Proxmox Backup to NAS: NFS vs SMB Setup and Restore Checklist

Preparation date: September 17, 2026. Scope: This is a documentation-based implementation and verification guide, not a claim about a completed customer incident. It covers ordinary Proxmox VE VZDump backups written to NAS storage. A Proxmox Backup Server datastore is a different architecture and is called out separately. The short answer is: choose NFS when Proxmox is the main consumer and your NAS can restrict the export to the Proxmox node addresses. Choose SMB/CIFS when the same share must also fit a Windows-oriented operating model or your NAS administration is already built around named users and SMB permissions. The protocol choice matters, but the restore test matters more. A green backup task proves that an archive was written; it does not prove that you can recover a VM on replacement storage. Proxmox backup to NAS verification flow A Proxmox node writes a VZDump backup over NFS or SMB to a NAS, then a separate restore test validates recovery. ...
Post a Comment

Horizon Disconnects with Zscaler Client Connector: Evidence-First Troubleshooting

Horizon disconnecting while Zscaler Client Connector is installed does not establish a driver conflict. First distinguish an application crash, a session disconnect, a tunnel state change, and an ordinary network interruption. Their evidence and owners differ.

Correction — September 12, 2026: This article previously asserted memory collisions and a fixed disconnect pattern without diagnostic evidence, recommended broad traffic bypasses, and prescribed an MTU range as a general fix. Those claims and instructions have been removed. The guide below is a documentation-based investigation workflow, not a confirmed vendor defect report.

Collect one synchronized incident timeline

ObservationUseful evidenceInitial owner
Horizon process exitsCrash event, exact process and module, Client version, timestampEndpoint and Horizon support
Process stays open but desktop disconnectsClient/Agent and gateway logs, selected protocol, destinationVDI and network teams
Client Connector changes stateConnector error/status, effective profile, logs at the same timeZscaler administrator
Other services fail simultaneouslyEndpoint interface events, route changes, broader connectivity evidenceEndpoint or network team

Record exact Horizon and Client Connector versions, endpoint OS build, location, and whether the path uses UAG. Describe the effective Zscaler service and forwarding configuration rather than grouping every ZIA and ZPA deployment into a single tunnel behavior. Time-correlated symptoms narrow the investigation; they do not on their own prove causality.

Gather supported diagnostics

Use the diagnostic options described in Zscaler's Client Connector troubleshooting documentation. Coordinate the collection window with the administrator and restore the normal log level afterward. Logs and captures can contain internal addresses and sensitive session details; store them in the restricted support system.

Check Zscaler's packet-capture guidance when the ordinary endpoint capture does not show the relevant traffic. Capture visibility depends on the driver and collection method. Absence from one capture is not sufficient evidence that a packet was never sent.

Compare the route without disabling security

  1. Identify authentication and session traffic separately using Omnissa's Horizon connection guide.
  2. Compare a known-good and affected endpoint with the same approved account, pool, and client versions where possible. Record effective policy differences.
  3. Correlate the failed attempt with gateway, Connector, and firewall evidence. A reset packet or timeout requires investigation of its source and surrounding events.
  4. If the security owner authorizes a policy comparison, use a scoped pilot with a defined end time and rollback. Do not advise users to disable Client Connector or broadly exempt the gateway from inspection.

When MTU or compatibility becomes a reasonable lead

Investigate path MTU only when the observations support a packet-size or fragmentation issue. Let the network owner choose and validate a change for the actual path; a fixed value copied from another deployment can be ineffective or harmful. Keep the original configuration and test other business traffic after any adjustment.

A driver compatibility hypothesis needs a reproducible crash signature, supported-version comparison, or vendor finding. Do not label two installed products incompatible merely because both interact with networking. Likewise, encryption in Horizon does not by itself remove an organization's requirement for access controls or traffic inspection.

Verify and escalate

After a scoped correction, repeat fresh login, launch, reconnect, and the operation that preceded the incident. Observe for a period that covers the previously measured recurrence interval. Confirm that security controls remain active and unrelated applications still work. If the problem remains, send both vendors the same sanitized timeline, configuration, and comparison results rather than separate narratives that assume a cause.

Related troubleshooting guides

Comments

Post a Comment

Popular posts from this blog

Horizon vdpConnect_Failure: Connection-Stage Triage Before Reinstalling

vdpConnect_Failure is a starting symptom, not a root-cause diagnosis. Before reinstalling Horizon Agent or opening firewall ports, establish whether the failure occurs during authentication, desktop launch, or an established session. This documentation-based triage guide does not report a reproduced incident or a universal fix. Corrected September 12, 2026: The earlier guide suggested restarting the Windows RPC service and treated a local netstat listing as a test for blocked ports. Those instructions have been removed. A socket listing does not demonstrate end-to-end reachability. Classify the failure before making changes Observation First evidence to collect Avoid assuming Authentication never completes Exact login error, identity provider or broker event, timestamp That the display protocol is the failing component. Desktop selection succeeds, launch fails Assigned desktop, chosen protocol, Client/Agent and gateway logs That a successful HTTPS login proves the session path ...
Read more

Horizon Agent Unreachable: Registration and Desktop-Health Triage

Start an “Agent Unreachable” investigation by separating desktop health, Agent registration, and session traffic. Do not begin with a pool rebuild. This documentation-based triage guide helps decide which team should act and what evidence to preserve. Correction, September 12, 2026: The earlier guide mixed display ports with Agent communication, tested Blast against the Connection Server, and offered generic service restarts and image rebuilds. Those instructions have been replaced with path-specific investigation. First-response decision table Check Evidence Investigation owner Is the guest responsive? Approved console access, OS health, resource and disk observations Desktop/virtualization team if the OS is unavailable. Is this one desktop or a whole image family? Affected pool, image revision, Agent version, start time Image owner if failures align with a deployment. Does registration fail? Agent and Connection Server events for the same desktop and time Horizon team, then netw...
Read more

Horizon Protocol Error: Trace the Display-Session Handoff

A desktop can authenticate successfully and still fail to establish its display session. This guide investigates that handoff. Use it after identifying the actual console/client error, not as a claim that every “Protocol Error” means a firewall failure. Correction, September 12, 2026: The previous version combined a general checklist with an unverified incident narrative, conflated gateway and desktop port directions, and recommended blanket endpoint-security exclusions. Those instructions have been removed. This is a documentation-based diagnostic plan. Draw the attempted connection Record the selected protocol, assigned desktop, Client and Agent versions, gateway route, and attempt time. Distinguish a direct internal connection from an external UAG connection or a Connection Server tunnel. Use Omnissa's connection guide to identify where the failed handoff occurs. Stage Question Useful comparison Authentication Did the user receive desktop entitlement? Failed login versus ...
Read more