# Down the Rabbit Hole: Fostering Active Learning through Guided Exploration of a SCADA Cyber Range
## 3 Development of the Cyber Range Environment
### Cyber Range Scenario Setup  
The complete logical network organization of the CANVAS-based cyber range scenario is depicted in Figure 6. Following the IEC-62443 recommendations, the Operational Technology (OT) and IT networks are segmented. The OT network encompasses the physical process components and devices, together with the virtualized component/service instances associated with Levels 1 and 2 (see Figure 5). Figure 6: Logical network topology for the full cyber range environment. A Demilitarized Zone (DMZ) provides isolation between the OT and IT networks, with the latter hosting the logging, data ingestion, normalization and analytics service/component VMs. Components in the IT, DMZ and virtual OT networks are virtualized within a type 1 hypervisor environment, together with the associated network infrastructure, which is supported by means of virtual switches, port groups and network appliance VMs. CANVAS components may be manually provisioned or instantiated from a template library of assets. This approach allows for efficient reuse of resources with a quick deployment turnaround time, requiring minimal customization for each instance. In the specific case of Figure 6, template-based VMs are enclosed within blue boxes--this is the case for all the HMI VMs, which are created from a base template composed of a Windows 7 OS image and the Rapid SCADA [24] open-source industrial automation platform, or the vPLC, based on a Linux OS image with an OpenPLC deployment. Other available templates include preconfigured Mininet simulated topologies, virtual devices or low interaction honeypots, which can be seamlessly added to the laboratory environment network in order to enrich the scenario. Students are also provided with template-based VMs (green VMs), preloaded with the Kali Linux OS [25], configured with 2 virtual CPU cores, 2 GB RAM, two network interfaces and 50 GB of persistent storage, providing equal resources and access rights for everyone, while shielding the environment from the Campus LAN  
Figure 7 depicts the physical topology for the cyber range environment setup. VMs are hosted on VMware ESXi 7.0 hypervisor nodes (both servers share the same configuration) which, besides the student VM instances, also host supporting services and virtualized components required for the specific laboratory environment (such as HMIs or vPLCs). Moreover, note that student VMs have a multi-homed network interface setup. This allows for students to access their VMs via the interface connected to the campus network, using the second interface to access the cyber range scenario. This is the reason for the duplicate representation of the student VMs in Figure 6, since each one is provisioned with two network interfaces, one connected to the OT and the other one to the IT network. One challenge remains, though. For network traffic capture and analysis purposes, students need to access a SPAN/Mirror port, configured to replicate traffic from selected devices belonging to the physical network side (on the left)--in fact this a recommended practice for Intrusion Detection Systems (IDS) deployment in critical infrastructure scenarios, as it allows for passive traffic capture without introducing a point of failure in the middle of a communications path. Unfortunately, our cyber range setup uses a managed switch that does not support Remote SPAN (RSPAN) or Encapsulated RSPAN (ERSPAN)  
Figure 7: Cyber range environment physical infrastructure (green VMs used for students; yellow VMs support services and testbed components for the specific scenario). capabilities [26], therefore limiting the possibility of creating shared mirror ports. With such capabilities in place, VMware distributed vswitches or Open vSwitch [27] instances could have been used as endpoints for traffic replication, effectively allowing for the replication of mirror traffic across all the student VM instances.