Palo Alto NCM config backup fails with “not a valid Destination (username@host:path)” when using SCP

Session trace on the device shows the Palo Alto CLI returning “not a valid Destination (username@host:path)” and “Invalid syntax” for the SCP destination string, and the backup only starts working after switching from a domain-qualified SCP account to a simple local account on the SCP server.

Palo Alto expects the SCP destination in the form username@host:path in its scp export commands.

In this scenario, NCM was configured to use a Windows SCP account in domain-qualified format (for example, doamin\domain-Solarwindwmi) as the ${SCPServerUserName} passed into the device template’s scp export ... to ${SCPServerUserName}@${SCPStorageAddress}:/${StorageFilename} command.

• Confirm the failure is due to the SCP destination string

  • Review the NCM session trace for the affected Palo Alto node and look for lines similar to:
    • **********@<ip_address>:<filename>.config is not a valid Destination (username@host:path)
    • Invalid syntax.
  • If these messages are present, the device is rejecting the SCP destination string (username/host/path format), not the network connection or file system permissions.

• Check the SCP username configured in NCM

  • In the SolarWinds Web Console, go to:
    Settings > All Settings > NCM Settings > SCP Server (or the equivalent SCP/Network Storage configuration used for Palo Alto binary configs).
  • Note the account configured for the SCP server. If it uses a domain-qualified format such as DOMAIN\username, this will be passed into the Palo Alto scp export ... to ${SCPServerUserName}@${SCPStorageAddress}:/${StorageFilename} command and will not match the expected username@host:path pattern.

• Create or select a local SCP account with a simple username

  • On the Windows server running the SolarWinds SFTP/SCP Server (or equivalent SCP service), create or identify a local user (for example, sw_scp_backup) that:
    • Has a non-domain-qualified username (no DOMAIN\ prefix).
    • Has “log on locally” permission if required by the SCP service.
    • Has read/write access to the SCP root directory used for NCM config backups.

• Update NCM to use the simple SCP username

  • In NCM Settings > SCP Server, update the SCP credentials to use the local account created in step 3 (for example, sw_scp_backup), including the correct password.
  • If you are using Binary Config Storage for Palo Alto Device State or other binary backups, ensure that any related Network Storage / Binary Config Storage settings also reference the same local account and root directory so that NCM and the SCP server are aligned.

• (Optional) Validate from the Palo Alto CLI

  • From the Palo Alto CLI, manually test an SCP export using the simple username to confirm the device accepts the destination format, for example (syntax will vary by config type):
    • admin@PA-220> scp export configuration from MyBackup.xml to sw_scp_backup@<IP_Address>:/path
    • or for device state:
      admin@PA-220> scp export device-state to sw_scp_backup@<IP_Address>:/path
  • The command should complete without “not a valid Destination (username@host:path)” or “Invalid syntax” errors if the username and path are valid.

• Re-run the NCM backup job

  • In NCM, run the Palo Alto configuration backup job again (for the relevant config type such as Device State or Running/Startup configuration).
  • The backup should now complete successfully. In the original case, once a suitable (non-domain-qualified) SCP account was used, the customer reported that “the backup process for the Palo Alto devices is now running successfully.”