Every one of these changes is something a network needs eventually — segmentation, re-addressing, a new core, IPv6, a vendor swap — and every one has to happen while people are using the network. This series is the order of operations that gets each done without an outage: additive first, reversible at every step, enforcement turned on last.
Designing a network from scratch is the easy case; the hard case is changing one that is already carrying work and cannot stop. Each post here is a cutover: the starting point, the three rules (additive, reversible, enforce-last), the ordered steps with a rollback for each, the gotchas that lock people out, and a maintenance-window checklist. The companion series, Broken by Design, is what happens when a change is done the wrong way.
They are filed under the surgery category on the blog.
Segmentation & Addressing
The two most common live changes: adding segmentation, and fixing an address plan you inherited.
01Flat to SegmentedAdd VLANs and a firewall to one big flat /24 without cutting anyone off: build alongside, migrate hosts a group at a time, permit-and-log to find dependencies, flip to default-deny last.8 min→ 02Re-addressing Without an OutageChange VLAN IDs or subnets live by running both schemes at once with a secondary address, migrating hosts on a short lease, and retiring the old scheme only when nothing answers on it.6 min→Moving the Gateways
The riskiest live changes move the default gateway — done per subnet, with the old gateway kept warm.
03Pushing Routing to the EdgeMigrate from layer-2 access to routed access — each switch routing to the core — shrinking the spanning-tree failure domain one subnet at a time, with the old gateway as backup during each cut.7 min→ 04Replacing the Core Without DowntimeSwap an end-of-life core by running the new one in parallel, pairing them with FHRP and routing, moving uplinks one at a time, flipping the virtual gateway, and retiring the old only when idle.7 min→Protocols & Vendors
Adding a protocol, crossing a major version, or swapping vendor — all without a big-bang weekend.
05Adding IPv6 Without Breaking IPv4Roll out IPv6 safely: build the v6 firewall before handing out a prefix (clients auto-enable v6 and your v4 rules do not apply), mirror every rule, keep ICMPv6, roll out per VLAN.7 min→ 06RouterOS 6 to 7 on a Live BoxCross the major version safely: the wireless-to-wifi rename that does not auto-convert, the new WireGuard and queues, out-of-band access, and a tested downgrade before you start.7 min→ 07Migrating Cisco to MikroTik, GraduallySwap vendors without a big-bang: run both in parallel peered over OSPF and a trunk, migrate gateways one VLAN at a time with VRRP (not HSRP), and cut the WAN last.7 min→Segmentation, re-addressing, a new core, IPv6, a vendor migration — I run these as live cutovers: additive, reversible at every step, enforcement proven before it is turned on, so the change lands without an outage anyone notices.
Book a Discovery Call →