This article explains the required configuration while performing transfer-on-commit feature using SFTP.

Transfer-on-commit is a Junos feature that is used to configure the router or switch to transfer its currently active configuration to an archive site each time you commit a candidate configuration.

Statement / feature was introduced in Junos OS Release 9.0 for EX Series switches.
Statement / feature was introduced in Junos OS Release 11.1 for the QFX Series.
 

You can configure the device to transfer its active configuration by FTP, HTTP, secure copy (SCP), or SFTP periodically or after each commit.

While we configure using SFTP, we might see that the transfer fails with the below log messages:

Nov 22 11:04:59 EX-1 logger: transfer-file failed to transfer /var/transfer/config/EX-1_20231122_110449_juniper.conf.gz rc 255

Nov 22 11:04:59 EX-1 pfed: ACCT_TRANSFER_FILE_FAILED_ITER: Error <65280> uploading file '/var/transfer/config/EX-1_20231122_110449_juniper.conf.gz'. Remaining retry attempts = 2, retry in 295 seconds...

Below is the basic configuration example for transfer-on-commit using the service SFTP.
 

system {
  archival {
    configuration {
      transfer-on-commit;
      archive-sites {
              "sftp://username@host<:port>/url-path;"" password "<password>"; ## SECRET-DATA
      }
    }
  }
}

The transfer might fail using the below configuration with the following log message on the switch:

Nov 22 11:04:59 EX-1 logger: transfer-file failed to transfer /var/transfer/config/EX-1_20231122_110449_juniper.conf.gz rc 255

Nov 22 11:04:59 EX-1 pfed: ACCT_TRANSFER_FILE_FAILED_ITER: Error <65280> uploading file '/var/transfer/config/EX-1_20231122_110449_juniper.conf.gz'. Remaining retry attempts = 2, retry in 295 seconds...

• Whenever first time we ssh or sftp to a new server we are asked to accept the fingerprint of the server key. Same goes here. The above log messages can be seen most likely when the Junos device doesn’t know the ssh key fingerprint of the backup server / SFTP server where these config files are backed up.
• In such scenario, we configure the SSH-HOST keys for the SFTP server. SSH uses encryption algorithms to generate a host, server, and session key system that ensures secure data transfer. Typically, SSH host key information is automatically retrieved when you set a URL attribute for SFTP using the archival configuration archive-sites statement at the [edit system] hierarchy level.
• However, if the archival site is not backing the config file along with above mentioned log messages, then we can configure the SSH host keys manually using the below command:

user@host# set security ssh-known-hosts fetch-from-server <SFTP-SERVER-IP>

• This will help the Junos device to communicate well with the SFTP server and files will get backed up in the archival sites.

If issue persists even after configuring the SSH host keys then raise a case with JTAC for further investigations.

https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/transfer-on-commit-edit-system.html
https://www.juniper.net/documentation/us/en/software/junos/cli/topics/task/junos-software-system-management-router-configuration-archiving.html#id-10944516