SFTP destination connection fails in Adobe Experience Platform
The SFTP destination connection fails even when all required IP addresses are allow-listed and the credentials are correct. This issue occurs when the SFTP server supports only outdated SSH key exchange algorithms that are incompatible with AEP’s validator, causing SSH negotiation to fail before authentication. This applies even when using username and password authentication. To fix this issue, update the SFTP server to support modern SSH algorithms and ensure all required Adobe IP addresses are allow-listed.
Description description
Environment
- Product: Adobe Experience Platform
- Instance: SFTP destination
Issue/Symptoms
- The SFTP destination connection test fails immediately with an error indicating invalid parameters or a failure while validating SFTP credentials.
- Firewall logs show inbound traffic from at least one of the required Adobe IP addresses.
- The same credentials work when connecting through external tools such as WinSCP.
- No successful connection is established from Adobe Experience Platform, and no base connection objects are created.
Resolution resolution
To fix this issue, follow these steps:
-
Confirm that all required Adobe IP ranges are allow-listed on the firewall:
52.247.108.70 (global)51.137.8.208/29 (EMEA region-specific; includes 51.137.8.208 through 51.137.8.215) -
Verify that the allow-listing is applied as a CIDR block if supported, or as individual IPs if not.
-
Check whether the SFTP server supports modern SSH key exchange algorithms required by AEP:
curve25519-sha256curve25519-sha256@libssh.orgecdh-sha2-nistp256ecdh-sha2-nistp384ecdh-sha2-nistp521diffie-hellman-group-exchange-sha256diffie-hellman-group16-sha512diffie-hellman-group18-sha512diffie-hellman-group14-sha256 -
Update the SFTP server configuration to enable at least one of these algorithms if only legacy options (such as
diffie-hellman-group14-sha1ordiffie-hellman-group-exchange-sha1) are present. -
After updating the server configuration, attempt to establish the SFTP destination connection again from AEP.
-
Verify that the connection succeeds and data transfer is possible.
Notes
- AEP destinations do not support SFTP services hosted on Microsoft Azure based on current documentation.
- SFTP with username and password requires successful SSH negotiation using supported key exchange algorithms before authentication.
- Traffic can originate from any IP within the subnet range. Include all individual IPs in a
/29block if CIDR notation is not supported by the firewall. - If the issue continues after updating SSH algorithms and confirming allow-listing, check network routing or other security controls. These steps are not covered here.