How to replace a core switch with a rollback path: configuration and validation checklist for enterprise cutovers
Core-switch replacement is more than copying configuration. Verify VLANs, trunks, gateways, STP, link aggregation, optics, routing, ACLs, DHCP relay and uplink relationships, then execute staged validation with a defined rollback plan.
Core-switch replacement is more than copying configuration. For this case, first verify VLAN, trunk and gateway inventory and STP root and protection settings, then use link aggregation and LACP to decide whether remediation is needed.
Why migrate now
For this network and security-boundary case, establish the failure boundary with VLAN, trunk and gateway inventory and STP root and protection settings, then continue to link aggregation and LACP. Capture the current state, incident time and one known-good comparison before changing production configuration.
Pre-migration dependency inventory
| Check | Why it matters | Recommended action |
|---|---|---|
| 01 · VLAN, trunk and gateway inventory | Verify VLAN, trunk and gateway inventory on the affected path using logs, counters or state information rather than relying only on the configured rule. | Record the current value, evidence source and timestamp for VLAN, trunk and gateway inventory. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 02 · STP root and protection settings | Verify STP root and protection settings on the affected path using logs, counters or state information rather than relying only on the configured rule. | Check STP root and protection settings read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 03 · link aggregation and LACP | Verify link aggregation and LACP on the affected path using logs, counters or state information rather than relying only on the configured rule. | Compare link aggregation and LACP with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
| 04 · static and dynamic routing | Review the current state, related logs and recent changes for static and dynamic routing, then align them with the incident timeline before deciding whether a change is required. | Record the current value, evidence source and timestamp for static and dynamic routing. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 05 · ACL, DHCP relay and management addresses | Review the current state, related logs and recent changes for ACL, DHCP relay and management addresses, then align them with the incident timeline before deciding whether a change is required. | Check ACL, DHCP relay and management addresses read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 06 · optics, link state and physical rollback | Review the current state, related logs and recent changes for optics, link state and physical rollback, then align them with the incident timeline before deciding whether a change is required. | Compare optics, link state and physical rollback with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
Recommended migration path
- Start with read-only evidence. Check VLAN, trunk and gateway inventory and STP root and protection settings before changing configuration.
- If the first checks are normal, continue with link aggregation and LACP and static and dynamic routing, keeping evidence tied to the incident time.
- Change configuration only when the evidence explains the symptom. For ACL, DHCP relay and management addresses, preserve the original value and define the rollback trigger before adjustment.
- Validate optics, link state and physical rollback in a controlled scope before expanding to production users or traffic.
Cutover window
- Validate the complete user or application workflow; do not stop at the single status of VLAN, trunk and gateway inventory.
- Recheck ACL, DHCP relay and management addresses and optics, link state and physical rollback after the change and confirm that no new bypass, permission expansion or secondary error has appeared.
- Archive evidence from VLAN, trunk and gateway inventory through optics, link state and physical rollback, together with before/after configuration, business validation and the rollback point.
Validation and rollback
- Changing VLAN, trunk and gateway inventory and STP root and protection settings at the same time, which makes the original cause impossible to prove.
- Treating a normal result for link aggregation and LACP as proof that static and dynamic routing and the rest of the business path are healthy.
- Leaving a temporary exception related to ACL/DHCP Relay/ or optics, link state and physical rollback in production without an owner, expiry time and rollback note.
Related questions
Where should I start with “How to replace a core switch with a rollback path: configuration and validation checklist for enterprise cutovers”?
Start with VLAN, trunk and gateway inventory and STP root and protection settings; they establish the first useful troubleshooting boundary without changing production state.
What should be checked after the first layer looks normal?
Continue with link aggregation and LACP and static and dynamic routing, then correlate the result with the incident time and the actual user or application path.
What should be retained after the change?
Keep evidence for ACL, DHCP relay and management addresses and optics, link state and physical rollback, plus the original configuration, validation result, observation notes and rollback point.
Need an assessment for your actual environment?
Share the current topology, device models, system versions, symptoms, impact, maintenance windows and available configuration/backup information. We can first assess risk, scope and rollback needs, then define remote, on-site or project work.