NETWORK SETUP CHECKLIST
Planning, addressing & WAN
Vendor-neutral | Tick verified items; mark non-applicable items N/A.
Project / site: __________________________________________
Reviewer: _____________________ Date: __________________
01 Scope & design
Sites, users, devices and required services identified.
Physical and logical network diagrams documented.
Device roles, hostnames, interfaces and uplinks recorded.
Capacity, availability and performance requirements agreed.
Change window, recovery access and rollback plan approved.
Lab or test traffic isolated from production where applicable.
02 IP address plan
IPv4 and IPv6 requirements explicitly defined.
Unique, non-overlapping subnets assigned to each routed segment.
Prefix lengths selected for host capacity and point-to-point requirements.
Core/router addresses and default gateways recorded for every subnet.
Management addresses assigned to routers, switches and access points.
Static addresses, DHCP ranges, exclusions and reservations documented.
Address conflicts checked against remote sites, VPNs and cloud networks.
03 ISP / WAN handoff
Provider details, circuit identifiers and support contacts recorded.
WAN addressing method and any provider VLAN requirements confirmed.
WAN addresses, prefix lengths, gateways and DNS details recorded.
Public, private or carrier-grade NAT status confirmed for each circuit.
Link speed, duplex and MTU requirements verified.
Primary and backup circuits identified; direct gateway reachability verified.
Planning • Implementation • Verification
1/4
NETWORK SETUP CHECKLIST
Switching & network services
Vendor-neutral | Tick verified items; mark non-applicable items N/A.
04 VLANs & switching
VLAN IDs, names, purposes and associated subnets documented.
Access ports assigned to the correct untagged VLAN and PVID.
Trunk links carry only the required tagged VLANs.
Native or untagged VLAN expectations match at both ends of each trunk.
Management VLAN and device management interfaces correctly assigned.
Bridge/switch VLAN membership and ingress filtering verified.
Loop prevention, edge-port protection and unused-port policy configured.
05 Core & device management
Inter-VLAN routing location and gateway ownership confirmed.
Gateway addresses assigned to the correct routed or VLAN interfaces.
Default or shared administrator credentials replaced.
Management services restricted to approved networks and protocols.
Unnecessary services disabled; remote administration uses a secure path.
Recovery console or out-of-band access verified before restrictive changes.
06 DHCP, DNS & time
DHCP scopes, masks, gateways, lease settings and reservations verified.
DHCP relay configured only on segments that require it.
No unintended DHCP servers or overlapping address pools present.
Client DNS resolution and required internal records verified.
DNS recursion restricted to approved clients; public open recursion prevented.
Time zone and trusted time synchronisation configured consistently.
07 Wireless — if applicable
SSIDs mapped to their intended VLANs.
Wireless authentication and encryption match the security policy.
Guest wireless isolation and permitted access verified.
Coverage, capacity and roaming checked where required.
Planning • Implementation • Verification
2/4
NETWORK SETUP CHECKLIST
Routing, NAT & security
Vendor-neutral | Tick verified items; mark non-applicable items N/A.
08 Routing & resilience
Connected, static and dynamic routes match the approved design.
Return paths exist for all permitted routed traffic.
Primary and backup default routes have the intended preference.
Health checks detect the relevant link and upstream-service failures.
Failover, recovery and failback behaviour verified for each required circuit.
Asymmetric routing and active-session behaviour during failover assessed.
09 NAT — where required
Source NAT configured only for networks and egress paths that require it.
Internal, inter-site and VPN traffic is exempt from NAT where appropriate.
Destination NAT limited to approved published services and destinations.
Matching security policy, return path and translation behaviour verified.
Double NAT, hairpin NAT and upstream NAT constraints addressed if applicable.
10 Firewall & access control
Separate policies defined for device access and traffic passing through it.
Stateful return traffic and invalid-traffic handling verified.
Required DHCP, DNS, time and diagnostic traffic explicitly considered.
Inter-VLAN access limited to approved source, destination and service needs.
Guest, untrusted and management networks have the intended separation.
Unsolicited inbound traffic denied except for explicitly approved services.
IPv4/IPv6 policy, rule order, logging and rate limits reviewed.
11 VPN / remote access — if applicable
VPN peers, permitted networks and authentication requirements documented.
Secure credentials, keys or certificates provisioned and protected.
Routing, firewall policy and NAT exemptions match the VPN design.
Tunnel recovery, remote access restrictions and revocation verified.
Planning • Implementation • Verification
3/4
NETWORK SETUP CHECKLIST
Validation & operational handover
Vendor-neutral | Tick verified items; mark non-applicable items N/A.
12 End-to-end acceptance
Each client receives or uses the correct address, mask, gateway and DNS.
Clients reach their local gateway and approved shared services.
Same-VLAN and permitted inter-VLAN traffic works as intended.
Disallowed inter-VLAN and guest traffic is demonstrably blocked.
Required external or simulated upstream services are reachable.
Published services and VPN paths tested from appropriate external peers.
Each required failure and recovery scenario tested with traffic running.
Performance and saved-configuration persistence verified within approved scope.
13 Monitoring & maintenance
Device availability, link state and service-health monitoring configured.
Important security, authentication and failover events are logged.
Alerts and recovery notices tested without exposing sensitive information.
Monitoring failure is distinguished from a healthy or empty result.
Update, configuration-review and credential/certificate renewal ownership agreed.
14 Backup, recovery & sign-off
Pre-change and final configurations backed up securely.
Backup access, retention and off-device storage requirements verified.
Restore or rollback procedure tested in an appropriately safe environment.
Final addressing, VLAN, port, routing, NAT and firewall records updated.
Credentials and recovery material stored separately from general documentation.
Exceptions, outstanding risks and untested items recorded with an owner.
Operational ownership, acceptance results and final sign-off recorded.
Planning • Implementation • Verification
4/4