Network Upgrade & Cutover Checklist Template

The Scope dropdown on the first task (Switching, Firewall, Wireless or WAN/ISP) shows the matching Phase 5 checks. Changing two layers means two checklists and two windows.

• Open the change, choose the scope and name the implementer, approver and rollback owner — replacing the firewall and the core switches in one window doubles what can go wrong
• Walk the site and update the as-built record — rack positions, cabling, power, port maps and which closet feeds which floor
• Export the current state from the devices themselves — interfaces, VLANs, routes, DHCP scopes and LLDP or CDP neighbours; the diagram is a starting point, not evidence
• List what depends on the network besides users — phones, cameras, door access, alarms, building management, payment terminals and printers with static addresses
• Check the new kit against the real load — port count, uplink speeds, throughput with security features turned on, and the PoE budget
• Confirm support, licences and firmware for the new kit — the vendor’s recommended release, licences activated and support registered to the serial numbers

• Back up the running configuration of every device in scope and store it off the device — then open the file to prove it is complete
• Export controller and cloud dashboard settings — wireless controllers, SD-WAN orchestrators and firewall managers hold configuration the devices do not
• Translate the old configuration to the new platform — check NAT, VPN, VLAN and QoS by hand; migration tools convert syntax, not intent
• Pre-configure and burn in the new kit on the bench — firmware updated, configuration loaded and powered for at least a day
• Label every cable with its new destination — a port map row per patch lead, so the move is mechanical at 2 a.m.
• Test what can be tested before the window — a VPN tunnel to a test peer, a spare SSID, or a single access switch on a spare uplink

The approver named on the first task records Approved or Not approved on the last task. The checklist halts there, and nothing is unplugged until they decide.

• Write the cutover plan with timings and the rollback steps — each step, its owner, its duration and how it is verified
• Set the rollback trigger and the time-box — the point in the window at which you stop fixing forward and go back
• Agree the window with the business — away from month-end, payroll and trading peaks, with 24-hour services such as alarms and door access considered
• Line up people and access — hands on site, console cables, out-of-band access, ISP and vendor support numbers and spare optics
• Notify users, site contacts and third parties — what goes down and for how long; tell the ISP and the alarm monitoring company too
• Approve the change — the approver records the decision with the plan and backups attached

If the checkpoint answer is Yes, the rollback task appears.

• Confirm the go-ahead at the start of the window — people present, backups verified, monitoring alerts paused for the devices in scope
• Capture a final snapshot of the old state — ARP and MAC tables, routes and interface status, to compare after the move
• Move connections in the planned order using the port map — uplinks first, then access ports, then special cases
• Clear stale ARP entries on neighbouring devices — Cisco IOS keeps ARP entries for four hours by default, and upstream routers keep sending to the old MAC address
• At the time-box checkpoint, record whether the rollback trigger is met — Yes or No, with the test results so far
• Roll back to the old kit — reconnect, confirm service, and record the cause for the next attempt

Only the tasks matching the Phase 1 scope appear.

• Switching: verify trunks, spanning tree and link aggregation — every VLAN allowed on every trunk, the root bridge where it was, all bundle members up
• Switching: check the PoE budget under load — total power runs out before ports do once cameras and access points start drawing
• Firewall: verify NAT, published services and VPN tunnels — and that remote peers accept the new device’s identity or certificate
• Wireless: verify SSIDs, security, VLAN mapping and roaming settings — 6 GHz needs WPA3 or Enhanced Open, and 802.11r can trip up older clients
• WAN/ISP: verify routing, failover and new public addresses — update SPF records, VPN peers, DNS records and third-party allowlists that name old addresses
• WAN/ISP: fail over to the secondary circuit and back — time both directions

• DHCP: a fresh client in every VLAN gets a lease — relay addresses on each new gateway interface must point at the right servers
• DNS: internal and external names resolve from each VLAN — including split-horizon names and the DNS servers handed out by DHCP
• VLANs: reach key services from each VLAN, and confirm what should be blocked is blocked — guest to corporate above all
• VPN: site-to-site tunnels are up and remote users connect — test with large transfers too; MTU problems show up as half-loaded pages
• VoIP: phones register on the voice VLAN and calls work — make an external call and a transfer, and check call quality
• Wi-Fi: roam between access points during a call — and check signal at the edges of coverage
• Business owners confirm their critical services — payment terminals, door access, printing and line-of-business apps

The fourth task records whether the old kit is retired or kept as a spare. Retire shows the disposal task.

• Add the new devices to monitoring and remove the old ones — SNMP, syslog, flow data, alert thresholds and the automatic configuration backup schedule
• Take a configuration backup of the new kit as the new baseline — after the fixes made during the window, not before
• Update diagrams, the IP plan, port maps and the asset register — while the details are fresh
• Watch errors, interface flaps and tickets for a week — then record whether the old kit is retired or kept as a spare
• Factory reset the old kit and send it to disposal — remove it from vendor cloud dashboards and licence portals first, then follow the IT Asset Disposal Checklist
• Close the change record — with backups, test results and the updated diagrams attached