SCOR-350-701 master topology
scor-master-v1
Every IP, hostname, VLAN and interface used in this course's lessons resolves to this blueprint. Modules only ever add to it — a lab built at lesson 3 is still valid at lesson 40.
Rules this topology is built under
Additive only — devices, interfaces, subnets, and VLANs may be added by later modules; existing ones are NEVER renumbered, renamed, or re-addressed.
Every lesson declares lab.devices_in_scope from this device list and lab.starting_state as the previous lesson's slug (or 'baseline').
Real = documented here. Lessons may not invent hosts, IPs, or VLANs (CI ip-lint).
Public-facing examples use documentation ranges only (198.51.100.0/24, 203.0.113.0/24, 192.0.2.0/24) — never real public IPs.
Device inventory
| Device | Role | Image | Interface | Zone | Address | Connected to |
|---|---|---|---|---|---|---|
FMC-01 | Firepower Management Center | sf-fmc-10.0.1 | eth0 | mgmt | 10.82.22.162/24 | — |
ISE-01 | Identity Services Engine (PAN/MnT/PSN standalone) | ise-3.5-p3 | eth0 | mgmt | 10.82.22.161/24 | — |
SNA-M-01 | Secure Network Analytics Manager VE (formerly Stealthwatch Management Console) | sna-manager-ve-7.6 | eth0 | mgmt | 10.82.22.163/24 | — |
SNA-FC-01 | Secure Network Analytics Flow Collector VE (Data Store) — first exporter target | flow-collector-ve-7.6 | eth0 | mgmt | 10.82.22.158/24 | — |
SNA-DS-01 | Secure Network Analytics Data Store — a single Data Node | sna-data-node-ve-7.6 | eth0 | mgmt | 10.82.22.172/24 | — |
AD-01 | Active Directory + DNS + Enterprise CA | win-srv-2025 | NIC1 | mgmt | 10.82.22.160/24 | — |
WS-ADMIN-01 | Admin workstation (browser access to all consoles) | win-10-ent | NIC1 | mgmt | 10.82.22.194/24 | — |
FTD-EDGE-01 | Firepower Threat Defense (FMC-managed) | ftdv-10-0-0 | Management0/0 | mgmt | 10.82.22.164/24 | SW-ACCESS-01 |
GigabitEthernet0/0 | perimeter | 198.51.100.1/24 | R-ISP-01 Gi0/0 | |||
GigabitEthernet0/1 | inside | 10.10.1.254/24 | SW-ACCESS-01 trunk | |||
GigabitEthernet0/2 | dmz | 172.16.1.254/24 | DMZ segment | |||
ASA-EDGE-01 | ASA (primary; active in HA pair) | asav-9-24-1 | Management0/0 | mgmt | 10.82.22.185/24 | SW-ACCESS-01 |
GigabitEthernet0/0 | perimeter | 198.51.100.2/24 | R-ISP-01 Gi0/0 | |||
GigabitEthernet0/1 | inside | 10.10.1.253/24 | SW-ACCESS-01 trunk | |||
GigabitEthernet0/2 | dmz | 172.16.1.253/24 | DMZ segment | |||
GigabitEthernet0/3 | failover | 10.255.1.1/29 | ASA-EDGE-02 Gi0/3 | |||
ASA-EDGE-02 | ASA (secondary; standby in HA pair — powered on for HA lessons only) | asav-9-24-1 | Management0/0 | mgmt | 10.82.22.186/24 | SW-ACCESS-01 |
GigabitEthernet0/0 | perimeter | 198.51.100.3/24 | R-ISP-01 Gi0/0 | |||
GigabitEthernet0/1 | inside | 10.10.1.252/24 | SW-ACCESS-01 trunk | |||
GigabitEthernet0/2 | dmz | 172.16.1.252/24 | DMZ segment | |||
GigabitEthernet0/3 | failover | 10.255.1.2/29 | ASA-EDGE-01 Gi0/3 | |||
SW-MGMT-01 | Out-of-band management switch (L2) | ioll2-xe-17-18-02 | Vlan100 | mgmt | 10.82.22.155/24 | — |
SW-DMZ-01 | DMZ switch (L2) | ioll2-xe-17-18-02 | Vlan20 | dmz | 172.16.1.2/24 | — |
SW-ACCESS-01 | L2/L3 access switch (campus VLAN anchor, dot1x authenticator) | ioll2-xe-17-18-02 | Vlan10 | inside | 10.10.1.254/24 | — |
