Task 08 — Post-Deployment Verification

DOCUMENT CATEGORY: Implementation Runbook — Task SCOPE: Azure Local cluster — all Phase 06 tasks PURPOSE: Confirm all Phase 06 post-deployment configuration tasks completed successfully before proceeding to operational foundations

Verify that all Phase 06 tasks completed successfully. This task must pass before the cluster is handed off for operational foundations work.

Prerequisites:

• Tasks 01–07 complete
• Administrative access to cluster and management server
• Azure credentials with Reader access to the cluster resource group

---

Variables from variables.yml

Path	Type	Description
compute.cluster_nodes[].management_ip	string	Node management IPs
compute.azure_local.cluster_name	string	Cluster name
azure_platform.resource_groups.cluster.name	string	Resource group
azure_platform.subscriptions.lab.id	string	Subscription ID
storage_accounts.storage_accounts.cluster_witness.*	object	Witness config
active_directory.security_groups.*	object	Security groups

---

Verification Checklist

Task	Check	Expected
01	WAC gateway service running	Running
01	WAC port 443 reachable	TcpTestSucceeded : True
02	Quorum type configured	CloudWitness or FileShareWitness
02	Quorum state	Normal
03	Admin AD group in Administrators on all nodes	Present
03	Operator AD group in Remote Management Users on all nodes	Present
04	sshd service running on all nodes	Running
04	Port 22 reachable on all nodes	TcpTestSucceeded : True
05	Storage pool health	Healthy
05	CSV volumes mounted and online	Count matches design
06	VM images in Azure	Provisioning state Succeeded
07	Logical networks in Azure	Provisioning state Succeeded

---

Verify Phase 06

Manual Checklist

When to use: Step-by-step verification from the portal or console. Use when confirming individual tasks after they complete or when CLI/PSRemoting access is unavailable.

---

Task 01 — Windows Admin Center

1. RDP or console into the WAC server (iic-wac01.azurelocal.cloud)
2. Run Get-Service ServerManagementGateway — expected: Status = Running
3. Browse to https://iic-wac01.azurelocal.cloud:443
4. Navigate to Settings → Extensions → Installed extensions
5. Confirm Dell EMC OpenManage Integration is listed

Task 02 — Cluster Quorum

1. In WAC, connect to cluster iic-clus01
2. Navigate to Settings → Witness
3. Confirm quorum type is set (CloudWitness or FileShareWitness) and state is Normal

Task 03 — Security Groups

On each cluster node, run:

Get-LocalGroupMember -Group "Administrators" | Where-Object ObjectClass -eq "Group"
Get-LocalGroupMember -Group "Remote Management Users" | Where-Object ObjectClass -eq "Group"

Each should return at least one AD group entry.

Task 04 — SSH Connectivity

From the management server:

Test-NetConnection -ComputerName iic-01-n01 -Port 22
Test-NetConnection -ComputerName iic-01-n02 -Port 22

Expected: TcpTestSucceeded : True for all nodes.

Task 05 — Storage

1. In WAC → iic-clus01 → Storage → Volumes — confirm all CSV volumes are Healthy and Online
2. In Azure Portal → Azure Local → iic-clus01 → Storage paths — confirm all show Succeeded

Task 06 — VM Images

In Azure Portal → Azure Local → iic-clus01 → VM images — confirm all required images show provisioning state Succeeded.

Task 07 — Logical Networks

In Azure Portal → Azure Local → iic-clus01 → Logical networks — confirm all required logical networks show provisioning state Succeeded and VLAN IDs match the site network plan.

Orchestrated

When to use: Config-driven, logged verification from the management server. Reads cluster node list and credentials from variables.yml. Produces a timestamped log in logs/task-08-post-deployment-verification/ for handoff documentation.

Script: Invoke-VerifyPostDeployment.ps1

scripts/deploy/04-cluster-deployment/phase-06-post-deployment/
 task-08-post-deployment-verification/powershell/Invoke-VerifyPostDeployment.ps1

Invoke-VerifyPostDeployment.ps1

#Requires -Version 5.1
<#
.SYNOPSIS
 Orchestrated: verifies all Phase 06 post-deployment tasks against variables.yml.

.DESCRIPTION
 Phase 06 — Post-Deployment | Task 08 — Post-Deployment Verification

 Runs read-only checks against the cluster to confirm all Phase 06 tasks completed
 successfully. Checks: Task 01 (WAC), 02 (quorum), 03 (security groups), 04 (SSH),
 05 (storage), 06 (VM images via az CLI), 07 (logical networks via az CLI).

