How do you order the change windows to move a zone's enforcement onto the real traffic path, when an intruder keeps the unfiltered path until the last one?

## The shape of the problem You have established that a documented boundary is not on the path: an overlay stretch, a newer fabric path or an interconnect built to make two merged estates talk carries the traffic around it. Nothing about that is fixed by a decision. It is fixed by a sequence of maintenance nights, each of which must leave the estate working, and one of which will be the night an undocumented flow meets a policy for the first time. You are the change owner on that call. ## Stage 1 - discovery, and why the window length matters more than the tooling The permit set cannot be copied from the old rule base, because the old rule base only ever saw the flows that transited it - and by hypothesis the interesting flows did not. So the permit set is built from observation on the path that really carries the traffic. The single most common failure is a discovery window that is too short. Estates run on cycles: month-end batch, quarter-end reporting, an annual reconciliation, a disaster-recovery test that only replicates once a quarter. A two-week observation window plus a cut on the wrong weekend produces a finance outage with your name on the change record. Where you cannot observe a full cycle, you compensate: ask the application owners, and stage the cut so the first pairs to move are the ones with no batch behaviour. Record what you can and cannot see while doing it. Flow records tell you that a pair talked and on what ports; they do not tell you which business process depended on it. That mapping comes from owners, and getting it is a large part of the calendar cost. ## Stage 2 - shadow, and the honesty it demands Before blocking, run the intended policy in a posture where it logs what it would deny and denies nothing. Reconcile every would-be deny into one of three buckets: expected and permitted (add the rule), dead and to be removed (confirm with the owner), or unknown (an exception with an expiry date and a name against it, never an open-ended one). Say the uncomfortable part out loud in an interview: a shadow period is a window in which you know the gap exists and are deliberately not closing it. That is a defensible decision only if it is time-boxed, has an owner, and is recorded as an accepted risk with an end date. It is not defensible as an indefinite state, and a shadow policy that has been logging for eighteen months is a failure dressed as caution. ## Stage 3 - cut, in the smallest reversible steps Three rules do most of the work: 1. **Separate the routing change from the policy change.** Moving the path and turning on enforcement on the same night means that when something breaks you cannot tell which caused it, and your rollback has to undo both under time pressure. Move the path first, confirm the traffic now transits the enforcement point with the policy still permissive, then enforce on a later night. 2. **Order by blast radius, smallest first.** Start with a zone pair or a direction whose flow set is small, well-owned and easy to roll back. Each success buys credibility for the next window; a first-night outage on the payments path can stall the whole programme for a quarter. 3. **Make the rollback trivial.** The abort action must be one reversible step - withdraw the policy, restore the route - decided by a stated abort time, not by a debugging session at 03:00. What you watch on the night matters too. The device's deny counters are necessary but not sufficient: watch the application's own error rate and the owners' checks, because the flows that break most painfully are the ones whose failure looks like slowness rather than a refusal. ## Stage 4 - cleanup, and why it is not optional Until the bypass path is removed or re-scoped, the enforcement point is one route away from being irrelevant again. Cleanup is its own change, with its own window, and it is the step most likely to be dropped when the programme runs out of budget. A programme that stops after stage 3 has bought monitoring, not containment. ## What the intruder experiences through all of this Nothing, until the pair they would use is actually cut over. That is the honest framing for a status update: percentage of zone pairs enforced, not percentage of the project plan complete. An intruder in the estate does not get partial credit for a programme in flight. ## Interview signal Strong answers talk about calendars, owners and rollbacks as engineering artefacts, not project management overhead. Weak answers describe the target state in detail and treat getting there as an implementation detail - which is exactly the part that fails.