Before deploymentlinux-network

Checklist: Network readiness pre-deploy verification

35 items ·28 critical ·7 warn ·0 info

Use this checklist before promoting any host or service to production. Run it from a known-good source (your workstation or a debug host) and from the target host itself. Any failure must be resolved before deployment.

How to use this checklist

Run each command from the target host and from a known-good source. Resolve any critical item before deploy. warn items should be reviewed but do not block deploy.

Sign-off

Operator: _________________ Date: ___________
Reviewer: ________________ Date: ___________

Critical28 items

Static IPv4 (or documented DHCP) address is configured and matches the IPAM.
```
ip -br addr show
```
Hostname is set in /etc/hostname and matches DNS forward and reverse lookups.
```
hostname; hostname -f
```
Default route is present and points to the correct gateway.
```
ip route show default
```
`ip route get <external>` returns the expected path with the expected source.
```
ip route get 8.8.8.8
```

Interface is UP at the expected speed and duplex.

ip link show; ethtool <iface> | grep -E 'Speed|Link detected'

Path MTU is verified end-to-end to every peer at the full frame size, not just configured on the local interface. An interface set to 9000 whose switch path carries 1500 passes every small-packet check and stalls on every bulk transfer.
```
ip link show <iface> | grep -o 'mtu [0-9]*'; tracepath -n <peer>; ping -M do -c 3 -s $((MTU-28)) <peer>
```
Bonded hosts only: every slave is up, all slaves share one Aggregator ID, the LACP partner fields are populated (not 00:00:00:00:00:00), and miimon is non-zero. A bond with one dead slave and no link monitoring reports as healthy.
```
cat /proc/net/bonding/<bond>
```
Addresses, routes, VLANs and bonds are written in the persistent configuration, not applied by hand. Manual `ip` commands do not survive a reboot, and the host that works today comes back unreachable.
```
ls /etc/netplan/ /etc/systemd/network/ /etc/NetworkManager/system-connections/ 2>/dev/null; networkctl status
```
The host has been rebooted once and every item above re-verified against the running state. This is the only check that proves the persistent configuration is the one actually in effect.
Forward lookup: `dig <hostname>` returns the expected IP.
```
dig <hostname>
```
Reverse lookup: `dig -x <ip>` returns the expected hostname.
```
dig -x <ip>
```
All expected ports are listening (`ss -tlnp`).
```
ss -tlnp
```
Each service is enabled (`systemctl is-enabled`) and starts cleanly on boot.
```
systemctl list-unit-files --state=enabled
```
Every base chain in the filter table has policy drop. The command prints one line per base chain with its policy; any line not reading "drop" is a finding.
```
sudo nft -j list ruleset | jq -r '.nftables[].chain | select(.type=="filter") | "\(.hook)\t\(.policy)"'
```
No unconditional accept left over from testing - an accept with no match expression at all matches everything, whatever the chain policy says. The command prints only such rules, so no output is the pass condition and ANY output is a finding.
```
sudo nft -j list ruleset | jq -r '.nftables[] | select(has("rule")) | .rule | select(any(.expr[]; has("accept"))) | select(any(.expr[]; has("match")) | not) | "chain=\(.chain) handle=\(.handle) comment=\(.comment // "-")"'
```

Certificate is valid and not expired.

echo | openssl s_client -connect <host>:443 2>/dev/null | openssl x509 -noout -dates

Certificate chain is complete (server returns intermediates).
```
openssl s_client -connect <host>:443 -showcerts </dev/null
```

Certificate matches the hostname (CN or SAN).

echo | openssl s_client -connect <host>:443 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

Only TLS 1.2+ is enabled.

nmap --script ssl-enum-ciphers -p 443 <host>

`ping <gateway>` succeeds.
```
ping -c 3 <gw>
```
Every REQUIRED egress destination is reachable on its real port (repo, NTP, DNS, SMTP, log sink). This is the gate, not ICMP: reach the services the host actually needs.
```
for hp in repo.example.com:443 ntp1.example.com:123 10.0.0.1:53; do nc -zv -w3 "${hp%:*}" "${hp#*:}"; done
```
`curl -I https://<hostname>` returns 200 (or expected status).
```
curl -I https://<hostname>
```
Cluster nodes only: every configured Corosync link reports status `connected`. A link left `disconnected` gives the configuration of redundancy and none of the behaviour.
```
corosync-cfgtool -s
```
Cluster nodes only: the two Corosync links follow genuinely independent physical paths (different NICs, switches and uplinks). Two VLANs on the same bond report as two connected links and fail together.
```
corosync-cfgtool -s; ip -br link show
```
Host is registered in the IPAM.
Host is registered in DNS.
Host is registered in the configuration management database.
Owner, team, and contact are recorded.

Warning7 items

Static IPv6 address is configured if required by the host role.
```
ip -6 addr show
```
Any custom routes are documented and present in the running configuration.
```
ip route show
```

No sustained error or drop counters in ethtool -S.

ethtool -S <iface> | grep -E 'errors|dropped|missed'

External resolver (`@8.8.8.8`) returns the same answer as the local resolver.
```
dig @8.8.8.8 <hostname>; dig <hostname>
```
Cloud security groups match the local firewall intent.
ICMP to an external address succeeds. INFORMATIONAL: a host built to the firewall-default-deny item above, or one behind a restrictive cloud egress group, is expected to fail this. A failure is only a defect if your egress policy is supposed to permit ICMP.
```
ping -c 3 8.8.8.8 || echo "ICMP filtered - confirm against the egress policy before recording a failure"
```
`traceroute <external>` completes. `-T` builds raw TCP probes and needs CAP_NET_RAW, so it must run under sudo.
```
sudo traceroute -T -p 443 8.8.8.8
```