Configuration Validation¶
The final check before treating the network as ready — later and more specific than Testing Procedures's functional tests, focused on confirming the configuration itself is complete, correct, and saved.
Configuration Completeness¶
Cisco IOS — privileged EXEC:
show running-config
Walk through it against what was intended, checking specifically for:
- No leftover configuration from testing (temporary ACLs, debug settings, test VLANs)
- All intended VLANs, trunk/access assignments, and SVIs present — see VLANs & Inter-VLAN Routing
- Security Checklist items all actually applied, not just remembered as "usually done"
Configuration Saved¶
The single most common late-stage mistake: everything works, but nothing was saved, and a reboot (power blip, accidental reload) reverts to an old or blank config.
Save the config (see Configuration Management & Recovery), then compare:
Cisco IOS — privileged EXEC:
copy running-config startup-config
show running-config
show startup-config
Faster than eyeballing both listings: show archive config differences nvram:startup-config system:running-config (privileged EXEC) prints only the lines that differ — output with no +/- lines means the save took. Don't just assume the copy succeeded.
Backup Taken Post-Final-Config¶
Once the config is final and saved, take a fresh export — the pre-deployment backup from days earlier is no longer the current source of truth:
Cisco IOS — privileged EXEC:
copy running-config tftp://10.0.99.5/sw01-event-final.cfg
See Backup and Restore via TFTP.
If the Netgate or Ruckus config changed during setup, re-export those too — pfSense: Diagnostics → Backup & Restore (see Netgate 6100 MAX Administration); ZoneDirector: Administer → Backup.
Security Posture Confirmed¶
- Default passwords changed everywhere — switch, Netgate, Ruckus controller
- SSH-only management confirmed, Telnet disabled
- SNMP/syslog community strings and credentials are non-default (see SNMP, Syslog)
- Unused ports shut and parked in the blackhole VLAN — see Disable Unused Ports
Logging Confirmed Live¶
Not just configured — actually verified arriving at the syslog server, per the last step of Testing Procedures. A misconfigured logging destination fails silently from the device's own perspective.
Sign-Off¶
Once every item above is confirmed, the deployment is ready. Record the result somewhere durable — a simple "validated on [date], by [who], config backup at [location]" note is enough to answer "was this actually checked?" days or weeks later.