The main office VLAN usually comes back first time. The trouble comes from the phones that lose their voice VLAN, the printer with a static address in the old range, and the upstream router still sending traffic to the old firewall’s MAC address.
This free network upgrade checklist replaces or upgrades switches, firewalls, Wi-Fi or WAN and ISP circuits inside a planned maintenance window. Network engineers, IT teams and MSPs use it for end-of-life replacements, capacity upgrades and new circuits. It covers the site survey and as-built records, configuration backups, staging, change approval, user communications, a cutover with a rollback trigger and a time-box, testing after the cutover, monitoring and documentation updates, and disposal of the old kit.
Network checklists tend to be audits: is the configuration secure, are the rules still needed. A cutover asks a different question. Can you swap a device that everything depends on, in a few hours, with a known way back if it goes wrong? The reviews below are useful inputs to an upgrade, but they are not the upgrade.
Security audit
The whole network, assessed
Trigger: an annual schedule or a compliance requirement.
Trigger: end-of-life hardware, a capacity limit or a new circuit.
Output: new kit in service, tested and documented, and old kit gone.
Rollback: the old device, kept ready until the window closes.
Run the rule review before a firewall replacement, not after. Every rule you carry across has to be translated, tested and documented on the new platform, so a replacement is the cheapest moment to drop the ones nobody can justify.
What the Network Upgrade Checklist Covers
Seven phases take a network change from survey to disposal. The scope chosen on the first task decides which Phase 5 checks appear, the change approval halts the checklist before the window, and a rollback task appears if the trigger is met.
Phase 1
Phase 1: Scope, Survey & As-Built
The Scope dropdown on the first task (Switching, Firewall, Wireless or WAN/ISP) shows the matching Phase 5 checks. Changing two layers means two checklists and two windows.
Open the change, choose the scope and name the implementer, approver and rollback owner — replacing the firewall and the core switches in one window doubles what can go wrong
Walk the site and update the as-built record — rack positions, cabling, power, port maps and which closet feeds which floor
Export the current state from the devices themselves — interfaces, VLANs, routes, DHCP scopes and LLDP or CDP neighbours; the diagram is a starting point, not evidence
List what depends on the network besides users — phones, cameras, door access, alarms, building management, payment terminals and printers with static addresses
Check the new kit against the real load — port count, uplink speeds, throughput with security features turned on, and the PoE budget
Confirm support, licences and firmware for the new kit — the vendor’s recommended release, licences activated and support registered to the serial numbers
Phase 2
Phase 2: Backup & Staging
Back up the running configuration of every device in scope and store it off the device — then open the file to prove it is complete
Export controller and cloud dashboard settings — wireless controllers, SD-WAN orchestrators and firewall managers hold configuration the devices do not
Translate the old configuration to the new platform — check NAT, VPN, VLAN and QoS by hand; migration tools convert syntax, not intent
Pre-configure and burn in the new kit on the bench — firmware updated, configuration loaded and powered for at least a day
Label every cable with its new destination — a port map row per patch lead, so the move is mechanical at 2 a.m.
Test what can be tested before the window — a VPN tunnel to a test peer, a spare SSID, or a single access switch on a spare uplink
Phase 3
Phase 3: Change Approval & Window
The approver named on the first task records Approved or Not approved on the last task. The checklist halts there, and nothing is unplugged until they decide.
Write the cutover plan with timings and the rollback steps — each step, its owner, its duration and how it is verified
Set the rollback trigger and the time-box — the point in the window at which you stop fixing forward and go back
Agree the window with the business — away from month-end, payroll and trading peaks, with 24-hour services such as alarms and door access considered
Line up people and access — hands on site, console cables, out-of-band access, ISP and vendor support numbers and spare optics
Notify users, site contacts and third parties — what goes down and for how long; tell the ISP and the alarm monitoring company too
Approve the change — the approver records the decision with the plan and backups attached
Phase 4
Phase 4: Cutover
If the checkpoint answer is Yes, the rollback task appears.
Confirm the go-ahead at the start of the window — people present, backups verified, monitoring alerts paused for the devices in scope
Capture a final snapshot of the old state — ARP and MAC tables, routes and interface status, to compare after the move
Move connections in the planned order using the port map — uplinks first, then access ports, then special cases
Clear stale ARP entries on neighbouring devices — Cisco IOS keeps ARP entries for four hours by default, and upstream routers keep sending to the old MAC address
At the time-box checkpoint, record whether the rollback trigger is met — Yes or No, with the test results so far
Roll back to the old kit — reconnect, confirm service, and record the cause for the next attempt
Phase 5 — By scope
Phase 5: Scope-Specific Checks
Only the tasks matching the Phase 1 scope appear.
Switching: verify trunks, spanning tree and link aggregation — every VLAN allowed on every trunk, the root bridge where it was, all bundle members up
Switching: check the PoE budget under load — total power runs out before ports do once cameras and access points start drawing
Firewall: verify NAT, published services and VPN tunnels — and that remote peers accept the new device’s identity or certificate
Wireless: verify SSIDs, security, VLAN mapping and roaming settings — 6 GHz needs WPA3 or Enhanced Open, and 802.11r can trip up older clients
WAN/ISP: verify routing, failover and new public addresses — update SPF records, VPN peers, DNS records and third-party allowlists that name old addresses
WAN/ISP: fail over to the secondary circuit and back — time both directions
Phase 6
Phase 6: Post-Cutover Testing
DHCP: a fresh client in every VLAN gets a lease — relay addresses on each new gateway interface must point at the right servers
DNS: internal and external names resolve from each VLAN — including split-horizon names and the DNS servers handed out by DHCP
VLANs: reach key services from each VLAN, and confirm what should be blocked is blocked — guest to corporate above all
VPN: site-to-site tunnels are up and remote users connect — test with large transfers too; MTU problems show up as half-loaded pages
VoIP: phones register on the voice VLAN and calls work — make an external call and a transfer, and check call quality
Wi-Fi: roam between access points during a call — and check signal at the edges of coverage
Business owners confirm their critical services — payment terminals, door access, printing and line-of-business apps
Phase 7
Phase 7: Monitoring, Documentation & Disposal
The fourth task records whether the old kit is retired or kept as a spare. Retire shows the disposal task.
