Firewall Pre-Deployment Field Checklist

Assigned to Caleb. Follow each step in order. This is a discovery-only visit: observe, identify, photograph, test, install TGOS Scout, document, and submit. Do not reconfigure network equipment unless specifically authorized.

Assigned to Caleb. Follow each step in order. Discovery-only visit: observe, identify, photograph, test, install TGOS Scout, document, and submit. Do not reconfigure network equipment.

Assigned Field Tech

Confirm the technician completing this checklist.

Customer / Project

Branch Name

Enter the exact branch/location name before beginning.

Branch Address

Onsite Contact

Onsite Contact Phone

Arrival Date / Time

Date

Time

Departure Date / Time

Date

Time

Step 1 — Was the network operating normally on arrival?

Yes
No — existing issue documented below

HOW TO: Ask whether internet, printing, scanning, phones, and business systems are working. Open a web page, print a test page, test a normal scan if used, and make one phone call if VoIP is used. Do not change anything.

Step 1 — Existing problems found before assessment

Document anything already broken before you begin. If none, enter None.

Step 2 — TGOS Scout Computer Name

HOW TO: Log in to TGOS, open Karschner Insurance, select the correct branch, download that branch's Scout installer, run as Administrator, complete enrollment, and wait until TGOS shows the endpoint Online / Reporting. Leave Scout installed.

Step 2 — Scout PC IP Address

Step 2 — Scout is online and reporting

Yes
No — support required

If NO: confirm internet works, verify the TGOS Scout service is running, refresh TGOS, and wait several minutes.

Step 3 — Network Overview Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 10 files.

HOW TO: Take wide photos of the entire network area first: front view, angled view, and open rack/cabinet if present. On a phone, tap the upload control and choose Camera / Take Photo when offered.

Step 4 — ISP Name

HOW TO: Follow the incoming coax/fiber/Ethernet service line to the modem, ONT, or ISP gateway. Record the provider if known.

Step 4 — ISP Device Make / Model

Step 4 — WAN Service Type

DHCP / Dynamic
Static IP
PPPoE / Authentication
Unknown — Engineering Review Required

Step 4 — WAN / ISP Notes

Record static IP details only in the approved secure location. Do NOT put passwords, Wi-Fi keys, API keys, or other credentials in this form.

Step 4 — ISP Device Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 6 files.

Take front, rear/cabling, and readable make/model label photos. Avoid photographing passwords or Wi-Fi keys.

Step 5 — Existing Router / Firewall Make / Model

HOW TO: Follow the Ethernet cable leaving the ISP device and identify the next routing device. If the ISP gateway is the router, enter ISP Gateway is Current Router.

Step 5 — Existing Router / Firewall Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 6 files.

Take front, rear, make/model label, WAN connection, and LAN connection photos. Do not unplug cables.

Step 6 — Current Default Gateway

HOW TO on Windows: Open Command Prompt, run ipconfig, locate the active adapter, and record Default Gateway. Do not change any settings.

Step 7 — Current PC IPv4 Address

From ipconfig, record the active adapter's IPv4 address.

Step 7 — Current Subnet Mask

Step 7 — Current DNS Servers

Use ipconfig /all if needed.

Step 8 — DHCP Server

HOW TO: Run ipconfig /all and record DHCP Server for the active adapter. If DHCP is disabled, state that.

Step 9 — Switch Inventory

HOW TO: Starting at the LAN cable leaving the router/firewall, physically follow it. For EVERY switch, enter temporary ID, manufacturer/model, port count, approximate ports used, uplink port, and where the uplink goes. Do not unplug cables merely to identify them.

Step 9 — Switch Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 20 files.

Photograph every switch: full front, connected ports, rear if accessible, readable model label, and uplink.

Step 10 — Switch Management / VLAN Capability

Never guess VLAN capability. Enter exact switch models so engineering can verify 802.1Q, trunk/access, PoE, and management support.

Step 11 — Wireless Access Points

HOW TO: Walk the office and locate ceiling/wall APs, mesh units, consumer routers used as APs, and ISP Wi-Fi. Record make/model, approximate location, and Ethernet connection if visible. Do not reset or reconfigure anything.

Step 11 — Wireless AP Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 12 files.

Step 12 — Printer / MFP Inventory

For every network printer/MFP record make/model, IP if known, static/DHCP if known, and whether staff uses printing, scan-to-folder, and scan-to-email.

Step 12 — Printer / MFP Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 15 files.

Step 13 — Scan-to-Folder / Scan-to-Email Test

HOW TO: Ask the employee who normally scans to perform a normal scan. Record which MFP, destination selected, whether it arrived, and which PC/server/share received it. Do not collect passwords.

Step 14 — Phone / VoIP Equipment

Record phone provider if known, representative phone make/model, approximate quantity, PBX/ATA/gateway equipment, and whether Ethernet passes through the phone to the PC.

Step 14 — Phone / VoIP Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 10 files.

Step 15 — Specialty / IoT Devices

HOW TO: Ask what else is connected to the network. Check for postage meters, fax bridges, smart TVs, cameras/NVR, access control, alarms, NAS, servers, time clocks, UPS management, wireless bridges, and specialty insurance equipment. Record make/model, connection, and business purpose.

Step 15 — Specialty / IoT Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 20 files.

Step 16 — Known Static-IP Devices

Check likely devices such as printers, servers, NAS, cameras/NVR, phone controllers, and network infrastructure. If a device explicitly shows Manual / Static / DHCP Off, record it. Otherwise state Addressing Method Not Confirmed.

