VPN Production Readiness Checklist
Checklist discipline. Every item is meant to be answered yes / no with evidence. Items marked critical are non-negotiable; items marked warn are judgement calls; items marked info are baseline expectations.
Items
- VPN technology chosen for the use case (severity: info)
- Key material managed safely (severity: critical)
- MTU verified for the tunnel (severity: info)
- MSS clamping applied at the tunnel interface (severity: info)
- Routing over the tunnel explicit (severity: info)
- Firewall allows the VPN traffic (severity: critical)
- VPN session state monitored (severity: info)
- Failover behaviour planned (severity: info)
- VPN configuration backed up off-router (severity: critical)
- VPN tested for asymmetric routing impact (severity: warn)
- VPN tested for stateful firewall impact (severity: warn)
Severity legend
- info: baseline expectation
- warn: judgement call; production-grade depends on context
- critical: non-negotiable; a missed critical item is a release blocker
Evidence retention
The completed checklist is evidence for the change ticket, the audit, and the post-incident review. Store it where it can be recovered if the router is lost.