Vlan100 | mgmt | 10.82.22.192/24 | — | |||
GigabitEthernet0/1 | — | — | FTD-EDGE-01 Gi0/1 | |||
GigabitEthernet0/2 | — | — | WS-INSIDE-01 | |||
GigabitEthernet0/3 | — | — | WS-ADMIN-01 | |||
WLC-01 | Wireless LAN Controller | cat9800-17-18-03 | management | inside | 10.10.1.2/24 | — |
AP-01 | Access point — joins WLC-01 over CAPWAP | vap-20260611 | eth0 | inside | 10.10.1.3/24 | SW-ACCESS-01 |
WS-INSIDE-01 | Employee workstation (Windows) | win-10-ent | NIC1 | inside | 10.10.1.100/24 | — |
WS-INSIDE-02 | Employee workstation (Linux) | ubuntu-24-04-20260307 | eth0 | inside | 10.10.1.101/24 | — |
WS-WIFI-01 | Wireless client | wireless-client-24-04-20260611 | wlan0 | inside | — | — |
WSA-01 | Web Security Appliance (explicit/transparent proxy) | wsa-14-5-1-016 | M1 | mgmt | 10.82.22.156/24 | — |
P1 | inside | 10.10.1.250/24 | — | |||
SRV-WEB-01 | Web server (Apache) | ubuntu-24-04-20260307 | eth0 | dmz | 172.16.1.10/24 | — |
SRV-MAIL-01 | Mail server (Postfix) | ubuntu-24-04-20260307 | eth0 | dmz | 172.16.1.20/24 | — |
SRV-DNS-01 | DNS server (BIND) — authoritative public DNS simulation for the lab's mail domains | ubuntu-24-04-20260307 | eth0 | dmz | 172.16.1.30/24 | — |
ESA-01 | Email Security Appliance | esa-15-0-5-016 | M1 | mgmt | 10.82.22.157/24 | — |
Data1 | dmz | 172.16.1.40/24 | — | |||
R-ISP-01 | ISP router | iosv-159-3-m12 | GigabitEthernet0/0 | perimeter | 198.51.100.254/24 | firewall outside interfaces |
GigabitEthernet0/1 | internet | 203.0.113.1/25 | ATK-KALI-01, SRV-CLOUD-01 | |||
GigabitEthernet0/2 | branch-wan | 192.0.2.1/30 | R-BRANCH-01 Gi0/0 | |||
Loopback0 | internet | 203.0.113.254/32 | the OUTSIDE HOST the ASA module's lessons ping, telnet and packet-trace to; drawn from the internet zone's reserved upper half (ruling 26, #306) | |||
ATK-KALI-01 | Kali attack machine | kali-2026-2 | eth0 | internet | 203.0.113.99/25 | — |
eth1 | inside | 10.10.1.99/24 | SW-ACCESS-01 | |||
SRV-CLOUD-01 | Cloud services simulator | ubuntu-24-04-20260307 | eth0 | internet | 203.0.113.10/25 | — |
R-BRANCH-01 | Branch router (S2S VPN peer, SD-WAN edge) | iosv-159-3-m12 | GigabitEthernet0/0 | branch-wan | 192.0.2.2/30 | R-ISP-01 Gi0/2 |
GigabitEthernet0/1 | branch | 10.20.1.1/24 | SW-BRANCH-01 | |||
SW-BRANCH-01 | Branch switch | ioll2-xe-17-18-02 | Vlan1 | branch | 10.20.1.2/24 | — |
WS-BRANCH-01 | Branch workstation (RA-VPN client) | ubuntu-24-04-20260307 | eth0 | branch | 10.20.1.100/24 | — |
VMANAGE-01 | Catalyst SD-WAN Manager (vManage) — read-along/policy-display only, not built by SCOR | vmanage-20.3.x | eth0 | mgmt | 10.82.22.168/24 | SW-MGMT-01 |
VBOND-01 | Catalyst SD-WAN Validator (vBond) — read-along/policy-display only, not built by SCOR | vbond-20.3.x | — | — | — | — |
VSMART-01 | Catalyst SD-WAN Controller (vSmart) — read-along/policy-display only, not built by SCOR | vsmart-20.3.x | — | — | — | — |
DUO-TENANT | Cisco Duo tenant (MFA, phishing-resistant methods, device trust) | — | — | — | — | — |
Harness devices (used by a single lesson, not part of the persistent build): ASA-HARNESS · R1 · R2
Addressing
Zones and VLANs. A lesson naming an address that is not here fails the addressing lint.
