Network documentation fails because it is written once, as a project deliverable, and then diverges from reality within a quarter. This template is scoped to the things that change slowly and are expensive to rediscover at 02:00.
Document what is expensive to rediscover. Skip anything a tool can tell you in thirty seconds. Document the things that take an hour on the phone to a vendor: circuit IDs, support contract numbers, why that odd static route exists, which port the firewall HA heartbeat uses.
Record the why and the what. An undocumented firewall rule gets removed during a cleanup and breaks something nobody can diagnose. One sentence of justification per non-obvious configuration saves the outage.
Keep a change log in the same document. A dated line per change turns the document into a history. When something breaks, the first useful question is what changed, and the answer should not require a ticket search.
Here's a preview. Unlock the free download to get all 5 sections (4 more below).
One row per managed device. Management address and credentials location are the fields used under pressure.
| Hostname | Role | Make / model | Serial | Site / rack | Management IP | Firmware | Support expires | Credentials in |
|---|---|---|---|---|---|---|---|---|
| fw-lon-01 | Firewall (HA primary) | FortiGate 100F | FG100F0001 | LON / rack B12 | 10.10.0.1 | 7.4.3 | 2027-03-14 | Vault: net/fw-lon |
| sw-lon-core | Core switch | Catalyst 9300 | FOC2512X1AB | LON / rack B11 | 10.10.0.2 | 17.9.4 | 2027-01-30 | Vault: net/sw-core |
More free templates IT teams use alongside this one.
IP conflicts are almost always an administrative failure rather than a technical one: two people assigned the same address because neither had a single place to look. This sheet is that place.
Firewall rule bases grow and never shrink, because adding a rule solves a problem today and removing one might cause an outage tomorrow. This log makes removal safe by requiring evidence of use before a rule is retired.
Network hardware fails quietly into unsupportability: firmware stops receiving security updates, support contracts lapse, and the vendor announced end-of-life two years ago. This inventory surfaces those dates before they become an incident.
A device register with management addresses and support expiry, circuit and ISP details with support numbers and circuit IDs, VLAN and subnet allocations with their purpose, and a dated change log. Prioritise what is slow to rediscover from a vendor rather than what a scan can tell you.
At the point of change, as a step in your change process, rather than on a review schedule. Documentation updated only during periodic reviews is wrong for most of the period, which is precisely when an incident will use it.
No. Record where the credentials live (the vault path or the privileged access system) rather than the credentials themselves. The document is usually more widely shared than its authors assume.
