VPN upgrades fail socially, not technically: twenty people locked out on the same Monday morning. One pilot user, one external test and a backup taken before you start turns the same job into a non event.
The video finishes by connecting and verifying - the right instinct, applied to one client. A whole office deserves the same discipline at slightly larger scale. This page is the rollout method for the upgrade: back up first, pilot second, batches third, with the two checks people most often skip - testing from a genuinely external network, and confirming the MFA prompt appears on reconnection, not just the first connection.
Before any authentication change, take a backup of the firewall's configuration using its built in backup option and store the file somewhere that is not the firewall - a secured folder, an encrypted drive. You are about to change the rules of the door everyone uses to enter the network; if a subtlety breaks (an account missed, a setting saved wrong), restoring yesterday's configuration is a five minute embarrassment instead of a weekend rebuild. Keep that backup until the new setup has survived a full normal week, then replace it with a backup of the new world.
Create or pick one account and run it through the entire new world first: local directory entry, password, MFA enrolment with the QR code, fresh config download, import, connect. The pilot should be someone patient whose work will not stop a business if the first attempt hiccups - an IT friendly colleague, or your own daily account while your old admin path still works. Every rough edge you find with the pilot - a confusing prompt, a mistyped step, a phone clock problem - is one you will not meet fifteen times on rollout day.
"Connected" is not a test. Run the pilot through all five: connects from the office network; connects from mobile data (truly external - the video's closing DHCP warning lives here, because a public address that changed will only betray you from outside); opens a real office application over the tunnel, not just the tunnel itself; disconnects and reconnects, being asked for a fresh code; and fails correctly when a wrong code is typed. That last check is the one that proves MFA is enforcing, not decorating. Write the results on the audit sheet.
Migrate three to five users at a time, with enrolment done in person as described in the MFA page. Batches keep problems small and attributable: if batch two struggles, batch one's difference tells you why. On the first morning after each batch, be reachable and expect the two classic calls - "the code changed while I was typing" (wait for the next code) and "it works at home but not at the client site" (that network may block or the address moved; your external test already proved your side). After the last batch, retire every pre upgrade config you find, and re run the audit list against the new directory.
Two slow fuses remain after a successful rollout. First, certificates expire - the server and client certificates behind OpenVPN have lifetimes, and when one lapses the failure is total and always at the worst time; check expiry dates during an annual review, not during an outage. Second, attention expires: schedule a quarterly ten minute review of the user directory against current staff, exactly as the audit page describes. The upgrade you tested so carefully deserves a calendar entry, not just a good memory.
The video ends with a successful verified connection - the pilot test in this page is that same check, done five ways.
▶️ Watch Full VideoBecause it is a genuinely external network with no office equipment in the path. It exposes the two failures office testing hides - the firewall not being reachable from outside, and a DHCP assigned public address that has changed since the config was written.
Three to five. Small enough that every enrolment is personal and every problem is traceable, large enough that patterns appear. The pilot user comes before all batches and is not counted in them.
Until the new setup has run cleanly for at least a full working week with every user migrated. Then take a fresh backup of the new configuration and keep that as your restore point going forward.