| Zone | Subnet | Gateway | VLAN | Purpose |
|---|---|---|---|---|
| Management | 10.82.22.0/24 | 10.82.22.1 | 100 | Out-of-band management for all security platforms |
| Inside | 10.10.1.0/24 | 10.10.1.254 | 10 | Employee LAN — wired, wireless, endpoints |
| 802.1X Authenticated | 10.10.30.0/24 | 10.10.30.1 | 30 | — |
| Guest | 10.10.40.0/24 | 10.10.40.1 | 40 | — |
| Quarantine | 10.10.99.0/24 | 10.10.99.1 | 99 | — |
| DMZ | 172.16.1.0/24 | 172.16.1.254 | 20 | Public-facing servers — web, mail, DNS, content security |
| Perimeter Transit | 198.51.100.0/24 | 198.51.100.254 | 5 | Firewall outside interfaces <-> ISP transit; NAT public pool lives here |
| Simulated Internet | 203.0.113.0/25 | — | — | Attacker, cloud services sim — everything beyond R-ISP-01 |
| Branch WAN Link | 192.0.2.0/30 | — | — | P2P link R-ISP-01 <-> R-BRANCH-01 (VPN underlay) |
| Branch LAN | 10.20.1.0/24 | 10.20.1.1 | — | Remote office site |
| ASA Failover Link | 10.255.1.0/29 | — | — | ASA active/standby failover + stateful replication (Module 4 HA) |
| ASA Harness Inside (R1 side) | 192.168.1.0/24 | — | — | ASA-HARNESS Gi0/1 to R1 Gi0/0 — the inside host of the routed/transparent mode flip |
| ASA Harness Outside (R2 side) | 192.168.2.0/24 | — | — | ASA-HARNESS Gi0/0 to R2 Gi0/0 — the outside host of the routed/transparent mode flip |
| VLAN | Name | Subnet |
|---|---|---|
| 5 | OUTSIDE-TRANSIT | 198.51.100.0/24 |
| 10 | INSIDE | 10.10.1.0/24 |
| 20 | DMZ | 172.16.1.0/24 |
| 30 | DOT1X-AUTH | 10.10.30.0/24 |
| 40 | GUEST | 10.10.40.0/24 |
| 99 | QUARANTINE | 10.10.99.0/24 |
| 100 | MGMT | 10.82.22.0/24 |
Pools: nat_public_pat = range: 198.51.100.100-198.51.100.110 · purpose: PAT pool (Modules 4-5 NAT lessons) · nat_public_static = range: 198.51.100.111-198.51.100.130 · purpose: Static NAT for DMZ servers · ravpn_client_pool = range: 10.10.50.1-10.10.50.100 · subnet: 10.10.50.0/24 · purpose: Remote Access VPN client addresses (Module 13) · dhcp_inside = range: 10.10.1.150-10.10.1.199 · purpose: Inside DHCP scope. Narrowed from .100 on 2026-09-03: WS-INSIDE-01 took 10.10.1.100 when hosts and servers stopped sharing a block, so named statics live .100-.149 and DHCP starts at .150. Both sit inside the ruling's .100-.199 workstation band (docs/LAB-ADDRESSING.md). · dhcp_dot1x = range: 10.10.30.100-10.10.30.199 · purpose: 802.1X-authenticated scope (VLAN 30, ISE-assigned). The .100-.199 workstation band. · dhcp_branch = range: 10.20.1.150-10.20.1.199 · purpose: Branch LAN scope, relayed by R-BRANCH-01. Narrowed from .100 on 2026-10-04 (#506): WS-BRANCH-01 took 10.20.1.100, so named statics live .100-.149 and DHCP starts at .150 -- the inside precedent, inside the .100-.199 workstation band.
