the AWS backbone focusing on improving connectivity and application performance. SD-WAN primarily operates at layer 3 (Network Layer) of the network OSI model offering centralized control, routing, path selection, IP-based policies, and the ability to prioritize specific mission critical applications, such as SAP, making it well-suited for cloud-based RISE with SAP environments. - -Although SD-WAN primarily operates at Layer 3, using an overlay network such as broadband internet, it can utilize Layer 2 (Data Link) technologies such as [AWS Direct Connect](https://aws.amazon.com/directconnect/) as the underlay network for transport, and Layer 3 (Network) technologies such as [AWS Site-to-Site VPN](https://docs.aws.amazon.com/vpn/latest/s2svpn/VPC_VPN.html). - -In SD-WAN architecture, an SD-WAN headend acts as a hub or centralized network component, while [SD-WAN edge devices](https://en.wikipedia.org/wiki/SD-WAN#SD-WAN_edge) deployed at branch offices, remote sites or data centers which serves as the entry and exit points for WAN Traffic. - -You can refer to more detailed information in the [Reference Architectures for Implementing SD-WAN Solutions on AWS](https://d1.awsstatic.com/architecture-diagrams/ArchitectureDiagrams/sd-wan-deployment-models-ra.pdf?did=wp_card&trk=wp_card). - -**Scenario A: SD-WAN appliances (edge and/or headend/hub) on-premises** - -[AWS Transit Gateway Connect](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-connect.html) allows you to extend your SD-WAN network to AWS using [GRE (Generic Routing Encapsulation)](https://en.wikipedia.org/wiki/Generic_routing_encapsulation) tunnels without needing additional AWS infrastructure. Through [Transit Gateway Connect Peer](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-connect.html#tgw-connect-peer), you can establish GRE tunnels between your transit gateway in your AWS account and the SD-WAN appliance on-premises which are connected via AWS Direct Connect connection as underlying transport. - -The appliance must be configured to send and receive traffic over a GRE tunnel to and from the transit gateway using the [Connect attachment](https://docs.aws.amazon.com/vpc/latest/tgw/create-tgw-connect-attachment.html). The appliance must be configured to use [BGP (Border Gateway Protocol) ](https://aws.amazon.com/what-is/border-gateway-protocol/)for dynamic route updates and health checks. - -Each connection can be configured with its own route table and BGP peer, enabling you to extend your on-premises network segmentation via [Virtual routing and forwarding (VRF)](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/extend-vrfs-to-aws-by-using-aws-transit-gateway-connect.html) to aws. The RISE with SAP VPC is attached to the AWS Transit Gateway. - -This setup provides a streamlined way to connect your SD-WAN environment with RISE with SAP on AWS using AWS Direct Connect, maintaining network separation while simplifying the overall architecture. - -In this scenario, the [overlay network](https://en.wikipedia.org/wiki/Overlay_network) is SD-WAN (with GRE Tunnels) with the headend/hub or edge devices deployed on on-premises, and the underlay transport is AWS Direct Connect - -**Pattern A-1: SD-WAN devices integration with AWS Transit Gateway and AWS Direct Connect with your AWS landing zone** - - - -The preceding diagram illustrates a pattern of how you can extend and segment your SD-WAN traffic to AWS without adding extra infrastructure. You can create Transit Gateway connect attachments using an AWS Direct Connect connection as underlying transport in your AWS account. - -Outbound from RISE with SAP VPC: - - 1. Traffic initiated from the RISE VPC to the corporate data center is routed to the Transit Gateway. - - 2. The Transit Gateway connect attachment uses the Direct Connect connection as the underlay transport and connects the Transit Gateway to the corporate data center SD-WAN device with GRE tunneling and BGP. - - - - -Inbound to RISE with SAP VPC: - - 1. Traffic from the corporate data center SD-WAN device to the RISE VPC is forwarded to the Transit Gateway via the GRE tunnel of the Transit Gateway attachment over the Direct Connect link. - - 2. Transit Gateway forwards the traffic to the destination RISE with SAP VPC. - - - - -**Pattern A-2: SD-WAN devices integration with AWS Transit Gateway and AWS Direct Connect with no AWS landing zone** - - - -The preceding diagram illustrates a pattern of how you can extend and segment your SD-WAN traffic to AWS without adding extra infrastructure. In RISE with SAP, you can request SAP to create Transit Gateway connect attachments using a Direct Connect connection as underlying transport. Customers can leverage SAP-managed [Direct Connect gateway (DXGW)](https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html) if required. - -Outbound from RISE with SAP VPC: - - 1. Traffic initiated from RISE VPC to the corporate data center is routed to the Transit Gateway. - - 2. The Transit Gateway connect attachment uses the Direct Connect connection as transport and connects the Transit Gateway to the corporate data center SD-WAN device using GRE tunneling and BGP. - - - - -Inbound to RISE with SAP VPC: - - 1. Traffic from the corporate data center SD-WAN device to the RISE VPC is forwarded to the Transit Gateway via the GRE tunnel of the Transit