Topology/physical + logical view · 6 zones · ~20 nodes rev latest·07·2026
§ Topology Physical + logical view — what talks to what, and how

The Batman4NY lab spans six trust zones — four cloud tenants (Cisco, NVIDIA, OCI, GitHub), one home rack, one user surface. Nodes group by zone; edges below the diagram document the connections with protocol, edge type, and auth pattern. Legend at the bottom.

§ Network diagram · connections drawn solid = live · dashed = planned · line color = edge type  Click to enlarge
USERS OCI TENANCY · $0/mo NVIDIA GITHUB · Batman4NY CISCO TENANT · SSO federated HOME RACK · Upper Nyack, NY Public visitor ANY BROWSER Peer / reader ANY BROWSER Admin (Billy) WORKSTATION cisco-web-1-arm Ampere ARM64 · 2 OCPU · 12 GB LIVE Cloudflare DNS Zone: uppernyack.com · gray-cloud Let's Encrypt ACME · tls-alpn-01 · via Caddy build.nvidia.com NIM Free · up to 5K credits · 40 RPM LIVE Nemotron Endpoint via NIM Pages hosting batman4ny.github.io/* LIVE Repos Apache-2.0 · 4 public AI Defense 3-point guard · LLM I/O API Security Cloud Control Central FTD mgmt WIP ThousandEyes 200+ cloud + local agents Talos Intel feeds · IPS + URL updates Umbrella DNS + SIG · SASE PLAN Duo MFA IdP · SAML federation PLAN Smart Software Manager Licensing / entitlement Home ISP WAN uplink Cisco 1210CE Secure Firewall · FTD 7.6 FDM today · SCC managed soon WIP ConsolePi Pi 3B+ · ser2net LIVE LAN switch Inside network fan-out UCS C220 M8 Compute · Intersight-managed PLAN TE local agent Endpoint on Pi · home LAN LIVE Admin workstation (same 'Billy' from users) HTTPS · aidefense-demo HTTPS · batman4ny.gh SSO · SAML NIM API 3-point guard API A record USB-C · CDC-ACM · :9000 trunk Mgmt · Token · mTLS Talos feed pulls Licensing IPsec (planned) Agent registration SAML federation FDM local HTTPS PRIMARY FLOWS: user → OCI → NVIDIA + AI Defense (demo). Admin → SCC (mgmt). ConsolePi ↔ 1210 (OOB). batman4ny.github.io/topology · 2026·07·08
Public (HTTPS · TLS) Mgmt (control plane) Data (API · feeds) OOB (serial · physical) SSO (SAML · MFA) Planned (dashed)
Userspublic + admin
Public visitor
Any browser
Reads the demo → hits aidefense-demo
Peer / reader
Any browser
Reads the site → batman4ny.github.io
Admin (Billy)
Workstation
Manages every tenant + rack + repo
OCI tenancy$0/mo free tier
cisco-web-1-arm LIVE
Ampere ARM64 · 2 OCPU · 12 GB
Hosts aidefense-demo.uppernyack.com
Caddy TLS · Docker Compose · nftables
Cloudflare DNS
Zone: uppernyack.com
Gray-cloud (DNS-only) A record → 129.80.113.130
Let's Encrypt
ACME · tls-alpn-01
Automatic cert via Caddy; 60-day renewal
NVIDIA tenant · free tier
build.nvidia.com LIVE
NIM Free Tier · hosted API
Up to 5K credits total (1K signup + 4K biz-email upgrade) · 40 RPM default
Nemotron model
Endpoint via NIM
LLM backend for the NetBox chatbot
Cisco tenantSSO federated
AI Defense
Cloud service
3-point guard API · input · tool-args · output
Security Cloud Control WIP
Central FTD mgmt · SCC tenant
Onboarding pending on 1210CE
ThousandEyes
Cloud + endpoint tenant
200+ cloud agents · 1 local agent
Talos
Intel feeds
IPS rules + URL categorization; pulled by 1210 FTD
Umbrella PLAN
DNS + SIG · SASE
IPsec tunnel from 1210 outside interface (planned)
Duo PLAN
MFA IdP
SAML in front of SCC + FDM (planned)
Smart Software Manager
Licensing
1210CE Smart License registration; 90-day eval today
GitHubBatman4NY
Pages hosting LIVE
Static site · Actions build
Serves batman4ny.github.io/* · 5 sub-sites
Repos
Apache-2.0 · public
4 repos · every artifact open-sourced
Home rackUpper Nyack, NY
Home internet uplink
ISP · WAN
Cable / fiber → 1210 outside interface
Cisco 1210CE WIP
Secure Firewall · FTD 7.6
FDM local mgmt today · SCC-managed soon
90-day eval · full features
LAN switch
Managed L2/L3
Inside network fan-out for the rack
UCS C220 M8 PLAN
Rack server · Intersight
Planned compute node · no GPU (yet)
ConsolePi LIVE
Pi 3B+ · ser2net
USB-C CDC-ACM to 1210 · ttyACM0 :9000
ThousandEyes local agent
Endpoint on Pi
Home-LAN path visibility → cloud tenant
§ Edges · connections · auth patterns colored by edge type — see legend
Public Public visitor → cisco-web-1-arm HTTPS · aidefense-demo.uppernyack.com · Caddy on :443 · Let's Encrypt cert TLS
Public Peer / reader → GitHub Pages HTTPS · batman4ny.github.io/* · GitHub-served TLS TLS
Data cisco-web-1-arm → build.nvidia.com HTTPS · NIM API call from demo orchestrator to Nemotron endpoint API key
Data cisco-web-1-arm → AI Defense HTTPS · 3-point guard scan (input, tool args, output) via AI Defense API API key
Public Cloudflare DNS → cisco-web-1-arm DNS resolution · A record maps hostname → OCI public IP · gray-cloud (DNS-only) DNSSEC
Mgmt 1210CE → Security Cloud Control HTTPS · outbound from FTD mgmt interface · SCC controls policy + reports events Token · mTLS
Mgmt 1210CE → Smart Software Manager HTTPS · Smart Licensing registration + entitlement pull Token
Data 1210CE → Talos HTTPS · rule + URL DB updates pulled to FTD 7.6 on scheduled interval SmartLic ent.
Data 1210CE → Umbrella (planned) IPsec IKEv2 · outside IP → Umbrella SIG POP · DNS + SWG traffic PSK · IKE
Data TE local agent → ThousandEyes tenant HTTPS · endpoint agent registration + test data upload · 240 req/min limit API key
OOB ConsolePi ↔ 1210CE USB-C serial · CDC-ACM · ttyACM0 · ser2net exposes as telnet ConsolePi.local 9000 None (physical)
Mgmt Admin → Security Cloud Control HTTPS · SSO federation via Cisco tenant · Duo MFA planned on top SAML SSO
SSO Cisco tenant ↔ Duo (planned) SAML IdP federation · Duo layered in front of SCC + FDM for MFA SAML · MFA
Mgmt Admin → 1210CE (FDM) HTTPS to FDM UI · direct on-box mgmt · admin + local password (Duo planned) Password
Mgmt Admin → OCI console HTTPS · Oracle account · MFA enabled · manages cisco-web-1-arm + tenancy MFA
Mgmt Admin → GitHub HTTPS + git SSH · Batman4NY account · fine-grained PAT for CI, SSH key for local push PAT · SSH key
Public — user-facing HTTPS · TLS termination
Mgmt — control plane · admin sessions · policy push
Data — service-to-service API · feed pulls · tunnels
OOB — out-of-band · serial · physical layer
SSO — auth federation · SAML · MFA