File-Based Backups to SFTP Destinations Hang or Fail from the vCenter Server Appliance

Products

• VMware vCenter Server

Issue/Introduction

The vCenter Server Appliance (vCSA) is unable to configure or execute file-based backups to a Secure File Transfer Protocol (SFTP) destination.

When attempting to configure the backup via the Management GUI, the process stalls or times out. When testing the connection manually using the built-in SFTP client from the vCSA command line, the command hangs indefinitely without returning a password prompt: 

#root@<Affected vCenter Host Name> [ ~ ]# sftp <<USER NAME>>@<Destination FQDN>

Environment

 VMware vCenter Server Appliance 8.x

Cause

This issue occurs due to a network-layer blockage or routing failure specific to the affected vCenter IP address. Outbound SFTP traffic (Port 22) is dropped or filtered at an upstream gateway or firewall, preventing the vCSA from reaching the storage endpoint.

Resolution

To resolve this issue, the network path between the vCenter Server Appliance and the target SFTP destination must be corrected.

1. Perform a Network Audit: Review firewall and Access Control List (ACL) logs at upstream gateways to identify dropped traffic originating from the vCSA IP address.

2. Port Validation: Ensure outbound Port 22 is explicitly permitted for the vCenter management IP address.

3. Route Verification: Confirm that routing tables at the network edge are configured to correctly handle traffic destined for the SFTP storage IP ranges.

To verify that the network path has been corrected, execute the SFTP connection test from the vCSA shell. A successful connection is indicated by the appearance of a password prompt:

 

root@<Working vCenter Host Name> [ ~ ]# sftp <<USER NAME>>@<Destination FQDN>
<<USER NAME>>@<Destination FQDN>'s password:
Connected to <Destination FQDN>.
sftp> dir
<Directory Name 1>  <Directory Name 2>  <Directory Name 3>
sftp>