 All checks are idempotent — nothing is created or modified.

.PARAMETER ConfigPath
 Path to infrastructure YAML. Defaults to config\variables.yml in CWD.

.PARAMETER Credential
 Credential for PSRemoting to cluster nodes. If omitted, resolved via Key Vault
 (Resolve-KeyVaultRef) then interactive Get-Credential prompt.

.PARAMETER TargetNode
 Limit node checks to specific node(s). Empty = all nodes in compute.cluster_nodes.

.PARAMETER WhatIf
 Log all planned checks without executing — validates config before a live run.

.PARAMETER LogPath
 Override log file path. Default: logs\task-08-post-deployment-verification\
 <YYYY-MM-DD_HHmmss>_VerifyPostDeployment.log (relative to CWD).

.PARAMETER WacServer
 FQDN or IP of the Windows Admin Center server. Override at the command line or set
 management.wac.server_fqdn in variables.yml. If empty, WAC checks are skipped.

.PARAMETER ClusterName
 Override cluster name. Defaults to compute.azure_local.cluster_name from YAML.

.EXAMPLE
 # Run from repo root with default config:
 .\scripts\deploy\04-cluster-deployment\phase-06-post-deployment\task-08-post-deployment-verification\powershell\Invoke-VerifyPostDeployment.ps1

.EXAMPLE
 # Dry-run (logs planned checks, no execution):
 .\...\Invoke-VerifyPostDeployment.ps1 -WhatIf

.EXAMPLE
 # Pass WAC server explicitly:
 .\...\Invoke-VerifyPostDeployment.ps1 -WacServer "iic-wac01.azurelocal.cloud"

.EXAMPLE
 # Limit to one node:
 .\...\Invoke-VerifyPostDeployment.ps1 -TargetNode iic-01-n01

.NOTES
 Requires: powershell-yaml module (Install-Module powershell-yaml -Scope CurrentUser)
 Requires: FailoverClusters module on management server
 Requires: az CLI authenticated (az login) for Tasks 06-07
 Read-only: no changes are made to cluster or Azure resources.
#>

[CmdletBinding(SupportsShouldProcess)]
param(
 [string] $ConfigPath = "",
 [PSCredential]$Credential,
 [string[]] $TargetNode = @(),
 [switch] $WhatIf,
 [string] $LogPath = "",

 # YAML-overridable
 [string] $WacServer = "", # management.wac.server_fqdn — leave empty to skip WAC check
 [string] $ClusterName = "" # compute.azure_local.cluster_name
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

#region LOGGING -----------------------------------------------------------------
$taskFolderName = "task-08-post-deployment-verification"
$timestamp = Get-Date -Format "yyyy-MM-dd_HHmmss"

if ([string]::IsNullOrEmpty($LogPath)) {
 $logDir = Join-Path (Get-Location).Path "logs\$taskFolderName"
 $LogPath = Join-Path $logDir "${timestamp}_VerifyPostDeployment.log"
}

$logDir = Split-Path $LogPath -Parent
if (-not (Test-Path $logDir)) { New-Item -ItemType Directory -Path $logDir -Force | Out-Null }

function Write-Log {
 param([string]$Message, [string]$Level = "INFO")
 $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
 $entry = "[{0}] [{1,-5}] {2}" -f $ts, $Level, $Message
 $entry | Out-File -FilePath $LogPath -Append -Encoding utf8
 $color = switch ($Level) {
 "FAIL" { "Red" }
 "WARN" { "Yellow" }
 "PASS" { "Green" }
 default { "Cyan" }
 }
 Write-Host $entry -ForegroundColor $color
}

Write-Log "======================================================="
Write-Log " Task 08 — Post-Deployment Verification (Orchestrated)"
Write-Log " Log: $LogPath"
if ($WhatIf) { Write-Log " [WhatIf] Dry-run mode — no checks will be executed" "WARN" }
Write-Log "======================================================="
#endregion

#region CONFIG LOADING ----------------------------------------------------------
if ([string]::IsNullOrEmpty($ConfigPath)) {
 $ConfigPath = Join-Path (Get-Location).Path "config\variables.yml"
}
if (-not (Test-Path $ConfigPath)) {
 Write-Log "Config not found: $ConfigPath" "FAIL"; throw "Config not found"
}

