An installation is finished when somebody else can take it over. That is a higher bar than "the network works", and it is the only bar that matters on the day you are not there. The configurator produces most of the material for it; all you do is keep it in one place.
What belongs in the customer folder
- The script per device, with the device name as the file name. In a site you can also download everything in one file, each script behind a header naming the device it belongs to.
- The rollback script next to each script. You want the way back before you need it.
- The site file, the
.jsonyou keep with "save site as file". This is the most important file in the folder: with it the next person opens your whole configuration in the tool again, changes something and generates new scripts, instead of reasoning backwards from a script to work out what was meant. - The printed handover sheet, for whoever is not going to open the tool.
- The things the tool cannot know: the account number at the provider, the subscription, the contact person, the serial numbers and where the equipment hangs.
The site file contains passwords and keys in plain text. Keep it with the customer records, not in a shared folder the whole office can open.
The handover sheet
Next to the scripts sits the handover sheet button: print it or save it as a PDF. It is built from the same data the script is generated from, so the two cannot disagree. Per device it carries:
- Device: name, model, role, site, time zone and update channel, with blank lines for the serial number and the location to fill in by hand.
- Management: the management address, the management VLAN, an emergency port if there is one, the admin user, and which services are reachable from which addresses.
- Internet, the LAN with its fixed leases, the VLAN table with subnet, router address, DHCP, internet and isolation, and, when you use it, who may reach which network.
- The port table: per port what is on it, which VLAN, and your own comment.
- Wi-Fi with the SSIDs, VPN, the firewall with its port forwards, and the note you set on the system.
At the bottom are lines for "installed by", the date and a customer signature. In a site a cover sheet comes first: the site with its name and time zone, every device with its role and management address, the cabling from which port to which port, and the site's VLANs and SSIDs. That cover sheet is often the only page anybody still reads a year later.
Passwords
By default no passwords appear on the handover sheet. There is a "print passwords" tick box for a sheet that goes into a safe; switch it on and the footer of the sheet says it holds passwords. The rest of the time, leave it off, because a printed sheet ends up on a desk or in a photo.
Passwords belong in a password manager, the customer's or your own, with one entry per device or per site. The configurator is not that place: it runs entirely in your browser and sends nothing to a server, but what the browser stores sits on that one computer and disappears with the browsing data. The password button in the tool generates one of sixteen characters; anything under twelve raises a warning. If you used something temporary during the installation, change it before the handover rather than after it.
The rollback script
Next to every script you can download a rollback script. It removes every object the first script creates, found by the name or comment that script gave it, in reverse order. What keeps your session alive goes last: addresses, the bridge, interface lists and the DHCP client. That way you stay connected as long as possible.
Be honest about what it does not do. Lines that change an existing setting cannot be put back: the old value is on the device, not in the script. Those are listed at the end of the file as comments, with the menu and the target only, so a password never lands in the rollback file. The same goes for scripted lines that only decide what they touch while they run. The exact way back is therefore the backup you take before pasting; the header of the file says so too, with /system backup load name=before-configurator next to it. Run the script from Safe Mode, and preferably over MAC-WinBox or a console.
What the next person needs
Hand somebody the site file, the handover sheet and the naming convention and they can carry on. Worth adding as a habit: which ports are trunks, where the emergency port is, and a line in the system note field about who manages this and how changes are requested. That note shows at login and on the sheet. When something has to change later, adjust it in the tool and compare the new script against an export from the running device, so you only paste the difference. See using the script and saving and sharing, and choosing names for the conventions that keep this readable.