Gateway attachment over the Direct Connect link. - - 2. Transit Gateway forwards the traffic to the destination RISE with SAP VPC. - - - - -**Scenario B: SD-WAN appliances (edge and/or headend/hub devices) in AWS** - -In this scenario, the virtual appliances of the SD-WAN network are deployed in a VPC within aws. Then, you use a VPC attachment as underlying transport for the Transit Gateway connect attachment between the SD-WAN virtual appliances and the Transit Gateway in your AWS account(s). Similar to Scenario A, Transit Gateway connect attachments support GRE for higher bandwidth performance compared to a VPN connection. It supports BGP for dynamic routing and removes the need to configure static routes. In addition, its integration with [Transit Gateway Network Manager](https://docs.aws.amazon.com/vpc/latest/tgwnm/what-is-network-manager.html) provides advanced visibility through global network topology, attachment level performance metrics, and telemetry data. - -Between on-premises and AWS, the [overlay network](https://en.wikipedia.org/wiki/Overlay_network) is SD-WAN with GRE or IPSec tunnels with the headend/hub deployed within AWS, and the underlay transport could be Internet, MLPS, or Direct Connect. Following are the architecture patterns under this scenario: - -Note: Network patterns covered in the following sections are applicable only with your existing or a new landing zone setup on aws. For SD-WAN appliances deployment and connectivity directly with AWS Account – managed by SAP, refer to Pattern A-2. - -**Pattern B-1: SD-WAN appliances in AWS integrated with AWS Transit Gateway Connect with your AWS landing zone** - - - -The preceding diagram illustrates a pattern of integrating your SD-WAN network with Transit Gateway using [connect attachments](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-connect.html) and placing (third-party) virtual appliances of the SD-WAN network in an Appliance VPC within aws. It’s common to have SD-WAN edge appliances deployed at branch locations, and on-premises data center to create a full mesh topology. - -Outbound from RISE with SAP: - - 1. Traffic initiated from the RISE VPC to the corporate data center is routed to the Transit Gateway. - - 2. The Transit Gateway connect attachment uses the VPC attachment as transport and connects Transit Gateway to the third-party appliance in the Appliance VPC using GRE tunneling and BGP. - - 3. The third-party virtual appliance encapsulates the traffic, which uses the SD-WAN overlay – on top of the Direct Connect link – to reach the corporate data center. - - - - -Inbound to RISE with SAP: - - 1. Traffic from branches outside AWS to the RISE VPC reaches the internet gateway of the appliance VPC via the SD-WAN overlay over the internet. Similarly, traffic from the corporate data center to the RISE VPC reaches the virtual private gateway of the Appliance VPC via the SD-WAN overlay over the Direct Connect link. - - 2. The third-party virtual appliance in the appliance VPC forwards the traffic to the Transit Gateway via the connect attachment. - - 3. Transit Gateway forwards the traffic to the destination RISE VPC. - - - - -**Pattern B-2: SD-WAN appliances in AWS integrated with AWS Site-to-Site VPN** - - - -The diagram above illustrates a pattern of integrating your SD-WAN network with Transit Gateway using an AWS Site-Site VPN connection and placing (third party) virtual appliances of the SD-WAN network in an Appliance VPC within aws. You may use this option when your third-party virtual appliance does not support GRE. It’s common to have SD-WAN edge appliances deployed at branch locations, and on-premises data center to create a full mesh topology. - -Outbound from RISE with SAP: - - 1. Traffic initiated from the RISE VPC to the corporate data center is routed to the Transit Gateway Elastic Network Interface (TGW ENI). - - 2. The traffic is routed between the Transit Gateway and the third-party virtual appliance using the Site-to-Site VPN connection. - - 3. The third-party virtual appliance encapsulates the traffic, which uses the SD-WAN overlay – on top of the Direct Connect link – to reach the corporate data center. - - - - -Inbound to RISE WITH SAP: - - 1. Traffic from branches outside AWS to the RISE VPC reaches the internet gateway of the appliance VPC via the SD-WAN overlay over the internet. Similarly, traffic from the corporate data center to the RISE VPC reaches the virtual private gateway of the appliance VPC via the SD-WAN overlay over the AWS Direct Connect link. - - 2. The third-party virtual appliance in the appliance VPC forwards the traffic to the Transit Gateway via Site-to-Site VPN connection. - - 3. Transit Gateway forwards the traffic to TGW ENI of the destination RISE VPC. - - - - -## Implementation steps for connectivity between RISE and your on-premises networks - -This section provides a deeper dive into the implementation steps for connectivity between RISE with SAP and your on-premise environments (without any Customer managed AWS Account usage). The two options we will step into are: first, creating highly resilient deployment for critical workloads, and second, creating cost effective alternative for non-critical workloads. - -For each option we’ll provide clarity on the details SAP needs, the steps you will take in your on-premise environment. -