Step 17 — Patch Panel / Cabling Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 15 files.

Take full patch-panel photos, close-ups of labels, router-to-switch and switch-to-switch uplinks, and anything unusual. Flag daisy-chained consumer switches, damaged/unlabeled cabling, loose equipment, or insufficient outlets.

Step 18 — UPS / Power Protection

HOW TO: Identify whether ISP equipment, router/firewall, main switch, and server/NAS are UPS-protected. Record make/model. Do not unplug anything.

Step 18 — UPS Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 6 files.

Step 19 — Branch-to-Branch Resource Requirements

Ask: Do you access anything located at another Karschner office? Record shared files, servers, accounting apps, printers, remote desktop, cameras, or phone systems. Record answers without interpreting them.

Step 20 — Remote Access Requirements

Ask: Does anyone connect to this office remotely? Record VPN, Remote Desktop, LogMeIn, TeamViewer, ScreenConnect, vendor support, camera access, or other services. Do not collect credentials.

Step 21 — Scout evidence is arriving

Yes — gateway / DHCP / DNS / discovery evidence is appearing
No — Support Required

Before leaving, verify Scout is reporting and network discovery evidence is beginning to populate.

Step 22 — Final Operational Check

Internet works
Printing works
Scanning works or was not used at this branch
Phones work or were not present
Critical business applications operate as they did on arrival

Repeat the same basic tests performed on arrival. If anything stopped working, do not leave until the cause is established.

Step 24 — Did you make any network configuration changes?

No
Yes — explain below

Normal answer is NO. This is a discovery-only visit.

Step 24 — If YES, explain every change made

Step 25 — Technician Completion Certification

I observed, identified, photographed, tested, installed Scout, documented, and submitted evidence only.
I did not redesign VLANs/subnets, change DHCP, reset equipment, reconfigure switches/Wi-Fi, or move critical cabling unless specifically authorized.
The branch is ready for TGOS / Engineering Review, not automatically ready for firewall installation.

Engineering Review / Red Blockers

Flag unmanaged switches, unknown ISP configuration, overlapping subnets, undocumented routers, unsupported Wi-Fi, business-critical devices with unclear network requirements, or other deployment blockers.

Number of Employees at This Branch

HOW TO: Ask the onsite contact for the approximate number of employees normally working from this branch. This helps engineering size the network and expected endpoint count.

Business-Critical Systems and Processes

HOW TO: Ask what must continue working after the firewall cutover. Include insurance applications, shared files, servers, printing/scanning, phones, remote access, cloud services, and other critical workflows. Do not collect credentials.

Maximum Acceptable Downtime During Firewall Cutover

HOW TO: Ask the onsite contact how long this branch can reasonably be without internet/network services during the eventual firewall cutover. This is planning information only.

Measured Internet Download Speed

HOW TO: If practical, run one normal speed test from a wired business PC while the network is operating normally. Record the approximate Mbps result. Do not disrupt users.

Measured Internet Upload Speed

Record the approximate Mbps upload result from the same test.

Guest Wi-Fi Present

Yes
No
Unknown

HOW TO: Ask whether visitors use a separate wireless network and confirm by observing available SSIDs/settings only when authorized. Do not request the Wi-Fi password.

Existing VLANs / Network Segmentation Present

Yes — verified
No / flat network — verified
Unknown — Engineering Review Required

HOW TO: Record only what can be verified from current equipment/settings or reliable documentation. Do not guess and do not change VLAN settings.

Existing VLANs / Segments and Purpose

If segmentation exists, record known VLAN IDs, subnets, names/purposes, and which equipment uses them. If unknown, state what could not be verified.

Known Port Forwarding Present

Yes — verified or client reported
No — verified
Unknown — Engineering Review Required

HOW TO: Ask whether cameras, servers, remote desktop, vendor systems, or other services are reachable from the internet. Review existing router/firewall settings only when authorized. Do not create or change rules.

Known Port Forwards / Internet-Exposed Services

Record service/device, internal destination, and external port only when verified or client reported. Do not enter passwords or authentication secrets.

Servers / NAS / Local Storage

HOW TO: Identify any server, NAS, shared-storage appliance, or workstation acting as a file server. Record make/model, hostname if known, IP if known, physical location, and business purpose.

Servers / NAS Photos

Drag & Drop Files, Choose Files to Upload You can upload up to 10 files.

Take overview and readable make/model photos where practical. Do not photograph credentials.

Cameras / NVR / Physical Security Systems

HOW TO: Identify cameras, NVR/DVR, access control, alarms, and related network devices. Record make/model, approximate count, connection, and whether remote viewing is used.

Backup / Disaster Recovery Dependencies

HOW TO: Ask whether any local server/NAS/workstation is backed up and whether backups depend on internet, another branch, or a cloud service. We only need dependencies that could affect firewall deployment; do not collect backup credentials.

Cloud / Hosted Services Used by This Branch

HOW TO: Record major services employees rely on, such as Google Workspace/Gmail, Microsoft 365, hosted insurance applications, cloud storage, VoIP, remote support, or vendor portals. Do not collect usernames/passwords.

Assessment Scope / Systems Not Assessed

HOW TO: Record anything you could not inspect or verify, inaccessible rooms/equipment, devices powered off, absent employees, or other limitations. Never imply an unverified system was assessed.

Authorized Access Confirmed

Yes — client authorized this pre-deployment assessment
No — stop and contact Tek Guy On Demand

Confirm the client has authorized Tek Guy On Demand to review the systems and settings included in this pre-deployment visit. If NO, stop.

Save and Resume Later