Add the new devices to monitoring and remove the old ones — SNMP, syslog, flow data, alert thresholds and the automatic configuration backup schedule
Take a configuration backup of the new kit as the new baseline — after the fixes made during the window, not before
Update diagrams, the IP plan, port maps and the asset register — while the details are fresh
Watch errors, interface flaps and tickets for a week — then record whether the old kit is retired or kept as a spare
Factory reset the old kit and send it to disposal — remove it from vendor cloud dashboards and licence portals first, then follow the IT Asset Disposal Checklist
Close the change record — with backups, test results and the updated diagrams attached
A Four-Hour Window, With the Rollback Decided in Advance
The rollback trigger and time-box set in Phase 3 only work if they are written as times. This example is for a firewall replacement in a window from 22:00 to 02:00. Adjust the times to your window; the rule is that rollback must start early enough to finish before the window ends.
One week before
Approval, communications and staging complete
The change is approved, users and third parties are told, the new firewall has run on the bench with the translated configuration, and spare cables and optics are in the bag.
Afternoon of the change
Final backups and go-ahead
Fresh configuration backups of every affected device, opened and checked. The implementer, the rollback owner and the ISP contact confirm they are available.
22:00
Window opens
Snapshot the ARP, MAC and route tables, then move the cables in port map order. Clear ARP on the upstream router, or ask the ISP to, if it is their equipment.
23:00
Core tests
Internet access, inbound published services, site-to-site VPN and remote access. Problems found here are fixed forward while there is still time.
00:30
Checkpoint: rollback trigger met?
If core tests are not all passing, the answer is Yes and rollback starts now. That leaves ninety minutes to reconnect and verify the old firewall; starting at 01:30 would not.
01:30
Full test list and business checks
DHCP, DNS, VLAN policy, voice and Wi-Fi from Phase 6, plus any service the business owners asked to see working before morning.
02:00 and next morning
Window closes; staff on hand at opening time
Monitoring alerts back on and the result recorded. Someone who did the change is available when the first users arrive, because that is when the edge cases appear.
Why Run Network Cutovers in CheckFlow?
1
The rollback is decided before the window
The change approval is assigned to the approver picked on the first task, and the checklist halts until they decide. At the checkpoint, the rollback answer is a dropdown: record Yes and the rollback task appears, assigned to the rollback owner.
2
One template for four kinds of change
The scope dropdown shows the switching, firewall, wireless or WAN checks and hides the rest. A table inside the staging task holds the port map, one row per patch lead, and a data set keeps your sites and devices consistent across changes.
3
Evidence for the change record
Configuration backups, test results and updated diagrams attach to the tasks they prove. The audit trail shows who moved what and when, and tags keep each client or site separate for MSPs running changes across many networks.
When the trigger you agreed before the window is met, not when the team runs out of ideas. Write the trigger as a test and a time, for example core tests not all passing by the checkpoint, and set the checkpoint early enough that rolling back still finishes inside the window. Deciding at 2 a.m. under pressure is how a four-hour window becomes a lost morning.
Why does traffic fail after a firewall swap when the configuration is identical?
+
Often it is ARP. The new firewall keeps the old IP addresses but has a new MAC address, and the upstream router keeps sending traffic to the old one until its cache entry expires. On Cisco IOS the ARP timeout is four hours by default. A gratuitous ARP may refresh the primary address but not extra addresses used for NAT. Clear the ARP cache upstream, or ask the ISP to, as part of the cutover.
How do you check the PoE budget for a switch replacement?
+
Add up what the connected devices need, not the number of ports. Per port, 802.3af supplies up to 15.4 W, 802.3at up to 30 W, and 802.3bt up to 60 W (Type 3) or 90 W (Type 4) at the switch, with less arriving at the device. The switch’s total PoE budget is usually lower than every port at full power, so newer access points and PTZ cameras can exhaust it while ports are still free.
Do Wi-Fi 6E and Wi-Fi 7 networks need WPA3?
+
On the 6 GHz band, yes. The Wi-Fi Alliance requires WPA3 or Enhanced Open there, with protected management frames; WPA2 is not permitted. Older clients that only support WPA2 stay on 2.4 GHz and 5 GHz, so a wireless upgrade often needs a separate SSID or transition settings for them. Test those clients in the window.
How is this different from a network security audit?
+
An audit assesses the network as it stands and produces findings. This checklist changes the network: it replaces a device or circuit in a planned window with approval, rollback and testing. The two connect. An audit finding such as unsupported firewall firmware often becomes the trigger for an upgrade, and the upgrade closes the finding.
Is CheckFlow free for this template?
+
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
Cut Over on Schedule, With a Way Back Ready
Free trial — no credit card required.
Do you like cookies? 🍪 We use cookies to ensure you get the best experience on our website. Learn more
