I am currently planning a lab setup for an academic situation. We have host pc's that students use and we wish them to both have access to the internet and networking kit in the lab.
The university has Standard student images which would be applied to the host machine and from that we can run extra VM's. The VM's will give the students access to the kit via Ethernet. This should allow them to both console in via our terminal server or emulate a VM as a pc within a Topology.
The problem we face both internet connectivity and VM traffic will be using one NIC by deafult. Yes we could use Vlans to stop VM's getting internet access however students could alter the Vlans from the VM's or use clashing Vlans on the kit when emulating a pc in the topology.
MY question to the community is, is there any alternative to allow for a separation of traffic with ONE NIC on the host pc taking into consideration the use of cisco kit both on the university production network and in our labs. (They CAN NOT communication as it could cause clashes.) VM's can not have internet access due to students ability to use that to hack and do generally dubious activities but the host machine/OS NEEDS Internet access.