Write-Log "Loading config: $ConfigPath"
Import-Module powershell-yaml -ErrorAction Stop
$cfg = Get-Content $ConfigPath -Raw | ConvertFrom-Yaml

# Cluster name — YAML-overridable
if ([string]::IsNullOrEmpty($ClusterName)) {
 $ClusterName = $cfg.compute.azure_local.cluster_name # compute.azure_local.cluster_name
}
if ([string]::IsNullOrEmpty($ClusterName)) { throw "Cannot resolve cluster_name from config or -ClusterName" }

# WAC server — YAML-overridable, optional (empty = skip WAC check)
if ([string]::IsNullOrEmpty($WacServer) -and $cfg.management.wac.server_fqdn) {
 $WacServer = $cfg.management.wac.server_fqdn # management.wac.server_fqdn
}

# Cluster node hostnames
$allNodeNames = @()
if ($cfg.compute.cluster_nodes) {
 $allNodeNames = @($cfg.compute.cluster_nodes.GetEnumerator() | ForEach-Object { $_.Value.hostname }) # compute.cluster_nodes.<key>.hostname
}
$nodesToCheck = if ($TargetNode.Count -gt 0) { $TargetNode } elseif ($allNodeNames.Count -gt 0) { $allNodeNames } else { @() }

# Subscription / resource group for Azure CLI checks
$subscriptionId = $null
if ($cfg.azure_platform.subscriptions) {
 $subKey = ($cfg.azure_platform.subscriptions.GetEnumerator() | Select-Object -First 1).Key
 $subscriptionId = $cfg.azure_platform.subscriptions.$subKey.id # azure_platform.subscriptions.<key>.id
}
$resourceGroup = if ($cfg.azure_platform.resource_group_name) {
 $cfg.azure_platform.resource_group_name # azure_platform.resource_group_name
 } elseif ($cfg.compute.azure_local.arc_resource_group) {
 $cfg.compute.azure_local.arc_resource_group # compute.azure_local.arc_resource_group
 } else { $null }

# Expected counts for pass/fail comparison
$logicalNetworks = if ($cfg.networking.logical_networks) { $cfg.networking.logical_networks } else { @() } # networking.logical_networks[]
$marketplace = if ($cfg.marketplace_images.images) { $cfg.marketplace_images.images } else { @() } # marketplace_images.images[]

Write-Log "Cluster: $ClusterName"
Write-Log "WAC server: $(if ($WacServer) { $WacServer } else { '(skipped — not configured)' })"
Write-Log "Nodes: $($nodesToCheck -join ', ')"
Write-Log "Config: $ConfigPath"
#endregion

#region CREDENTIAL RESOLUTION ---------------------------------------------------
function Resolve-KeyVaultRef {
 param([string]$KvUri)
 if ($KvUri -notmatch '^keyvault://([^/]+)/(.+)$') { Write-Log " Not a Key Vault URI: $KvUri" "WARN"; return $null }
 $vaultName = $Matches[1]
 $secretName = $Matches[2]

 if (Get-Module -Name Az.KeyVault -ListAvailable -ErrorAction SilentlyContinue) {
 try {
 Write-Log " Retrieving '$secretName' from '$vaultName' (Az.KeyVault)..."
 $secret = Get-AzKeyVaultSecret -VaultName $vaultName -Name $secretName -AsPlainText -ErrorAction Stop
 if ($secret) { Write-Log " Secret retrieved." "PASS"; return $secret }
 Write-Log " Az.KeyVault returned no secret." "WARN"
 } catch { Write-Log " Az.KeyVault failed: $_" "WARN" }
 Write-Log " Falling back to Azure CLI..." "WARN"
 } else {
 Write-Log " Az.KeyVault module not found — trying Azure CLI..." "WARN"
 }

 try {
 $azCmd = Get-Command az -ErrorAction SilentlyContinue
 if (-not $azCmd) { Write-Log " Azure CLI (az) not found." "WARN"; return $null }
 Write-Log " Retrieving '$secretName' from '$vaultName' (az CLI)..."
 $tmpErr = [System.IO.Path]::GetTempFileName()
 $val = (& az keyvault secret show --vault-name $vaultName --name $secretName --query value --output tsv --only-show-errors 2>$tmpErr)
 $azErr = (Get-Content $tmpErr -Raw -ErrorAction SilentlyContinue).Trim()
 Remove-Item $tmpErr -ErrorAction SilentlyContinue
 if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($val)) {
 $errDetail = if ($azErr) { ": $azErr" } else { " (exit $LASTEXITCODE)" }
 Write-Log " az CLI failed$errDetail." "WARN"
 return $null
 }
 Write-Log " Secret retrieved (az CLI)." "PASS"
 return $val
 } catch { Write-Log " az CLI failed: $_" "WARN"; return $null }
}

