Switching cutover / May 8, 2026
Replaced the old switching path, restored the public-service VLAN, verified gigabit links, and documented the new core and access roles.
02 / Network operations / migration
Migrating a flat lab into role-based VLANs
I moved a flat homelab into 10 role-based VLANs, migrated more than 20 virtual workloads, and restored three-node Proxmox quorum after a switching cutover broke two node paths.
Starting point
Where it started
The lab had grown around one flat network. Management, storage, public services, guests, testing, and internal applications shared the same trust boundary, and replacing the switching fabric exposed how many services depended on the old path.
What I did
What I worked on
- Mapped network roles, service dependencies, migration order, validation checks, and rollback points before the cutover.
- Replaced the legacy switching path with a Cisco SG300 core and Netgear managed access switch, then audited tagged membership and physical links.
- Restored Proxmox quorum by tracing the affected node ports and correcting management-VLAN reachability across the trunks.
- Moved virtual workloads in phases and updated their DHCP reservations, DNS records, reverse-proxy targets, storage paths, and required firewall policy.
Evidence
What I checked and recorded
Cluster recovery / May 10, 2026
Used neighbor and port mapping to find two Proxmox trunks missing the management VLAN, corrected the allowed membership, confirmed three nodes and three votes, then saved the switch state.
Dependency validation
Checked workload addressing, DNS, proxy backends, storage reachability, required inter-VLAN paths, and the cluster state before retiring the old route.
Result
What changed
The lab now separates network roles, the three-node cluster is healthy, dependent services resolve through the correct paths, and the recovery order is documented for the next change.
What I learned
What I took from it
- A switch can be online while one required VLAN is still missing from the path.
- Service migrations fail at dependencies such as DNS, storage, and proxy targets more often than at the new address itself.
- Keep the previous management path until the replacement has been verified end to end.
Next case study / 03