After a network change, county config agents stop checking in to the configuration server though their local services still run. What should troubleshooting prioritize?

After a network change, when county configuration agents still run local services but stop checking in to the configuration server, prioritize network or firewall path issues preventing agent-to-server API communication. Local health without remote check-in is a classic symptom of blocked egress, changed routes, missing allow-list entries, or DNS breakage between agents and the configuration API. Network changes can drop the ports or destinations agents need; restoring reachability can restore check-ins without rewriting agent software. Rewriting every agent binary to remove network dependency fails conceptually: it abandons centralized configuration management rather than fixing the path and is not a proportionate incident response. Assuming YAML comments alone can restore remote check-in paths fails because comments do not open firewalls or repair routes. Reinstalling the server to reset its agent registry, despite healthy agent services, targets the wrong layer and risks disrupting the control plane instead of restoring communication. Exam caveat: “network or firewall path” includes security groups, NACLs, host firewalls, proxies, and DNS, not only the core router ACL. TLS or certificate issues can look similar, but the timing after a network change points first to path and reachability. Practical check: from an affected agent host, test DNS and TCP/TLS to the server, compare firewall rules before and after the change, temporarily allow the documented agent port to confirm causality, restore least-privilege rules that include required server access, and watch county-wide check-in metrics recover.