VMware backup or replication jobs may fail with errors such as “Failed to create NFC download stream” or “Failed to create NFC upload stream.” These messages indicate that the backup proxy was unable to open an NFC (Network File Copy) connection to the ESXi host in order to transfer VM disk data.
Cause
NFC stream creation failures most commonly fall into one of these categories:
- DNS / name resolution failure
The backup proxy can’t resolve the ESXi host name/FQDN it’s trying to reach.
- TCP port 902 blocked
The proxy can resolve the host but cannot connect to TCP/902 (NFC). You can test that by running the following in PowerShell:
Test-NetConnection “<destination>” -Port 902
- Insufficient VMware permissions
The account used to add/manage vCenter/ESXi doesn’t have required permissions for the VM or its objects (host, datastore, folder, etc.).
- VMware file locks
ESXi has a lock on one or more VM files (VMDK, VMX, snapshot files), preventing read access.
Steps to resolve
DNS / name resolution
- Proxy resolves ESXi hostname/FQDN to the correct IP
- Correct DNS servers, suffix/search order on the proxy
TCP/902 (NFC)
- If the proxy cannot reach port 902, check all Firewalls between the backup server and the ESXi host.
- Ensure that Test-NetConnection “<destination>” -Port 902 succeeds
VMware permissions
- Account has required access to VM, host/cluster, datastore, folder/resource pool
- Permissions/inheritance consistent across VM locations
VMware file locks
- No locked VM files or snapshot-chain issues (VMDK/VMX/snapshots)
- If needed: isolate with vMotion/Storage vMotion (host vs datastore)
Veeam KB: https://www.veeam.com/kb1198
If you need help reviewing logs, validating connectivity, or confirming the root cause, contact our support team at support@managecast.com.