if (-not $Credential) {
 $adminUser = $cfg.identity.accounts.account_local_admin_username # identity.accounts.account_local_admin_username
 $adminPassUri = $cfg.identity.accounts.account_local_admin_password # identity.accounts.account_local_admin_password
 Write-Log "Resolving credentials from Key Vault..."
 $adminPass = Resolve-KeyVaultRef -KvUri $adminPassUri
 if ($adminPass) {
 $Credential = New-Object PSCredential(
 $adminUser,
 (ConvertTo-SecureString $adminPass -AsPlainText -Force)
 )
 Write-Log "Credentials resolved for '$adminUser'." "PASS"
 } else {
 Write-Log "Key Vault unavailable — prompting for credentials." "WARN"
 $Credential = Get-Credential -Message "Enter local Administrator credentials for cluster nodes" -UserName $adminUser
 }
}

$credParam = if ($Credential) { @{ Credential = $Credential } } else { @{} }
#endregion

#region VERIFICATION ------------------------------------------------------------
$passCount = 0; $failCount = 0; $skipCount = 0

function Write-Check {
 param([bool]$Pass, [string]$Check, [string]$Detail = "")
 $level = if ($Pass) { "PASS" } else { "FAIL" }
 Write-Log " [$level] $Check$(if ($Detail) { " — $Detail" })" $level
 if ($Pass) { $script:passCount++ } else { $script:failCount++ }
}

function Write-Skip {
 param([string]$Check, [string]$Reason = "")
 Write-Log " [SKIP] $Check$(if ($Reason) { " — $Reason" })" "WARN"
 $script:skipCount++
}

# ── Task 01: Windows Admin Center ───────────────────────────────────────────
Write-Log ""; Write-Log "Task 01 — Windows Admin Center"
if ([string]::IsNullOrEmpty($WacServer)) {
 Write-Skip "WAC checks" "WacServer not configured — pass -WacServer or set management.wac.server_fqdn"
} elseif ($WhatIf) {
 Write-Log " [WhatIf] Would test WAC port 443 and gateway service on $WacServer" "WARN"
} else {
 $wacPort = Test-NetConnection -ComputerName $WacServer -Port 443 -WarningAction SilentlyContinue
 Write-Check -Pass $wacPort.TcpTestSucceeded -Check "WAC port 443 reachable" -Detail $WacServer
 try {
 $wacSvc = Invoke-Command -ComputerName $WacServer @credParam -ScriptBlock {
 Get-Service ServerManagementGateway -ErrorAction SilentlyContinue
 }
 Write-Check -Pass ($wacSvc.Status -eq "Running") -Check "WAC gateway service" -Detail $wacSvc.Status
 } catch { Write-Log " [FAIL] WAC gateway check failed: $_" "FAIL"; $failCount++ }
}

# ── Task 02: Cluster Quorum ──────────────────────────────────────────────────
Write-Log ""; Write-Log "Task 02 — Cluster Quorum"
if ($WhatIf) {
 Write-Log " [WhatIf] Would query cluster quorum on $ClusterName" "WARN"
} else {
 try {
 $quorum = Get-ClusterQuorum -Cluster $ClusterName -ErrorAction Stop
 $quorumState = (Get-Cluster -Name $ClusterName).QuorumState
 Write-Check -Pass ($null -ne $quorum.QuorumType) -Check "Quorum type configured" -Detail $quorum.QuorumType
 Write-Check -Pass ($quorumState -eq "Normal") -Check "Quorum state Normal" -Detail $quorumState
 } catch { Write-Log " [FAIL] Cluster quorum query failed: $_" "FAIL"; $failCount++ }
}

