How to audit a VLAN scheme you inherited

Documentation drifts from reality, and the drift is where the faults live. Writing it down is most of the work.

Inheriting a network means inheriting decisions nobody wrote down. The productive first step is not to redesign it but to record what is actually there and see what the record reveals.

What to collect

For each VLAN: its ID, its name, its subnet, the gateway address, and the DHCP range if it has one. That is enough to find most structural problems.

Get it from the running configuration rather than from the existing documentation. The two disagreeing is exactly the thing you are looking for.

What the audit finds

Overlapping subnets — usually the result of two people extending the scheme at different times without a shared record.

DHCP pools covering the gateway, which have not caused an outage yet only because the pool has not filled up.

Gateways outside their subnet, generally a typo that has been copied forward.

Subnets nearly full, which is a scheduled outage rather than a current one.

User traffic on VLAN 1, and VLANs in the 1002–1005 range that many switches refuse to create.

What to do with the findings

Fix the ones that are cheap and safe: a DHCP pool shortened to clear the gateway, a subnet given headroom before it fills. Those are configuration changes with an obvious blast radius.

Overlapping subnets usually mean renumbering, which is disruptive and needs planning. Record it, understand the risk, and schedule it — but do not renumber a live segment because a tool turned something red.

Frequently asked questions

Where should I get the data from?

The running configuration on the switches, not the existing documentation. Where the two disagree is precisely what the audit is for.

What should I fix first?

The cheap, contained changes: DHCP pools that cover a gateway, and subnets close to full. Both are outages waiting for a busy day.

Should I renumber overlapping subnets immediately?

No. Record it, understand what depends on the addressing, and schedule it. Renumbering a live segment is disruptive and should never be a reaction to a red flag.