VyOS Production Readiness Checklist
Checklist discipline. Every item is meant to be answered yes / no with evidence. Items marked critical are non-negotiable; items marked warn are judgement calls; items marked info are baseline expectations.
Items
- Hardware meets production sizing (CPU, RAM, NIC, storage) (severity: info)
- VyOS 1.5 LTS (circinus) installed from the official ISO (severity: info)
- Console access validated, OOB access path tested (severity: critical) — command:
show console - Management VRF configured and reachable from operator network (severity: critical) — command:
show vrf; ping -I mgmt - SSH hardened (key-only, modern algorithms, source ACL) (severity: warn)
- Out-of-band access (IPMI / serial) tested and documented (severity: critical)
- NTP synchronised from a trusted source (severity: info) — command:
chronyc sources - DNS configured and resolved for management hosts (severity: info)
- Logging forwarded to central syslog (severity: info)
- Monitoring exporting interface, BGP/OSPF/VRRP, CPU, memory (severity: info)
- Configuration saved and backed up off-router (severity: critical)
- Restore tested on a scratch router (severity: warn)
- Routing-protocol authentication configured (severity: critical)
- max-prefix set on BGP peers (severity: warn)
- Default-deny outbound BGP filter in place (severity: critical)
- MTU verified end-to-end including tunnels (severity: info)
- VRF boundaries documented and validated (severity: info)
- Change-management process understood and approved (severity: info)
Severity legend
- info: baseline expectation
- warn: judgement call; production-grade depends on context
- critical: non-negotiable; a missed critical item is a release blocker
Evidence retention
The completed checklist is evidence for the change ticket, the audit, and the post-incident review. Store it where it can be recovered if the router is lost.