Configuring SFTP Backup Location Fails Without Error Due to Blocked Port 22

Products

• VCF Operations

Issue/Introduction

When attempting to configure the SFTP backup location via the Backup & Restore tab in VMware Cloud Foundation (VCF), the configuration fails silently without displaying an error message in the user interface. A manual validation test shows that establishing a direct SSH connection from the VCF Operations node to the target SFTP backup location fails with a network access error or timeout.

Environment

VMware Cloud Foundation 9.1

Cause

Outbound TCP Port 22 (SSH/SFTP) traffic is blocked by a firewall or network routing rule between the VCF Operations node and the target SFTP backup server.

Resolution

1. Identify the source IP address of the VCF Operations node and the destination IP address of the SFTP backup server.
2. Verify Connectivity: Log in to the VCF Operations node CLI and manually run ssh root@<SFTP_Server_IP_or_FQDN> to confirm that the connection is being blocked (resulting in a Timeout or Connection Refused).
3. Engage your network or security administration team to allow outbound TCP Port 22 traffic from the Operations node to the SFTP server.
4. Validate the network configuration change by initiating a direct SSH connection from the Operations node to the SFTP server to confirm reachability.
5. Navigate to the VCF Backup & Restore tab in the UI and re-attempt the backup location configuration.

Additional Information

If network connectivity on TCP Port 22 is confirmed but the issue persists, verify that the internal vmware-system-user credentials are in sync per In VCF 9.1, configuring the backup location fails (KB 447328).