> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/connection-methods/sftp/troubleshooting-sftp.md).
# Troubleshooting SFTP
SFTP connection issues are usually caused by firewalls or incorrect settings in the SFTP client. The checks below cover the most common causes.
Work through the items below before contacting support.
## Check for Firewall Issues
SFTP is frequently restricted by corporate and network firewalls. A firewall-policy change can interrupt a connection that previously worked.
### Have You Manually Allowlisted Any IP Addresses?
If you have, confirm that all of the appropriate IPs are allowlisted, not just some of them.
### Do You Need to Request an IP Allowlist?
If you have not allowlisted IP addresses, your firewall administrator may require an explicit allowlist for SFTP traffic. Submit a request to your network or firewall administrator to allow SFTP port `22` traffic to all of the IP addresses used by your server.
## Connection Settings in Your SFTP App
The settings below are the most common sources of SFTP connection problems. Double-check each one.
### Hostname
Connect with SFTP to the fully qualified domain name of your appliance. Do not include `https://` at the start of the address. If the client requires an IP address, use the external IP address configured in the Appliance Manager.
### Port
The default SSH/SFTP port is `22`. Many corporate firewalls block or interfere with port `22`.
### Timeout
If your app supports it, increase the connection timeout value to 60 seconds.
### Retry Logic
If the client supports it, configure three connection retries at 10-second intervals. This allows it to recover from a transient connection failure.
### Keepalives
ExaVault times out SFTP sessions that have been idle for 120 seconds. This prevents unused sessions from holding server resources. Idle timeouts are normal, and most SFTP apps handle them without issue, but some apps do not. Many apps complete transfers in progress and then reconnect when the user issues another command. If your app aborts a transfer or errors out on the idle timeout message, configure keepalives (null packets or dummy commands) every 100 seconds to maintain the SFTP connection.
### Ciphers
Your SFTP app and ExaVault will only connect if both sides agree on a secure cipher. Insecure ciphers are rejected by either side. Make sure your SFTP app uses a [supported secure cipher](/connection-methods/sftp/supported-ssh-ciphers.md).
Check the documentation for your SFTP app to find out how to configure ciphers for your connection.
## ExaVault Configuration That May Be Relevant
If the items above check out, the remaining cause is often on the ExaVault side.
Verify that the username is enabled and that the username and password are correct. In the *Users* section, enabled users show a green check and disabled users show a red X. Select a disabled user and use *Enable/Disable* to enable them.
## Authentication or Invalid Username/Password Failure Messages
The SFTP protocol has a quirk that often confuses users troubleshooting authentication issues. The protocol uses integers internally to communicate authentication failure codes and does not allow services like ExaVault to return detailed error messages related to authentication.
Other ExaVault interfaces can provide more detailed login errors.
Many SFTP clients show a generic "authentication failure" or "invalid username/password" message for any authentication error. Use [Investigating Login Failures](/authentication-and-identity/investigating-login-failures.md) to find the Activity record and determine the account-side reason.