Capstone Verification Checklist
Work top to bottom: a failure upstream makes everything below meaningless. Record the command and its output, not a tick. "It works" is a feeling; output is evidence.
Staged checks
| # | Stage · check | PASS criterion |
|---|---|---|
| 1.1 | Physical - link at both ends of every used port | Nothing that should be live is dark; speed/duplex as designed |
| 1.2 | Riser patched per schematic; powered devices | Link both ends; devices up, power budget fine |
| 2.1 | VLANs - show vlan brief on each switch | All five present with your names; every access port in its schematic VLAN (read port by port); none live in the default VLAN |
| 3.1 | Trunk - show interfaces trunk, both ends | Trunking; allowed list carries every VLAN crossing the riser |
| 3.2 | Native VLAN; AP uplinks | Native VLAN matches on both trunk ends and is not a user segment. AP uplinks: on real hardware each uplink is a trunk carrying its SSIDs' VLANs — record that as the production requirement. In the simulator each single-SSID AP object sits on an access port, so verify each AP's port is in the VLAN its SSID serves. |
| 4.1 | Routing - gateway ping per segment; routing table | Replies; one connected route per segment; permitted pairs reach each other |
| 5.1 | DHCP - release/renew in every DHCP segment | All four delivered fields match the design (see below) |
| 5.2 | Lease placement; statics | Inside scope, outside reservations; statics exact |
| 5.3 | Names - public + internal lookup per segment | Prompt answer from the specified server; a timeout fails |
| 6.1 | NAT - public host by address then name; translation table | Both succeed; entries share the one public address; the barred segment never appears |
| 7.1 | Wireless - SSIDs; coverage | Every SSID up, staff and guest; usable signal at reception and both meeting rooms |
| 7.2 | Test client per SSID | Right security, lands in the intended segment (judge by its address) |
On check 5.1. Read all four delivered values — address, subnet mask, default gateway, DNS server — and compare each, field by field, with your design. Receiving an address is not receiving a correct lease: three fields right out of four gives a client that looks connected and misbehaves later, in a way that looks unrelated.
The ping matrix
Fill the grid from your design first — what each cell should be — then test and write what it is. Rows are sources, columns destinations.
| From \ To | Design | Business | Servers | Guest | Cameras |
|---|---|---|---|---|---|
| Design | |||||
| Business | |||||
| Servers | |||||
| Guest | |||||
| Cameras |
| To internet | Design | Business | Servers | Guest | Cameras |
|---|---|---|---|---|---|
| by address / by name |
The pattern your design must produce
- Own gateway and own segment: pass everywhere.
- Design to Servers, Business to Servers: pass - shared resources are the point.
- Design to Business: whatever your design says - decide, write it, test that.
- Guest to any internal segment, all four, both directions: fail.
- Guest to internet, staff to internet: pass.
- Cameras to internet, internet to cameras: fail.
- Cameras to anything but their viewing point: fail, bar a named exception.
A pass where you expected a fail is a security finding: record, fix, retest, report. A fail where you expected a pass is a functional fault. Neither is left as "probably fine".
Evidence to capture
For every check: the command, its full text output, the device and time; text, not photographs of a screen. Name files by stage, check and device (s2-vlan-brief-SW1.txt) and caption each with the requirement it proves.
Minimum set: show vlan brief from both switches, trunk status, routing table, one lease per DHCP segment, one lookup per segment, translation table, wireless tests, the completed matrix.
Keep failures too: the output before a fix is half of a fault report and cannot be recreated later.
Network Essentials · Capstone · Turning Point Academy — backbone: Al-Doori, Network Essentials, Ch. 1-15.