A pod is a self-contained student workspace within the CyberLab. Each pod gives one student their own isolated section of Active Directory, their own network segment, and their own firewall, so they can practice cybersecurity operations without affecting other students.
20 pods (Pod01 - Pod20), supporting 20 concurrent students.
Current state (September 5, 2026): each student has their own member server —
POD01-SRV…POD20-SRVat10.50.XX.20, all built, domain-joined and mapped one-to-one tostudentXX(Pod Member Servers). Seeding, evidence and verification run on those servers (crc_pod_servers). DC01-P01 and DC02-P01 remain domain controllers foracs-p01.localand are no longer student session hosts; student logon on DC01 is removed at final cutover, and until then thePODXX-DCtiles remain as rollback. See Current Cohort Lab Notices for which waivers survive the move.
Each pod consists of:
OU=PodXX,OU=Students,DC=acs-p01,DC=local)PXX- prefixpodXXnet) on PVE1, subnet 10.51.XX.0/24PodXX-GW, VM 300–319) at 10.51.XX.1C:\CyberLab\PodXX\<FAMILY>-Artifacts\PODXX-SRV, VM 400 + pod number) at 10.50.XX.20 — built for pods 03–15, not yet the student session hostEach pod has its own /24 — pods are not on a shared subnet.
| Item | Pattern | Pod01 | Pod20 |
|---|---|---|---|
| PVE1 bridge | podXXnet |
pod01net |
pod20net |
| Pod subnet | 10.51.XX.0/24 |
10.51.1.0/24 |
10.51.20.0/24 |
| Pod gateway (pfSense LAN) | 10.51.XX.1 |
10.51.1.1 |
10.51.20.1 |
| pfSense web UI | http://10.51.XX.1 |
http://10.51.1.1 |
http://10.51.20.1 |
| Gateway VM | PodXX-GW |
VM 300 | VM 319 |
| PVE1 host address on bridge | 10.51.XX.100 |
10.51.1.100 |
10.51.20.100 |
| Student prefix | PXX- |
P01- |
P20- |
| Pod member server | 10.50.XX.20 |
10.50.1.20 |
10.50.20.20 |
Pod hosts (the DCs and the pod member servers) address on 10.50.XX.0/24 over the same podXXnet bridge, while each pod's pfSense gateway owns 10.51.XX.0/24 for the SC/AU/CM firewall labs.
Each PodXX-GW is a pfSense VM with two NICs: WAN on vmbr0 (the 192.168.1.0/24 management network) and LAN on podXXnet. Because every pod owns its own firewall, the SC labs let students change firewall rules with no effect on any other pod.
The domain is shared: DC01-P01 (10.50.1.10) and DC02-P01 (10.50.1.11) both attach to the pod01net bridge, and each pod's pfSense gateway routes and filters pod traffic to them. Isolation between pods is enforced by Active Directory OU delegation and per-pod firewall rules, not by separate domains.
This has a direct consequence for the SC labs: if a student's firewall rules block DNS or LDAP to
10.50.1.10, domain logon from that pod breaks. The SC guide covers the allow rules that must stay in place.
When a student logs in (current behavior):
https://crc.guac.01.tcecure.com/#/) and launch the PODXX-SRV connection, which targets their own pod member server at 10.50.XX.20. The legacy PODXX-DC tile is retained only as the rollback path until cutover completes; PODXX-WS01 was deleted in June 2026 and the 20 PODXX-GW tiles are hidden (see below)studentXX@acs-p01.local (or ACS-P01\studentXX) against acs-p01.local — the domain account is unchanged, only the session host moveddsa.msc, gpmc.msc, Server Manager → Tools, taskschd.msc and secpol.msc all open normally; the RunAsInvoker workaround the shared DC needed no longer applies. ADUC binds remotely to DC01/DC02PODXX-SRVhttp://10.51.XX.1 — not from a Guacamole tilehttps://training.status.tcecure.com/pod/XX and, for enrolled students, on https://my.digitalrcc.com/student (Portal Integration)| Connection | State | Notes |
|---|---|---|
PODXX-SRV |
Visible to the student — the connection to use | RDP to that pod's member server at 10.50.XX.20, granted only to the matching studentXX |
PODXX-DC |
Retained, rollback only | RDP to shared DC01; grants are removed from students at final cutover |
PODXX-GW |
Hidden from students | Created with protocol http, which guacd does not implement (Support for protocol "http" is not installed), so it failed and auto-retried in a loop. Only the students' READ permission was removed, so restoring it is one statement |
PODXX-WS01 |
Deleted (June 2026) | No per-pod workstations exist |
See the Student Quick Start for the student-facing version of this.
| Page | Purpose |
|---|---|
| Lab Families | What students do inside a pod |
| Domain Controllers | DC01 / DC02 configuration and session capacity |
| Pod Member Servers | Per-pod PODXX-SRV session hosts and cutover plan |
| AWX Automation | Seed, verify, reset per pod |
| Training Tracker | Per-pod progress |
| Current Cohort Lab Notices | Waivers and tool-launch rules for this cohort |
| Network & Firewall | Pod routing to the 10.51.XX.0/24 firewalls |