SCAZT-300-740 master topology
scazt-extension-v1
Every IP, hostname, VLAN and interface used in this course's lessons resolves to this blueprint. Modules only ever add to it — a lab built at lesson 3 is still valid at lesson 40.
Rules this topology is built under
Additive only — this file may add devices, interfaces, subnets, VLANs; it may NEVER redefine, re-address, or rename anything scor-master-v1 owns.
Inherited devices appear as reference rows (name + inherit marker) carrying NO addressing — scor-master-v1 stays the single source of truth for them.
Every address consumed by SCAZT comes from the bands the shared allocation table reserves for SCAZT (or from a new allocation explicitly flagged below for band-table adoption). Nothing SCOR, SNCF, or SISE owns is touched.
Zero platform_overrides — none needed, stated explicitly in platform_overrides below.
Real = documented here or in scor-master-v1. SCAZT lessons may not invent hosts, IPs, or VLANs (CI ip-lint).
Device inventory
| Device | Role | Image | Interface | Zone | Address | Connected to |
|---|---|---|---|---|---|---|
WS-ADMIN-01 | — | — | — | — | — | — |
AD-01 | — | — | — | — | — | — |
ISE-01 | — | — | — | — | — | — |
WS-INSIDE-01 | — | — | — | — | — | — |
SW-ACCESS-01 | — | — | — | — | — | — |
SRV-WEB-01 | — | — | — | — | — | — |
FTD-EDGE-01 | — | — | — | — | — | — |
FMC-01 | — | — | — | — | — | — |
ATK-KALI-01 | — | — | eth0 | internet | 203.0.113.99/25 | — |
R-ISP-01 | — | — | — | — | — | — |
VMANAGE-01 | — | — | — | — | — | — |
R-BRANCH-01 | — | — | — | — | — | — |
SRV-CLOUD-01 | — | — | — | — | — | — |
SRV-DNS-01 | — | — | — | — | — | — |
SW-BRANCH-01 | — | — | — | — | — | — |
WS-BRANCH-01 | — | — | — | — | — | — |
SNA-M-01 | — | — | — | — | — | — |
SNA-FC-01 | — | — | — | — | — | — |
SNA-DS-01 | — | — | — | — | — | — |
ASA-EDGE-01 | — | — | — | — | — | — |
ASA-EDGE-02 | — | — | — | — | — | — |
WLC-01 | — | — | — | — | — | — |
WS-INSIDE-02 | — | — | — | — | — | — |
WS-WIFI-01 | — | — | — | — | — | — |
WSA-01 | — | — | — | — | — | — |
SRV-MAIL-01 | — | — | — | — | — | — |
ESA-01 | — | — | — | — | — | — |
VBOND-01 | — | — | — | — | — | — |
VSMART-01 | — | — | — | — | — | — |
K8S-01 | Kubernetes node — the containerised workload Secure Workload protects, and the 1.6 eBPF target | ubuntu-22.04 | eth0 | mgmt | 10.82.22.169/24 | SW-ACCESS-01 |
SRV-WAF-01 | WAF fronting the private app the zero-trust path reaches | seclab-linux-base | eth0 | ztsvc | 10.10.250.30/24 | SW-ACCESS-01 |
DUO-PROXY-01 | Duo Authentication Proxy — AD-01 as Duo SSO's Active Directory source (2.6) | seclab-linux-base | eth0 | mgmt | 10.82.22.171/24 | — |
SPLUNK-01 | SIEM | ubuntu-22.04 | eth0 | mgmt | 10.82.22.191/24 | SW-ACCESS-01 |
WS-ROAM-01 | Roaming endpoint OUTSIDE the perimeter (remote worker simulation) | win-10-ent | NIC1 | internet | 203.0.113.100/25 | R-ISP-01 Gi0/1 segment |
SAC-RC-01 | Cisco Secure Access resource connector — OWNER-ONLY | cisco-sac-resource-connector-ova | eth0 | ztsvc | 10.10.250.40/24 | — |
SAC-TENANT | Cisco Secure Access tenant (SSE dashboard, policies, ZTNA, VPNaaS) | — | — | — | — | — |
SWX-TENANT | Cisco Secure Workload SaaS tenant | — | — | — | — | — |
XDR-TENANT | Cisco XDR tenant (5.4 SOC integration) | — | — | — | — | — |
DUO-TENANT | Cisco Duo tenant (MFA, phishing-resistant methods, device trust) | — | — | — | — | — |
TE-TENANT | ThousandEyes tenant (digital experience monitoring, 4.6.b) | — | — | — | — | — |
AWS-LAB | AWS account (free tier) — VPCs, security groups, IAM for 1.3/1.4 | — | — | — | — | — |
AZURE-LAB | Azure account (free tier) — VNets, NSGs, Entra concepts for 1.3/1.4 | — | — | — | — | — |
GCP-LAB | GCP account (free tier) — VPCs, firewall rules, IAM for 1.3/1.4 | — | — | — | — | — |
Harness devices (used by a single lesson, not part of the persistent build): ASA-HARNESS · R1 · R2
Addressing
Zones and VLANs. A lesson naming an address that is not here fails the addressing lint.
Source of truth: labs/SCAZT/blueprint.yaml · owner Taylor Thomas.
The full build sheet is not rendered on the site yet.
Lessons that run on this topology: SCAZT-300-740.