Explanation
* A public internet user can reach the SAP Web-Dispatcher over port 443
* The SAP Web-Dispatcher can reach the SAP Application server over port 443
* The App Subnet accepts traffic on port 443 from 10.0.0.0/24
* The SAP Application server sends traffic on port 30015 to the SAP DB server
* The DB subnet accepts traffic on port 30015 from 10.0.1.0/24.
* Public Internet Access is blocked on both App Subnet and DB Subnet.

References:
https://azure.microsoft.com/en-in/blog/sap-on-azure-architecture-designing-for-security/