{internet}
                                       |
                                     +-+--+
                                     | GW |             \     /     
                                     +-+--+              +---+      +---+
                                       | .254       .251 |ap1| .250 |noc|
    backbone net 10.10.0.0/24          |                 +-+-+      +-+-+
                                       |                   |          | 
  +---+-------+----------+-------+-----+-----------+-------+----+-----+-+--+
  .10 |    .1 |      .20 |    .2 |             .60 |    .6 |        
    +-+--+  +-+--+     +-+--+  +-+--+            +-+--+  +-+--+     
    |ext1|  |rtr1|     |ext2|  |rtr2|            |ext6|  |rtr6|     
    +----+  +-+--+     +----+  +-+--+            +----+  +-+--+     
              |.254              |.254                     |.254    
              |                  |                         |        
 10.10.1.0/24 |     10.10.2.0/24 |            10.10.6.0/24 |        
     --+------+--       --+------+--              --+------+--      
       |      |           |      |                  |      |        
   .10 |      | .253  .10 |      | .253         .10 |      | .253   
    +--+-+  +-+--+     +--+-+  +-+--+            +--+-+  +-+--+     
    |dmz1|  |fw1 |     |dmz2|  |fw2 | . . . . .  |dmz6|  |fw6 |     
    +----+  +-+--+     +----+  +-+--+            +----+  +-+--+     
              |.254              |.254                     |.254    
              |                  |                         |        
10.10.11.0/24 |    10.10.12.0/24 |           10.10.16.0/24 |         
     --+------+--       --+------+--              --+------+--      
       |      |           |      |                  |      |        
    +--+-+  +-+--+     +--+-+  +-+--+            +--+-+  +-+--+     
    |pc1 |  |srv1|     |pc2 |  |srv2|            |pc6 |  |srv6|     
    +----+  +----+     +----+  +----+            +----+  +----+     
     .10      .1        .10     .1                .10     .1        
                                                                    
       Group 1            Group 2                   Group 6         


Description:

extX = external host for group X
rtrX = 7200 border router for group X
dmzX = dmz services host for group X
fwX  = iptables / pfSense FW for group X
intX = internal server for group X
pcX  = WinXP victim :)

With this topology, we can pretty much do all we need to do:

- demonstrate firewall functionality
- demonstrate ACLs on IOS
- setup OSPF on the backbone
- demo metasploit and pivoting via the XP box
- nmap / vulnerability scanning
- port mirroring / analysis of traffic
- IDS
- host based labs (services, SSH/SSL, hardening, etc.)

Budget wise, we can allocate about 400 MB RAM to each of the hosts,
512 for the XP, and 192 for the rtr. That is roughly 2.3 GB worst
case memory usage / group. This leaves 2+ GB for base OS and running
a couple of hosts for the workshop pages and GW.