# ── Task 03: Security Groups ─────────────────────────────────────────────────
Write-Log ""; Write-Log "Task 03 — Security Groups"
foreach ($node in $nodesToCheck) {
 if ($WhatIf) { Write-Log " [WhatIf] Would check local group membership on $node" "WARN"; continue }
 try {
 $groups = Invoke-Command -ComputerName $node @credParam -ErrorAction Stop -ScriptBlock {
 @{
 AdminGroups = (Get-LocalGroupMember -Group "Administrators" | Where-Object ObjectClass -eq "Group").Count
 RmGroups = (Get-LocalGroupMember -Group "Remote Management Users" | Where-Object ObjectClass -eq "Group").Count
 }
 }
 Write-Check -Pass ($groups.AdminGroups -gt 0) -Check "$node — Administrators AD group(s)" -Detail "$($groups.AdminGroups)"
 Write-Check -Pass ($groups.RmGroups -gt 0) -Check "$node — Remote Management Users AD group(s)" -Detail "$($groups.RmGroups)"
 } catch { Write-Log " [FAIL] $node — group check failed: $_" "FAIL"; $failCount++ }
}

# ── Task 04: SSH Connectivity ────────────────────────────────────────────────
Write-Log ""; Write-Log "Task 04 — SSH Connectivity"
foreach ($node in $nodesToCheck) {
 if ($WhatIf) { Write-Log " [WhatIf] Would check sshd service and port 22 on $node" "WARN"; continue }
 try {
 $sshSvc = Invoke-Command -ComputerName $node @credParam -ErrorAction Stop -ScriptBlock {
 Get-Service sshd -ErrorAction SilentlyContinue
 }
 Write-Check -Pass ($sshSvc.Status -eq "Running") -Check "$node — sshd service" -Detail $sshSvc.Status
 } catch { Write-Log " [FAIL] $node — sshd check failed: $_" "FAIL"; $failCount++ }
 $sshPort = Test-NetConnection -ComputerName $node -Port 22 -WarningAction SilentlyContinue
 Write-Check -Pass $sshPort.TcpTestSucceeded -Check "$node — port 22 reachable"
}

# ── Task 05: Storage ─────────────────────────────────────────────────────────
Write-Log ""; Write-Log "Task 05 — Storage"
if ($WhatIf) {
 Write-Log " [WhatIf] Would query storage pool and CSV volumes on $ClusterName" "WARN"
} else {
 try {
 $pool = Get-StoragePool -CimSession $ClusterName | Where-Object IsPrimordial -eq $false
 if ($pool) {
 Write-Check -Pass ($pool.HealthStatus -eq "Healthy") -Check "Storage pool health" -Detail $pool.HealthStatus
 } else {
 Write-Log " [FAIL] No storage pool found on $ClusterName" "FAIL"; $failCount++
 }
 $csvVolumes = Get-ClusterSharedVolume -Cluster $ClusterName
 Write-Check -Pass ($csvVolumes.Count -gt 0) -Check "CSV volumes mounted" -Detail "$($csvVolumes.Count) volume(s)"
 foreach ($csv in $csvVolumes) {
 Write-Check -Pass ($csv.State -eq "Online") -Check " $($csv.Name)" -Detail $csv.State
 }
 } catch { Write-Log " [FAIL] Storage check failed: $_" "FAIL"; $failCount++ }
}

# ── Task 06: VM Images (Azure) ───────────────────────────────────────────────
Write-Log ""; Write-Log "Task 06 — VM Images (Azure)"
if (-not $subscriptionId -or -not $resourceGroup) {
 Write-Skip "VM images" "Cannot resolve subscription/resource group — verify manually in Azure Portal"
} elseif ($WhatIf) {
 Write-Log " [WhatIf] Would run: az stack-hci-vm image list --resource-group $resourceGroup" "WARN"
} else {
 $imagesJson = az stack-hci-vm image list --subscription $subscriptionId --resource-group $resourceGroup --output json 2>$null
 if ($LASTEXITCODE -eq 0 -and $imagesJson) {
 $images = $imagesJson | ConvertFrom-Json
 $succeeded = @($images | Where-Object { $_.provisioningState -eq "Succeeded" })
 Write-Check -Pass ($images.Count -gt 0) -Check "VM images in $resourceGroup" -Detail "$($images.Count) found"
 if ($marketplace.Count -gt 0) {
 Write-Check -Pass ($succeeded.Count -ge $marketplace.Count) -Check "All expected images Succeeded" -Detail "$($succeeded.Count)/$($marketplace.Count)"
 }
 } else { Write-Log " [FAIL] Could not query VM images — check az CLI auth" "FAIL"; $failCount++ }
}

