5 Network Management

Purpose and network records

Network management is the disciplined operation and maintenance of network equipment, services, configurations, and records. Its aim is to keep services available and reliable while controlling security and operational risk. Core practices include maintaining accurate records, managing addresses, monitoring network health, approving and documenting changes, troubleshooting systematically, and preparing for recovery.

Inventory and documentation

A network inventory identifies the devices and services an organization depends on. At minimum, record each item’s name or identifier, type, location, owner, management address, software or firmware version, support status, and dependencies. Include routers, switches, firewalls, access points, servers, circuits, and essential services such as DNS and DHCP.

Keep diagrams, addressing plans, configuration baselines, and operating procedures with the inventory, and update them after approved changes. For example, a branch router entry might include its hostname, site, model, serial number, management IP, software version, uplink circuit, responsible team, and date last verified. These details help administrators identify affected systems during outages, maintenance, and security reviews.

Addressing and network services

An addressing plan divides networks into subnets sized for their purpose and expected growth. Document each subnet’s purpose, prefix, gateway, location, and allocation method, and avoid overlapping address ranges. RFC 1918 defines IPv4 address ranges reserved for private internets.

DHCP can automatically provide hosts with IP addresses and other configuration parameters. Document DHCP scopes, exclusions, reservations, lease settings, and relay paths so dynamically and statically addressed devices do not conflict. A small office might use 10.20.10.0/24 for staff devices and 10.20.20.0/24 for voice devices, with a separate DHCP scope for each. Its network records should identify each subnet’s gateway and the services that supply addressing and name resolution.

Monitoring and operational records

Monitoring provides visibility into availability, performance, capacity, and security-relevant events. Useful signals include device and link status, interface errors, latency, packet loss, bandwidth utilization, wireless health, service availability, configuration changes, and authentication or firewall events.

Set thresholds that reflect service requirements, route alerts to accountable responders, and review trends rather than treating every alert as an isolated incident. Centralized, time-synchronized logs help correlate events across devices. Protect access to monitoring systems and logs, retain records according to organizational requirements, and use secure transport where supported. Syslog is a standard format for event notifications, and its specification describes TLS-based transport support.

Operational documentation should capture what happened and when, the affected services and devices, observations and test results, actions taken, approvals, and the outcome. Clear records help another administrator continue the work and support later review.

Configuration and change control

Configuration management keeps the configuration baseline accurate and identifies deviations from it. Store configuration backups securely, restrict administrative access, and compare deployed settings with approved baselines where feasible.

A controlled change normally includes a description and business reason, affected systems, risk and security-impact analysis, approval, implementation plan, test and validation steps, communication plan, and rollback procedure. After implementation, record the actual result and update the baseline, inventory, diagrams, and procedures. Emergency changes may use an accelerated process, but should still be documented and reviewed afterward. Security-focused guidance emphasizes reviewing security impacts, approving and documenting changes, and monitoring whether systems continue to match their approved configurations.

Systematic troubleshooting

Troubleshooting gathers evidence, narrows the cause, applies a controlled fix, and confirms service restoration. A systematic approach helps limit unnecessary changes and their potential impact.

1. Define the symptom: Identify who or what is affected, what is unavailable or degraded, and when the problem began.

2. Check scope and dependencies: Determine whether the problem affects one device, one subnet, a site, or a shared service. Check power, cabling, links, DNS, DHCP, routing, and recent changes as relevant.

3. Test from basic to specific: Verify local interface status and IP configuration, then test gateway reachability, name resolution, remote reachability, and the target application or service. Use logs and monitoring data to compare the affected path with a working one.

4. Change one relevant thing at a time: Follow change procedures, preserve evidence, and avoid broad alterations that could increase impact.

5. Verify and document: Confirm recovery from the user or service perspective, monitor for recurrence, record the cause and resolution, and update documentation if needed.

If users cannot reach a website by name but can reach its IP address, test DNS resolution before changing routes or firewall rules. This helps isolate a likely name-resolution issue without presuming the entire network is down.

Security and recovery

Use individual administrator accounts, least privilege, strong authentication, and approved secure management paths. Limit management interfaces to authorized networks, disable unused services, keep network software current under change control, and review access and logs. Investigate unexpected configuration changes, unknown devices, unusual traffic, and repeated authentication failures under the organization’s security procedures.

Disaster recovery planning identifies critical network services and the order in which they must be restored. Plans should specify responsible personnel, dependencies, alternate equipment or locations, access to verified configuration backups, and communications and escalation procedures. Define a recovery time objective (RTO) for the targeted time to restore a service and a recovery point objective (RPO) for the maximum acceptable data or configuration loss measured in time.

Back up device configurations and essential network-service data regularly, protect copies from unauthorized change or loss, and test restoration rather than assuming backups will work. Contingency planning coordinates plans, procedures, and technical measures for restoring systems and operations after disruption.