108 lines
3.0 KiB
Markdown
108 lines
3.0 KiB
Markdown
# Network Cutover Red Team Card
|
||
|
||
Use this during the live window when your brain gets dumb.
|
||
|
||
Historical status note:
|
||
- this card belongs to the 2026-05-22 cutover-planning wave
|
||
- keep it as operator evidence, but do not treat it as the current backlog without checking later migration result docs
|
||
|
||
Goal:
|
||
- make one clean change
|
||
- validate it
|
||
- either continue or revert
|
||
|
||
If you feel rushed, stop.
|
||
|
||
---
|
||
|
||
## DO
|
||
|
||
- Keep one known-good Trusted admin client online the entire time.
|
||
- Keep Rocinante alive as the live control box until the main server batch is done or a fallback admin path is proven.
|
||
- Keep UniFi open.
|
||
- Keep the master operator sheet open.
|
||
- Change one thing at a time.
|
||
- Validate after every host, SSID, profile, or firewall change.
|
||
- Revert the last change fast if the break is not obvious.
|
||
- Write down temporary exceptions immediately.
|
||
- Treat Legacy CIA as quarantine, not a place to hide problems.
|
||
|
||
## DO NOT
|
||
|
||
- Do not move unrelated core hosts casually.
|
||
- Do not move Rocinante early if you are actively driving the migration from it.
|
||
- Do not touch port 27 casually.
|
||
- Do not touch port 1 unless intentionally normalizing infra.
|
||
- Do not "clean up" Google/cast weirdness early.
|
||
- Do not add broad allow-any-any panic rules.
|
||
- Do not keep pushing forward while tired or annoyed.
|
||
- Do not trust memory when the docs already exist.
|
||
|
||
---
|
||
|
||
## FIRST IF BROKEN
|
||
|
||
1. Ask: what was the very last change?
|
||
2. Revert that exact change first.
|
||
3. Restore management reachability before anything else.
|
||
4. Confirm UniFi gateway, switch, and AP visibility.
|
||
5. Confirm the Trusted admin client still reaches the controller.
|
||
6. Only then decide whether to retry.
|
||
|
||
If management breaks:
|
||
- revert the last infra/profile/VLAN change immediately
|
||
- stop until control-plane access is stable
|
||
|
||
If the Nomad/Serenity/PD batch breaks:
|
||
- revert the last moved host first and unwind in reverse order
|
||
- do not start debugging Google nonsense in the middle of a storage/service outage
|
||
|
||
If a server breaks:
|
||
- revert only that server/port/profile
|
||
- do not move the next server yet
|
||
|
||
If an IoT device breaks:
|
||
- revert only that device
|
||
- keep the rest of the window moving
|
||
|
||
If Google/cast gets weird:
|
||
- defer it
|
||
- do not poison policy for the whole network
|
||
|
||
---
|
||
|
||
## SAFE ORDER
|
||
|
||
1. Baseline capture
|
||
2. Create/confirm objects only
|
||
3. Management cleanup
|
||
4. Security/chimes/camera lane
|
||
5. Server ports one by one
|
||
6. Easy IoT wins
|
||
7. Legacy CIA quarantine pass
|
||
8. Google weirdness only if time and confidence remain
|
||
9. Guest/SSID cleanup
|
||
10. Final validation
|
||
11. Stop
|
||
|
||
---
|
||
|
||
## SUCCESS LOOKS LIKE
|
||
|
||
- Management materially cleaner
|
||
- Camera/Security lane exists
|
||
- Servers lane exists and core hosts are moved or clearly staged
|
||
- Easy-value IoT devices are moved
|
||
- Legacy CIA is now an explicit quarantine/sunset lane
|
||
- No broad insecure emergency rules were added
|
||
|
||
## HARD STOP
|
||
|
||
Stop if:
|
||
- you lose clear management reachability
|
||
- you are stacking unresolved breakage
|
||
- you are guessing instead of validating
|
||
- you catch yourself saying "it’ll probably be fine"
|
||
|
||
That sentence means stop.
|