Qutzl LLC LogoQutzl Insights

Tutorial

A one-page network diagram that stays true

How to build a single network map your team will actually update after every change, not a shelf document from the last migration.

3 min readBy Michael NarehoodNetworking

Most network diagrams lie. Not on purpose, they just age the day after someone adds a VLAN, swaps ISPs, or drops a new AP on the wrong port. A one-page diagram only helps if it is the first thing you update when the network changes, and simple enough that you will.

This tutorial is for a single-sheet map: uplink, firewall, core switch, Wi-Fi, servers, and the VLANs that matter for troubleshooting. Not every patch panel. Not every desk jack.

1. Pick one canonical copy

Choose one place the diagram lives: a shared drive folder, your PSA wiki, or a printed sheet in the network closet with a “last updated” date in the corner. Multiple “official” versions is how everyone works from a different lie.

Name it plainly: Network Overview – Site Name. Link it from your runbook and onboarding notes.

2. Draw only what you need during an outage

Include:

  • Internet path: ISP handoff, modem/ONT, firewall WAN
  • Core gear: firewall, core switch, any router-on-a-stick
  • Wireless: APs or controller, which VLANs they serve
  • Servers / NAS / hypervisor: host name or role, management IP if useful
  • VLANs / subnets: ID, name, purpose (staff, guest, VoIP, cameras)
  • VPN / remote access: where it lands (full tunnel vs split, which VLAN)

Skip individual workstations. Skip cable colors unless they save you time on site.

3. Use consistent symbols and labels

You do not need Visio mastery. You need readability at 2 a.m.

  • Rectangles for appliances, clouds for ISP and SaaS
  • Label ports that matter: WAN1, LAN, DMZ, Trunk to switch
  • Write VLAN ID and subnet together: VLAN 20 – 10.20.0.0/24 – Staff
  • Note default gateway on each VLAN if staff other than you will read it

If a non-network person cannot find “where guest Wi-Fi lives,” simplify.

4. Tie changes to a three-line update rule

After any network change, update three things before you close the ticket:

  1. The diagram (one page)
  2. A short change note (date, what moved, who approved)
  3. Firewall or switch export if your team stores configs (optional but valuable)

Make “diagram updated” a checkbox on network change tickets. No checkbox, change is not done.

5. Review on a schedule you will keep

Quarterly is enough for most SMBs if you enforce the three-line rule. In the review:

  • Walk the closet: does the physical gear match the sheet?
  • Spot-check VLANs from a laptop on each SSID
  • Delete retired gear from the drawing (ghost switches confuse everyone)

Set a calendar invite. Skipping twice means the diagram is dead again.

6. Validate with a five-minute drill

Hand the diagram to someone who did not build the network. Ask them to answer:

  • Where does guest traffic exit?
  • What sits between cameras and the file server?
  • If ISP 1 fails, what is the failover path?

Wrong answers mean the drawing or the network needs fixing, sometimes both.

Bottom line

One accurate page beats a forty-page deck nobody opens. Keep a single canonical diagram, limit it to outage-critical paths, update it with every change, and review it quarterly. When the map stays true, troubleshooting and onboarding get faster without another documentation project.