Security, visibility, and traffic services
Validate the actual policy path
Security controls act at specific places and on specific fields. An ordered ACL can deny a flow before a later permit is reached. ACI contracts, VRF imports, first-hop protections, private-VLAN roles, and inserted services each have different purposes. Connectivity success alone does not establish least privilege, and route leaking does not automatically impose every required service restriction.
Authentication establishes identity, while authorization determines permitted operations. A read-only account can legitimately access inventory and be denied configuration changes. Check AAA reachability and returned role attributes separately; a ping to the authentication server does not prove the intended privileges. Out-of-band management reachability also does not demonstrate tenant forwarding or SAN health.
DHCP snooping and ARP inspection need meaningful trust boundaries and valid information for legitimate hosts. Marking arbitrary endpoint ports trusted can defeat the intended server-message restriction. Static-address hosts may need supported bindings or exceptions rather than an assumption that a DHCP-derived database covers every valid device. Verify the actual platform support and configured policy.
Interpret visibility with measurement limits
SPAN and ERSPAN provide observations, not an automatically perfect single-copy view of the wire. Source selection and direction can create multiple captured observations of a transit packet. ERSPAN also requires its encapsulated transport path and a suitable collector. Understand the measurement point before diagnosing duplicate forwarding or packet loss.
Correlating logs across devices requires coherent time and timestamp interpretation. A five-minute utilization average can hide a short queue microburst. Combine suitable counters, drop information, queue data, and higher-resolution observations rather than equate low mean utilization with no congestion. Protect credentials and session material in diagnostic exports; read-only tokens can still expose sensitive infrastructure state.
Match traffic treatment to requirements
Classification, marking, trust, queuing, policing, shaping, and scheduling are related but distinct. A policer can drop or remark excess traffic, while a shaper generally buffers to regulate transmission. Strict priority can reduce service to other classes under sustained load unless the design controls its demand. CoPP protects CPU-directed traffic and should fit legitimate control needs without assuming that physical line speed changes its limits.
Follow both forward and return paths through routing and stateful services. Policy-based redirection requires usable next hops and explicit failure behavior. A DHCP relay needs a valid server scope and return path. Test the intended service and approved failure cases while keeping policy changes as narrow as the evidence supports.