Network health check and documentation
Most networks have been changed far more often than they’ve been drawn. We review the client’s firewalls, routers, switches and wireless as they’re actually configured, document the network properly, and tell you what to fix first.
- Failover nobody has testedThe 4G backup is configured, but nothing shows it has ever carried traffic, so nobody knows whether it would work.
- Admin open to the internetFirewall management is enabled on the internet-facing interface. It’s one of the first things attackers look for when a vulnerability is published.
- One flat networkPCs, phones, printers, cameras and servers all share VLAN 1, so any one compromised device can reach every other.
- Out of updatesThis switch is running the vendor’s final software release. No more security fixes are coming for it.
- A guest that isn’tGuest Wi-Fi has its own VLAN, but a firewall rule added for one visitor lets it reach the file server.
- Not on any drawingToo many MAC addresses behind a single switch port give away an unmanaged switch nobody listed.
The network and its documentation drift apart
A network is designed once and then changed for years: a port opened for a vendor’s remote support, a switch added when the office grew, a Wi-Fi network for a training day that never got turned off.
Each change made sense at the time. Few of them reached the documentation, and the person who made them has often moved on. What’s left is a network everyone relies on and nobody can fully describe, which is a poor starting point for supporting it, securing it or changing it.
- Documented: Guest Wi-Fi is separate from the office network.Found: Guest Wi-Fi has its own VLAN, and a firewall rule that lets it reach the file server.
- Documented: Internet fails over to 4G.Found: The 4G link is set up. Nothing shows it has carried traffic since it was installed.
- Documented: The firewall configuration is backed up.Found: The newest saved copy predates the last firmware upgrade.
- Documented: Remote staff connect by VPN.Found: They do, and so could the accounts of people who left.
- Documented: Two switches in the comms cupboard.Found: Two in the cupboard, one under the reception desk.
The picture comes from the equipment
We don’t redraw the old diagram or ask someone to recall how it was set up. We read the network from the equipment itself, with read-only access, and nothing is changed during the review.
Where the equipment and the existing documentation disagree, the equipment wins, and the disagreement goes in the report. Where something looks wrong but could be deliberate, such as a rule for a line-of-business system or a link kept for a reason, we ask before calling it a fault.
- Running configurationWhat each device is doing today, whatever the old diagram says.
- Neighbour discoveryLLDP and CDP show which device is plugged into which port.
- MAC and ARP tablesWhat’s connected where, including devices nobody listed.
- DHCP scopes and leasesWhich ranges are in use, and how full they are.
- Routing tables and tunnelsHow traffic leaves the site and reaches other sites.
- Firewall policy and objectsWhat’s allowed in, out and between networks.
What we look at, layer by layer
Firewalls, routers, switches and wireless, plus firmware and lifecycle across all of them. Security is checked at each layer rather than written up as a separate section.
-
Firewall and internet edge
What the internet can reach, how the rules have grown, who can administer the firewall and from where, VPN users and settings, and whether logging would tell anyone that something happened.
The judgement callAn unexplained rule isn’t automatically wrong. We check what it allows and whether it’s still used before recommending it goes. Rule-by-rule clean-up is its own firewall audit.
-
Routing and WAN
Default and static routes, routes left behind by old projects, site-to-site tunnels, and how failover between internet links is meant to work.
The judgement callA configured failover hasn’t been shown to work until it’s tested. Proving it means a planned outage, so we document how it’s set up and say exactly what a test would confirm.
-
Switching
VLAN design and where it’s actually used, trunks, spanning tree, port security, management access, and unmanaged switches hiding under desks.
The judgement callLeft on defaults, spanning tree picks the root by the lowest MAC address, which is often the oldest switch in the building. The report says which switch should be root and why.
-
Wireless
Each SSID and the VLAN it lands on, authentication and encryption, shared keys versus per-user sign-in, guest isolation, and access point firmware.
The judgement callThis is a configuration review, not a coverage survey. A guest network can look isolated on the controller and still be routed through to the office by the firewall, so we check both ends.
-
Firmware and lifecycle
What each device runs against the vendor’s recommended release, published security advisories that apply, and where each model sits in the vendor’s support lifecycle.
The judgement callEnd of sale is less urgent than end of security updates. The target firmware is usually the vendor’s recommended release rather than the newest one.
-
Resilience
Single points of failure: one firewall, one core switch, one internet link, one power supply. Whether configuration backups exist, are recent, and are kept somewhere other than the device itself.
The judgement callNot every single point of failure needs fixing. A small office may sensibly accept one firewall. The report says which ones matter for this client, and why.
What the client ends up with
Three documents that describe the network as it is today, written so the next engineer can pick them up without a handover call.
Network diagrams
Drawn from what’s configured: sites, internet links, firewalls, switches, access points, and the VLANs that run between them.
The point of a good diagram is that someone who has never seen the site can answer “where does this cable go?” and “what happens if this box dies?” without logging in to anything.
IP address and VLAN plan
Every VLAN, subnet, gateway and DHCP range in one place, with what each one is for and what’s allowed to talk to it.
It’s also where clashes show up. A client LAN on 192.168.1.0/24 collides with many home routers, which breaks VPN access for staff on those home networks. Overlapping ranges between sites cause the same trouble the day the sites are joined.
| VLAN | Name | Subnet | Gateway | DHCP from | Notes |
|---|---|---|---|---|---|
| 1 | Default | None | None | None | Should carry no devices |
| 10 | Staff | 10.20.10.0/24 | 10.20.10.1 | Firewall | Desks and laptops |
| 20 | Voice | 10.20.20.0/24 | 10.20.20.1 | Firewall | Handsets, prioritised |
| 30 | Guest | 10.20.30.0/24 | 10.20.30.1 | Firewall | Internet only |
| 40 | Printers | 10.20.40.0/24 | 10.20.40.1 | Static | Reachable from Staff |
| 99 | Management | 10.20.99.0/24 | 10.20.99.1 | Static | Switches and access points |
Findings, in the order to fix them
Each finding says what we found, why it matters, the fix and how disruptive the fix is, so you can turn it straight into a quote or a change request.
- Fix nowAnything reachable from the internet that shouldn’t be, and equipment no longer getting security updates.
- PlanSingle points of failure that matter, hardware nearing the end of support, and designs that will hurt the next time something changes.
- TidyNaming, unused rules and VLANs, and small gaps. Low risk, and worth doing when someone is already in there.
Firewall administration enabled on the internet-facing interface
Fix now- Found
- HTTPS administration is allowed on the WAN interface from any address.
- Why it matters
- Exposed management pages are scanned for constantly, and are a common way in when a firewall vulnerability is published.
- Fix
- Remove administration from the WAN interface. Manage over the VPN or from the management VLAN.
- Disruption
- Low. No user impact. Anyone managing the firewall remotely needs the new path first.
A baseline you can support the network from
The documents are yours to hand to the client and to keep working from. You keep the client and the ongoing service; the review gives you an accurate picture of what you’re supporting.
- Firewall audit and clean-up, when the rule base needs more than a review.
- Router and switch migration, when equipment is out of support.
- Network monitoring setup, so the next problem gets noticed.
- New client takeover, when the network is one part of a wider handover.
Tell us about the client’s sites and equipment, and we’ll come back with a fixed-price quote.
Request a quote for this project