Boot order
-
Step 1
SW-ACCESS-01
-
Step 2
AD-01
-
Step 3
FMC-01
-
Step 4
ISE-01
-
Step 5
FTD-EDGE-01, ASA-EDGE-01
-
Step 6
remaining per module power_on
Save EVE-NG snapshot BASELINE-FMC-REGISTERED after step 5.
What each module powers on
| Module | Powered on | Active gateway | RAM |
|---|---|---|---|
| IS Fundamentals / Threats / Crypto & PKI | WS-ADMIN-01, AD-01, ATK-KALI-01, WS-INSIDE-01, SW-ACCESS-01 | none | 23 GB |
| ASA Stateful Firewall | ASA-EDGE-01, WS-ADMIN-01, WS-INSIDE-01, SRV-WEB-01, R-ISP-01, SW-ACCESS-01 | ASA-EDGE-01 | 16 GB |
| Firepower NGFW | FTD-EDGE-01, FMC-01, WS-ADMIN-01, WS-INSIDE-01, SRV-WEB-01, R-ISP-01, ATK-KALI-01, SW-ACCESS-01 | FTD-EDGE-01 | 58 GB |
| Email Security (ESA) | ESA-01, SRV-MAIL-01, SRV-DNS-01, FTD-EDGE-01, FMC-01, WS-ADMIN-01, R-ISP-01, SW-ACCESS-01 | FTD-EDGE-01 | 60 GB |
| Web Security (WSA) | WSA-01, SRV-WEB-01, FTD-EDGE-01, FMC-01, WS-ADMIN-01, WS-INSIDE-01, R-ISP-01, SW-ACCESS-01 | FTD-EDGE-01 | 62 GB |
| Endpoint Security (Secure Endpoint) | WS-INSIDE-01, WS-INSIDE-02, WS-ADMIN-01, SW-ACCESS-01 | none | 13 GB |
| Secure Network Access (ISE) | ISE-01, SW-ACCESS-01, WLC-01, AP-01, WS-INSIDE-01, WS-WIFI-01, AD-01, FTD-EDGE-01, FMC-01, WS-ADMIN-01 | FTD-EDGE-01 | 86 GB |
| Infrastructure Security | R-ISP-01, SW-ACCESS-01, FTD-EDGE-01, FMC-01, WS-ADMIN-01, AD-01 | FTD-EDGE-01 | 56 GB |
| Telemetry & Visibility (Secure Network Analytics) | SNA-M-01, SNA-FC-01, SNA-DS-01, SW-ACCESS-01, FTD-EDGE-01, FMC-01, WS-ADMIN-01, WS-INSIDE-01 | FTD-EDGE-01 | 91 GB |
| Site-to-Site VPN | FTD-EDGE-01, ASA-EDGE-01, R-ISP-01, R-BRANCH-01, SW-BRANCH-01, WS-BRANCH-01, FMC-01, WS-ADMIN-01, SRV-WEB-01, SW-ACCESS-01 | FTD-EDGE-01 | 56 GB |
| Remote Access VPN | FTD-EDGE-01, FMC-01, R-ISP-01, WS-BRANCH-01, WS-ADMIN-01, ISE-01, R-BRANCH-01, SW-BRANCH-01, SW-ACCESS-01 | FTD-EDGE-01 | 68 GB |
| Secure Service Edge (Cisco Secure Access) | FTD-EDGE-01, FMC-01, R-ISP-01, SRV-DNS-01, SRV-WEB-01, WS-INSIDE-01, WS-ADMIN-01, SW-ACCESS-01 | FTD-EDGE-01 | 56 GB |
| Cloud Security / DevSecOps | SRV-CLOUD-01, WS-ADMIN-01, R-ISP-01 | none | 9 GB |
Source of truth: labs/SCOR/blueprint.yaml · owner Taylor Thomas.
The full build sheet is not rendered on the site yet.
Lessons that run on this topology: SCOR-350-701.