Domain 3 capstone — run the branch for a week

capstone · 150 min · Objective 3.3

Task

Take the network you implemented in the domain 2 capstone and put a complete operations practice around it: monitoring with a baseline, centralised logging, documentation, a change process, configuration backup, and a tested recovery plan. Then prove the practice works by recovering from a failure you cause.

The deliverable is an operations pack — six artefacts — plus evidence of one executed change and one executed recovery.

Steps

  1. Baseline. Measure latency, throughput, interface errors and utilisation across the lab and record them with the date and conditions. State what "normal" is in numbers.
  2. Monitoring. Configure SNMPv3 on the router and poll interface counters on a schedule from Host B. Set a threshold that would alert — for example, utilisation above 70% for five minutes — and write down what you would do when it fires.
  3. Logging. Centralise syslog from all hosts onto the collector, with NTP synchronising every clock so the timestamps can be compared. Prove correlation works by finding one event on two hosts.
  4. Documentation. Produce the physical diagram, logical diagram, IP plan and service inventory, each derived from commands rather than memory.
  5. Change. Write and execute a change request for a real modification — adding a VLAN, or moving a service — with a tested rollback. Update the documentation as part of closing it.
  6. Backup and recovery. Capture golden configurations for every device and store them somewhere that survives the device. Then destroy one: delete the router's addressing and routes entirely, and rebuild it from your backup alone. Time it.
  7. Report. State your measured RTO from step 6 against the RTO you would have promised in step 1. If they differ, say which one you would change.

Verify

ping -c 50 -q 192.168.20.10 | tail -2
sudo grep -hc . /var/log/syslog
ip -br addr show; ip route show
diff -u /tmp/golden-router.txt <(ip -br addr show; ip route show) ; echo "drift exit $?"
sudo vtysh -c "show ip route" 2>/dev/null | head -5 || ip route show

The recovery is the part that matters: after rebuilding from backup alone, the diff against the golden config must be empty. An empty diff is the only acceptable proof that a recovery restored the configuration rather than something that looked like it.

Notes

Three findings this capstone reliably produces, and all three are exam content.

The backup was incomplete. Almost everyone captures addresses and routes and forgets firewall rules, sysctl settings, or the service configuration files. You discover it during recovery, which is precisely why you rehearse.

The measured RTO is longer than the promised one. Rebuilding from a text file takes longer than people estimate, especially the parts that need a reboot. An untested RTO is a guess, and this is the exercise that converts it into a number.

The documentation was already wrong. Between the domain 2 capstone and this one you changed things. If step 4 matched your earlier diagrams exactly, check again — it usually does not, and the discrepancy list is the most honest artefact in the pack.

Keep the operations pack. The domain 4 capstone secures this network and the domain 5 capstone troubleshoots it, and both assume the documentation exists.