# ── Task 07: Logical Networks (Azure) ────────────────────────────────────────
Write-Log ""; Write-Log "Task 07 — Logical Networks (Azure)"
if (-not $subscriptionId -or -not $resourceGroup) {
 Write-Skip "Logical networks" "Cannot resolve subscription/resource group — verify manually in Azure Portal"
} elseif ($WhatIf) {
 Write-Log " [WhatIf] Would run: az stack-hci-vm network lnet list --resource-group $resourceGroup" "WARN"
} else {
 $lnetsJson = az stack-hci-vm network lnet list --subscription $subscriptionId --resource-group $resourceGroup --output json 2>$null
 if ($LASTEXITCODE -eq 0 -and $lnetsJson) {
 $lnets = $lnetsJson | ConvertFrom-Json
 $succeeded = @($lnets | Where-Object { $_.provisioningState -eq "Succeeded" })
 Write-Check -Pass ($lnets.Count -gt 0) -Check "Logical networks in $resourceGroup" -Detail "$($lnets.Count) found"
 if ($logicalNetworks.Count -gt 0) {
 Write-Check -Pass ($succeeded.Count -ge $logicalNetworks.Count) -Check "All expected networks Succeeded" -Detail "$($succeeded.Count)/$($logicalNetworks.Count)"
 }
 } else { Write-Log " [FAIL] Could not query logical networks — check az CLI auth" "FAIL"; $failCount++ }
}
#endregion

#region SUMMARY -----------------------------------------------------------------
Write-Log ""
Write-Log "======================================================="
Write-Log " Summary"
Write-Log " Passed : $passCount"
Write-Log " Failed : $failCount"
Write-Log " Skipped : $skipCount"
Write-Log " Log: $LogPath"
Write-Log "======================================================="

if ($WhatIf) { Write-Log "Dry-run complete. Re-run without -WhatIf to execute checks." "WARN" }
if ($failCount -gt 0) { throw "$failCount check(s) failed. Review log: $LogPath" }
#endregion

Standalone

When to use: Copy-paste ready with no external dependencies — no toolkit clone or variables.yml required. Edit the #region CONFIGURATION block and run from any workstation with PSRemoting access to cluster nodes.

Script: Test-PostDeployment-Standalone.ps1

scripts/deploy/04-cluster-deployment/phase-06-post-deployment/
 task-08-post-deployment-verification/powershell/Test-PostDeployment-Standalone.ps1

Test-PostDeployment-Standalone.ps1 — CONFIGURATION region

#region CONFIGURATION -----------------------------------------------------------

# ─── Cluster ────────────────────────────────────────────────────────────────────
$cluster_name = "iic-clus01" # Azure Local cluster name

# ─── Nodes ──────────────────────────────────────────────────────────────────────
$node_names = @(
 "iic-01-n01",
 "iic-01-n02"
)

# ─── Windows Admin Center ───────────────────────────────────────────────────────
# Leave empty "" to skip WAC checks
$wac_server = "iic-wac01.azurelocal.cloud" # FQDN or IP of WAC server (or "" to skip)

#endregion CONFIGURATION --------------------------------------------------------

---

Phase 06 Completion Criteria

All of the following must be true before proceeding to Phase 17:

• WAC accessible and gateway service (ServerManagementGateway) running
• Cluster quorum configured and state is Normal
• Security groups applied to all cluster nodes (Administrators + Remote Management Users)
• SSH running on all cluster nodes, port 22 reachable
• Storage pool healthy, CSV volumes mounted and online
• Storage paths registered in Azure with provisioning state Succeeded
• VM images staged with provisioning state Succeeded
• Logical networks created for all workload VLANs, provisioning state Succeeded
• VLAN IDs validated against site network plan
• Verification script executed with zero failures

---

Troubleshooting

Issue	Cause	Resolution
Verification script reports failures on storage paths	Storage path registration incomplete or ARB sync pending	Re-run storage path registration; wait 10 minutes for sync; verify: az stack-hci-vm storagepath list
VLAN validation fails against network plan	Logical network VLAN IDs don't match site design	Compare az stack-hci-vm network lnet list output against site network plan; recreate mismatched logical networks
Multiple verification items fail simultaneously	Cluster health issue affecting dependent services	Start with Get-ClusterNode and Get-ClusterGroup to assess overall cluster health before addressing individual failures

---

Navigation

← Previous	Task 07 — Logical Network Creation
↑ Phase Index	Phase 06 — Post-Deployment Index
→ Next	Part 5 — Operational Foundations