{
 "firewall": [
  {
   "n": 1,
   "kind": "policy",
   "label": "web on 443 from a reserved node",
   "src": "node-a",
   "dst": "internet",
   "port": 443,
   "proto": "tcp",
   "app": null,
   "expected": "ai-web-out",
   "simulated": "ai-web-out",
   "action": "allow"
  },
  {
   "n": 2,
   "kind": "policy",
   "label": "overlay UDP to a named LAN peer",
   "src": "node-a",
   "dst": "lan-host",
   "port": 41641,
   "proto": "udp",
   "app": null,
   "expected": "ai-overlay-lan-direct",
   "simulated": "ai-overlay-lan-direct",
   "action": "allow"
  },
  {
   "n": 3,
   "kind": "policy",
   "label": "SSH to the same LAN peer by address",
   "src": "node-a",
   "dst": "lan-host",
   "port": 22,
   "proto": "tcp",
   "app": null,
   "expected": "ai-block-private",
   "simulated": "ai-block-private",
   "action": "drop"
  },
  {
   "n": 4,
   "kind": "policy",
   "label": "firewall management page",
   "src": "node-a",
   "dst": "fw-mgmt",
   "port": 443,
   "proto": "tcp",
   "app": null,
   "expected": "ai-block-private",
   "simulated": "ai-block-private",
   "action": "drop"
  },
  {
   "n": 5,
   "kind": "policy",
   "label": "a device on another private network",
   "src": "node-a",
   "dst": "private-other",
   "port": 8080,
   "proto": "tcp",
   "app": null,
   "expected": "ai-block-private",
   "simulated": "ai-block-private",
   "action": "drop"
  },
  {
   "n": 6,
   "kind": "policy",
   "label": "shared address space in the clear",
   "src": "node-a",
   "dst": "overlay-range",
   "port": 22,
   "proto": "tcp",
   "app": null,
   "expected": "ai-block-private",
   "simulated": "ai-block-private",
   "action": "drop"
  },
  {
   "n": 7,
   "kind": "policy",
   "label": "DNS to the sanctioned resolver",
   "src": "node-a",
   "dst": "resolver",
   "port": 53,
   "proto": "udp",
   "app": "dns",
   "expected": "ai-dns-sanctioned",
   "simulated": "ai-dns-sanctioned",
   "action": "allow"
  },
  {
   "n": 8,
   "kind": "policy",
   "label": "DNS to another public resolver",
   "src": "node-a",
   "dst": "resolver-other",
   "port": 53,
   "proto": "udp",
   "app": "dns",
   "expected": "ai-block-dns-other",
   "simulated": "ai-block-dns-other",
   "action": "reset-both"
  },
  {
   "n": 9,
   "kind": "policy",
   "label": "outbound SSH",
   "src": "node-a",
   "dst": "internet",
   "port": 22,
   "proto": "tcp",
   "app": "ssh",
   "expected": "ai-block-evasive",
   "simulated": "ai-block-evasive",
   "action": "drop"
  },
  {
   "n": 10,
   "kind": "policy",
   "label": "NTP",
   "src": "node-a",
   "dst": "internet",
   "port": 123,
   "proto": "udp",
   "app": "ntp",
   "expected": "ai-infra-out",
   "simulated": "ai-infra-out",
   "action": "allow"
  },
  {
   "n": 11,
   "kind": "policy",
   "label": "a non-standard web port",
   "src": "node-a",
   "dst": "internet",
   "port": 8443,
   "proto": "tcp",
   "app": null,
   "expected": "ai-cleanup-deny",
   "simulated": "ai-cleanup-deny",
   "action": "deny"
  },
  {
   "n": 12,
   "kind": "policy",
   "label": "an unreserved client",
   "src": "ai-other",
   "dst": "internet",
   "port": 443,
   "proto": "tcp",
   "app": null,
   "expected": "ai-cleanup-deny",
   "simulated": "ai-cleanup-deny",
   "action": "deny"
  },
  {
   "n": 13,
   "kind": "policy",
   "label": "LAN into the AI zone",
   "src": "lan-host",
   "dst": "node-b",
   "port": 22,
   "proto": "tcp",
   "app": null,
   "expected": "lan-to-ai-deny",
   "simulated": "lan-to-ai-deny",
   "action": "deny"
  },
  {
   "n": 14,
   "kind": "nat",
   "label": "source NAT for the web case",
   "src": "node-a",
   "dst": "internet",
   "port": 443,
   "proto": "tcp",
   "app": null,
   "expected": "ai-snat-out",
   "simulated": "ai-snat-out",
   "action": "allow"
  }
 ],
 "node": [
  {
   "n": 1,
   "check": "addressing",
   "expect": "the node holds its reserved address with the AI gateway as default route"
  },
  {
   "n": 2,
   "check": "web, first public host",
   "expect": "HTTP 200"
  },
  {
   "n": 3,
   "check": "web, second public host",
   "expect": "HTTP 200"
  },
  {
   "n": 4,
   "check": "a LAN service by address",
   "expect": "timeout"
  },
  {
   "n": 5,
   "check": "the firewall management page by address",
   "expect": "timeout"
  },
  {
   "n": 6,
   "check": "DNS via the sanctioned resolver, then via another public resolver",
   "expect": "an answer, then no answer"
  },
  {
   "n": 7,
   "check": "time sync status",
   "expect": "a server and an offset"
  },
  {
   "n": 8,
   "check": "overlay status",
   "expect": "both LAN peers shown as direct"
  },
  {
   "n": 9,
   "check": "overlay ping to the lab server",
   "expect": "replies via the direct path"
  },
  {
   "n": 10,
   "check": "overlay connectivity check",
   "expect": "UDP works; the mapping varies by destination behind dynamic NAT (expected)"
  },
  {
   "n": 11,
   "check": "SSH to the lab server over the overlay",
   "expect": "refused or timeout (overlay policy)"
  },
  {
   "n": 12,
   "check": "outbound SSH to a public host",
   "expect": "no connection (dropped by the evasive-apps rule)"
  }
 ]
}