# Network Migration Remaining Checklist

Current intent: only safe, low-drama follow-up work remains. The easy-value client cleanup already completed should not be re-run.

## Already completed
- Servers network/profile exists in UniFi
- Protect WiFi Chime `upstairs landing` moved from Management -> Camera
- Protect WiFi Chime `Living Room` moved from Management -> Camera
- `LG_Smart_Laundry2_open` moved from Trusted -> IoT
- `MyQ-29B` moved from Old IoT -> IoT
- `LG_Smart_Dryer2_open` moved from Old IoT -> IoT
- `Samsung-FamilyHub` moved from Old IoT -> IoT
- `Main-Floor` ecobee moved from Old IoT -> IoT
- `Upstairs` ecobee moved from Old IoT -> IoT
- These 8 client moves were verified live from UniFi `stat/sta`
- Firewall object/group scaffolding exists
- Basic custom outbound policy scaffolding exists (`Allow Internal to Untrusted`)
- First live management-plane hardening slice is now applied: `Block Untrusted to Gateway Admin Surfaces`
- Reference: `unifi-firewall-enforcement-result-2026-05-23.md`

## Safe to do now
1. Documentation cleanup
   - treat older pre-move docs as historical snapshots, not live next-step instructions
   - use this file as the current remaining-work reference

2. Finalize remaining task list
   - keep Google/cast pilot explicitly deferred until John is on the laptop
   - keep unknown Legacy CIA devices explicitly quarantine-first
   - Trusted-lane Intellirocks cleanup is now resolved separately; see `intellirocks-triage-result-2026-05-23.md`
   - Legacy CIA leftovers are now dispositioned separately; see `unifi-legacy-cia-closeout-2026-05-23.md`

3. Non-disruptive firewall planning cleanup
   - compare staged firewall objects/policies against desired rule order
   - produce a precise missing-rules gap list before any live rule apply

## Still pending before the migration is truly finished

### A. Google/cast validation batch
Do later, with user present on laptop:
- pilot one Google/cast-class device only
- validate Plex playback
- validate Plex discovery/casting
- validate Dispatcharr once relevant
- if ugly, revert that one device and defer the rest

Likely candidates still needing that treatment:
- `dc:e5:5b:8f:57:d2` (Google client currently in Trusted)
- `Google-Home-Mini`
- `3c:8d:20:f3:92:36`
- `90:ca:fa:b6:7f:6e`

### B. Remaining Trusted-lane cleanup
- Completed: `d4:ad:fc:f2:df:d2` was removed from Trusted and re-homed to `Old IoT`
- Reference: `intellirocks-triage-result-2026-05-23.md`

### C. Legacy CIA quarantine closeout
- Completed as a disposition decision: the remaining unidentified leftovers stay quarantined on `Old IoT`
- Reference: `unifi-legacy-cia-closeout-2026-05-23.md`

### D. Real firewall enforcement
Partially completed:
- live custom rule now blocks `IoT` / `Camera` / `Old IoT` access to the UDM Pro admin TCP ports
- reference: `unifi-firewall-enforcement-result-2026-05-23.md`

Still needed if the full design is to be enforced rather than just the first safe slice:
- stateful baseline review against UniFi built-ins
- broader management shield only after DHCP/DNS/gateway dependencies are verified
- explicit Trusted admin -> Management allows if broad internal->gateway restrictions are introduced later
- Trusted -> Servers allow only if later intra-Internal restrictions are introduced
- any camera/Protect helper exceptions after port-level verification
- any Google/cast discovery exceptions only after laptop validation

Important distinction:
- groups/objects exist
- at least one custom outbound policy exists
- the full inter-VLAN segmentation matrix is not yet fully enforced

### E. Final cleanup
- SSID simplification once Google/cast behavior is understood
- reference SSID retire/keep plan: `unifi-ssid-cleanup-proposal-2026-05-23.md`
- final validation sweep
- confirm no temporary panic exceptions remain
- document any intentionally deferred weird devices

## Suggested execution order from here
1. Wait for laptop session
2. Human-validate the already-completed Google/cast pilot from the laptop
3. Finish firewall enforcement carefully
4. Do final SSID simplification and closeout using `unifi-ssid-cleanup-proposal-2026-05-23.md`