vCenter VAMI backup in FTP fails with connection errors

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• FTP or SFTP-based backup from vCenter Appliance Management Interface fails to complete.
  
  
• Error messages from /var/log/vmware/applmgmt/backup.log may include such terms as:
  • "...Backup job failed to complete..."
  • "...Connection time-out..."
  • "...Failed to list FTP dir..."
  • "...Failed to create FTP dir..."
  • "...BackupManager encountered an exception..."
• Attempts to other backup paths also fail.
  
  
• Test backups to the vCenter local device do succeed.
  
  
• Port testing from vCenter to the backup device fails to one of the required ports:

  curl -v telnet://<destination IP>:20.

• For FTP protocol-based backup:
  • test ports 20 and 21
• For SFTP protocol-based backup:
  • For vCenter 6.7, tested ports 989 and 990
  • For vCenter 7.0, tested ports 22, 989 and 990
    
    

Environment

VMware vCenter Server 6.7.x and newer

Cause

• If issue is for FTP protocol-based backup:
  • TCP ports 20 or 21 may be blocked by firewall.
• If issue is for SFTP protocol-based backup:
  • For vCenter 6.7, TCP port 989 or 990 may be blocked by firewall.
  • For vCenter 7.0, TCP port 22, 989, or 990 may be blocked by firewall.

Resolution

• Allow firewall to pass TCP traffic for the required ports between the vCenter Server and the destination backup server.
  
  
  • For FTP protocol-based backup:
    Allow TCP ports 20 and 21
    
    
  • For SFTP protocol-based backup:
    For vCenter 6.7, allow TCP ports 989 and 990
    For vCenter 7.0, allow TCP ports 22, 989, and 990