India’s Leading Domain & Web Hosting Provider
Support
Domain & Login
Blog
SAP Network and Connectivity: Plants, Users, Partners and BTP to Cloud
SAP network and connectivity covers every path into and out of an SAP landscape on cloud: plant and branch users, MES and weighbridge interfaces, partner and bank links, SAP support via SAProuter and SAP BTP through Cloud Connector. NTSPL designs private links, latency budgets, DNS and firewall rules so SAP traffic stays predictable after the data centre is gone.
Delivered on
In scope
Why SAP Users Judge a Cloud Move by the Network
When SAP leaves the data centre, the network becomes the place where users feel the move. SAP GUI works well over modest bandwidth, but a plant on a single 20 Mbps MPLS link with 45 ms to Mumbai and a congested internet breakout notices every lost packet. RFC calls from MES and weighbridge systems were tuned for a LAN, so a few milliseconds per call add up across thousands of calls per shift. Meanwhile SAP support needs SAProuter, BTP needs Cloud Connector, and banks need fixed outbound IPs.
NTSPL designs SAP connectivity from the interface register produced in readiness, not from a generic hub-and-spoke diagram. Each flow is assigned a path, a latency budget and an owner: plants over SD-WAN or MPLS into a dedicated private link, partners through a controlled egress with fixed IPs, BTP through Cloud Connector in a segregated subnet. Application-to-database latency inside the cloud is measured and held within SAP's guidance.
When SAP Connectivity Needs Its Own Design Work
Signals you need SAP Network & Connectivity
- More than 10 plants, depots or branches will reach SAP over WAN after migration.
- MES, weighbridge, LIMS or warehouse systems make synchronous RFC calls to SAP from plant networks.
- Bank host-to-host payments, GST e-invoicing or EDI partners whitelist fixed IP addresses that will change.
- SAP BTP, SuccessFactors or Ariba integrations depend on an on-prem Cloud Connector that will move.
- Users already complain of SAP GUI lag at sites with round-trip times above 60 ms to the target region.
When to choose something else
- The question is whether bandwidth and latency allow a cloud move at all, before a design is chosen; that is a network and connectivity assessment.
- Only a single head office uses SAP over the existing internet VPN with no plant interfaces; standard landing zone connectivity is enough.
- SAP is moving under RISE with SAP; connectivity is then shaped by SAP's supported options, and NTSPL works within those.
Connectivity Paths NTSPL Designs for an SAP Landscape
User access paths
SAP GUI and Fiori access from plants, branches and remote users over SD-WAN, MPLS or private links, with Web Dispatcher and load balancer placement.
Plant and shop-floor integration
RFC, IDoc and OPC-to-SAP flows from MES, weighbridges and LIMS, with latency budgets and local buffering where links are weak.
Partner and statutory connectivity
Bank host-to-host, GST e-invoicing and e-way bill, EDI and logistics partner links through controlled egress with fixed public IPs.
SAP support and BTP
SAProuter for SAP support connections and SAP Cloud Connector for BTP, SuccessFactors and Ariba, each in its own subnet with tight rules.
Internal SAP network and DNS
Subnet layout, firewall rules between tiers, private DNS for SAP virtual hostnames and app-to-database latency validation.
SAP Traffic Map from Plants and Partners to HANA
SAP Traffic Map from Plants, Partners and BTP to HANA
Plant and branch traffic enters through a private link into a hub, passes inspection and reaches Web Dispatcher or application servers. Outbound partner traffic leaves through fixed-IP egress, SAP support uses SAProuter, and BTP reaches SAP through Cloud Connector.
Select any component
SAP Traffic Map from Plants, Partners and BTP to HANA: click any of its 8 components to see its role and the design choice NTSPL makes for it, or trace the 6-step primary path.
Private Links, Load Balancing and DNS for SAP per Cloud
Plants connect over Direct Connect into a Transit Gateway in Mumbai, partner traffic leaves through NAT gateways with Elastic IPs, and Route 53 Resolver links on-prem and SAP DNS.
ExpressRoute into a hub in Central India carries plant traffic; Azure Firewall inspects inbound flows, and SAP subnets peer to the hub without a firewall between app and database.
Partner or Dedicated Interconnect lands in Mumbai, Network Connectivity Center joins plant sites, and Cloud NAT with reserved addresses keeps partner whitelists stable.
Connectivity Choices with Latency and Bandwidth Thresholds
Private link or VPN for plants
Use a dedicated private link with two connections for production when more than 300 concurrent SAP users or any synchronous plant RFC flows exist. Site-to-site VPN over internet suits small branches and as backup. Plants with round-trip above 60 ms to the region should use SAP GUI with low-speed connection settings or Fiori apps tuned for WAN.
