Network Validation Runbook

Network acceptance tests one layer at a time. A successful internet request cannot substitute for proving the correct VLAN, sole gateway, DHCP owner, negative firewall path, and stable RSTP topology.

Local Recovery Required

Firewall, interface, switch-profile, and RSTP changes require local hands and a working Proxmox console or IPMI path. Validation is read-only except for the deliberate A6 one-DAC-at-a-time failure tests.

Evidence Record

Field	Capture
Timestamp and phase	Current A-phase and gate under test
Source	Device, switch port or SSID, VLAN, IP/CIDR, and MAC
Destination	Hostname/IP, expected VLAN, protocol, and port
Expected result	Allow, deny, no route, lease values, or RSTP state
Observed result	Command/UI output, OPNsense log/state, or UniFi topology state
Verdict	Pass or fail; no “mostly”
Artifact	Screenshot, exported config, text capture, or labeled cable/port audit

Define the expected result before running the probe. A successful request and its adjacent prohibited flow are separate evidence.

Preflight

Confirm the phase in Build Phases and use only addresses whose lifecycle gate passed.
Capture current OPNsense and UOS exports before a configuration milestone.
Reconcile the source with the final port map or approved temporary test port.
Record the intended switch profile, native VLAN, tagged allow-list, and PoE state.
Confirm local console/IPMI access and the rollback cable map.
Choose at least one positive and one negative probe for every policy rule under test.

Layered Acceptance Sequence

Order	Layer	Evidence	Pass condition
1	Physical link	Expected port, speed/duplex, link state, cable label	Correct endpoints and no unexpected bootstrap/target bridge
2	Switch profile	Access/native VLAN, tagged allow-list, disabled spare ports	Exact port-map match; no `Allow All` trunk
3	Endpoint addressing	IP/CIDR, gateway, DNS, MAC, assignment owner	Matches the IP registry and DHCP/IPAM workflow
4	Same-VLAN Layer 2	Peer reachability and neighbor/ARP resolution	Approved peer works without OPNsense
5	Gateway	Reachability to local `.1` on routed VLANs	Exactly one OPNsense `.1`; no gateway on 25/60/65/999
6	DHCP	Lease, mask, router, DNS options, owning server	Client lease is in scope; no second server; infrastructure matches design
7	DNS	External name and approved `core.aorxi.io` records	Expected resolver answers; A/PTR data matches the current phase
8	NAT/WAN	Public destination, OPNsense state/log, WAN lease	Egress uses the phase-correct upstream; no unsolicited inbound exposure
9	Firewall policy	Positive and adjacent negative probes	Both match the policy matrix on the expected ingress interface
10	RSTP	Root, alternate/discarding path, one-DAC results	`sa-sw-01` is root; exactly one alternate path; every DAC test reconverges
11	WireGuard	Transit peers, approved remote flow, prohibited local-only flow	Later campaign only; no NAT or stretched L2, and each site survives tunnel loss

Standard Client Probes

Replace placeholders with the recorded tuple rather than scanning a subnet.

ip -br addr
ip route
ping -c 3 <local-gateway-or-same-vlan-peer>
dig @<expected-resolver> <record.core.aorxi.io> A
dig @<expected-resolver> -x <address>
curl -I https://<approved-public-test>
traceroute <routed-destination>

For a deny test, timeout or rejection alone is incomplete. Correlate it with the expected OPNsense ingress rule/log, or with the absence of a gateway when testing VLAN 25 or 60.

RSTP Failure Test

Run only in A6 after profiles and priorities are audited:

Record sa-sw-01 as root and the observed alternate/discarding port.
Verify VLAN 10 management, a routed gateway, DNS, and WAN before the pull.
Disconnect one DAC only and record convergence.
Repeat the same probes.
Restore the DAC and wait for the recorded steady state.
Repeat for each remaining DAC, never pulling two at once.
Confirm XG6 is absent from the target spanning-tree domain.

This proves link redundancy, not gateway HA. Loss of sa-sw-01, sa-edge-01, or sa-fw-01 still removes the routed boundary.

Stop Conditions

Stop the gate if:

two gateways or two DHCP servers answer on one target VLAN;
an XG10 or target endpoint appears on 192.168.0.0/23;
VLAN 25 or 60 gains a gateway, NAT rule, or OPNsense route;
VLAN 65 or 999 becomes addressable at Site A;
Guest, IoT, or DMZ reaches management or storage;
a trunk carries an unapproved tag or uses Allow All;
the RSTP triangle loops, lacks an alternate path, or loses controller reachability;
a single-DAC pull causes persistent loss; or
WAN rollback requires readdressing the final LAN.

Gate Evidence Bundle

Retain the port/cable audit, source/destination test matrix, DHCP lease/options, DNS forward/reverse results, OPNsense state/log excerpts and export, UOS backup and RSTP state, WAN lease/NAT evidence, and the rollback result. Update the vault phase status only after the gate actually passes.

When a probe fails, continue with Packet-Flow Troubleshooting.