App-to-database latency budget
Keep application servers and HANA in the same zone and subnet group, with no network virtual appliance between them. SAP's network guidance treats round-trip under 0.3 ms as good and above 0.7 ms as below average. Measure with niping after build and after every major change.
Plant RFC flows over WAN
For MES or weighbridge systems that make many small synchronous RFC calls, either batch the calls, move to asynchronous IDoc or qRFC patterns, or keep a local buffer that posts when the link recovers. Assume 20 to 40 ms per round-trip from most Indian plants to the nearest cloud region and test throughput at shift change.
Fixed IPs for partners
Route all outbound partner traffic through a small set of static public IPs and notify banks, GSPs and EDI partners at least four weeks before cutover. Keep separate IPs for DR, registered in advance, so a DR switch does not wait on partner whitelisting.
SAP Network Build from Interface Register to Cutover
Flow mapping from interface register
Assign each SAP interface and user group a path, protocol, latency budget and owner.
Private link and hub build
Order and commission private links, build hub routing, firewall and DNS resolution.
SAP-specific components
Deploy Web Dispatcher, SAProuter, Cloud Connector and fixed-IP egress, and register partner IPs.
Latency and load tests
Run niping, SAP GUI timing and RFC throughput tests from representative plants during shift changes.
Cutover network switch
Update DNS, partner endpoints and plant routing, and verify every critical flow in the runbook.
What you receive
Network Measures That Predict SAP User Experience
| KPI | Typical target |
|---|---|
| App server to HANA round-trip | Below 0.3 ms average |
| SAP GUI dialog response at plants | Under 1 second average for top 20 transactions |
| Partner interfaces working on cutover day | 100 percent of critical flows |
| Private link availability per month | At least 99.95 percent with dual connections |
Network Mistakes That Hurt SAP After Migration
| Risk | How NTSPL prevents it |
|---|---|
| Bank or GSP whitelisting not updated, blocking payments or e-invoices on day one | Partner notice pack sent four weeks ahead, with test connections from new IPs confirmed before cutover. |
| Firewall appliance inserted between app and HANA, adding latency | Design rule forbids inspection between SAP tiers; segmentation uses security groups or NSGs instead. |
| Private link order takes longer than planned | Links are ordered in week one, and an IPsec VPN with tested capacity is built as a temporary path. |
SD-WAN with internet breakout or a dedicated private link for SAP plants?
For plants that run shop-floor interfaces into SAP or have more than 100 SAP users, terminate SD-WAN into a dedicated private link at the cloud region rather than relying on internet breakout. Internet paths in India vary across ISPs and times of day, and RFC-heavy integrations suffer most from jitter. SD-WAN still adds value for path selection, QoS and failover between MPLS, broadband and 4G. For small depots and sales offices using Fiori or SAP GUI lightly, SD-WAN over internet with a cloud VPN gateway is sufficient and much cheaper.
Key facts: SAP Network & Connectivity
SAP Network & Connectivity in Practice
2 SAP Network & Connectivity scenarios, from Tractor maker and Paper & board, plus related platform case studies.
Tractor maker keeps assembly-line RFC calls under 30 ms after moving SAP to Mumbai
Paper and board mill moves 140 SAP partner links to AWS with no failed payments
Specialty chemicals group links 6 plants and HQ to AWS with dual-path hybrid network
Container terminal links TOS, gate automation and Azure over dual ExpressRoute
SAP Network & Connectivity: Frequently Asked Questions
What does SAP network design and build cost?
Design and build effort is typically 20 to 35 consultant-days for a landscape with 10 to 30 sites. Private links and carrier circuits are the main recurring costs and vary by provider, location and bandwidth; NTSPL helps compare carrier quotes.
How much bandwidth does SAP GUI need per user?
SAP GUI is efficient, typically needing only a few kilobits per second per active user, but bursts happen with large reports and attachments. Fiori uses more. NTSPL sizes from measured traffic at existing sites rather than per-user rules of thumb.
How do plants keep working if the link to cloud fails?
Critical plants get two diverse links, and shop-floor systems that post to SAP are configured to buffer and post later. The cutover runbook and business continuity plan include an offline template for dispatches and receipts.
Does network logging cover CERT-In requirements?
Flow logs, firewall logs and DNS logs are sent to a log store in an Indian region and retained for at least 180 days, in line with CERT-In directions, so incidents can be traced and reported within 6 hours.
Where should SAP Cloud Connector run after migration?
In the cloud landing zone, in its own subnet close to SAP, with a high availability pair for production. It only opens outbound connections to SAP BTP and exposes listed back-end resources.
Can we use the internet for SAP access by remote users?
Yes, through a zero-trust access service or a VPN, never by exposing SAP GUI ports. Fiori can be published through a web application firewall with SSO. NTSPL designs this together with SAP security and identity controls.