diff --git a/ssh-bastion/README.md b/ssh-bastion/README.md
new file mode 100644
index 0000000..d8727e8
--- /dev/null
+++ b/ssh-bastion/README.md
@@ -0,0 +1,29 @@
+# SSH Bastion Hosts
+
+These files were created to allow users to use Vagrant ([http://www.vagrantup.com](http://www.vagrantup.com)) to quickly and easily spin up an environment for learning and working with SSH bastion hosts and proxy commands. This environment was created and tested using VMware Fusion 7.1.2, Vagrant 1.7.4, and the Vagrant VMware plugin.
+
+## Contents
+
+* **bastion\_rsa** and **bastion\_rsa.pub**: Private/public key pair for accessing the SSH bastion host. The password for this key pair is `password` (all lowercase). These files are automatically installed by Vagrant into the correct VMs.
+
+* **README.md**: This file you're currently reading.
+
+* **remote\_rsa** and **remote\_rsa.pub**: Private/public key pair for accessing the remote SSH nodes behind the bastion host. The password for this key pair is `secure` (all lowercase). The `Vagrantfile` will automatically place these files in the correct locations on the appropriate VMs.
+
+* **servers.yml**: This YAML file contains a list of VM definitions and associated configuration data. It is referenced by `Vagrantfile` when Vagrant instantiates the VMs. Generally, this is the _only_ file that requires any edits; you'll edit this file to specify the correct Vagrant box installed on your system.
+
+* **ssh-bastion-diagram.png**: This PNG diagram provides a graphical overview of the different VMs in this environment and how they are connected.
+
+* **Vagrantfile**: This file is used by Vagrant to spin up the virtual machines. This file is fairly extensively commented to help explain what's happening. You should be able to use this file unchanged; all the VM configuration options are stored outside this file.
+
+## Instructions
+
+These instructions assume you've already installed VMware Fusion, Vagrant, and the Vagrant VMware plugin. Please refer to the documentation for those products for more information on installation or configuration.
+
+1. Use `vagrant box add` to add a 64-bit Ubuntu 14.04 ("Trusty Tahr") base box to be used by this `Vagrantfile`. You'll need to specify a box that provides support for the `vmware_desktop` provider (it should work with either VMware Workstation or VMware Fusion).
+
+2. Edit the `servers.yml` file to ensure the box you downloaded in step 1 is specified on the "box:" line of this file for each VM. (By default, there are three VMs, so make sure to specify the correct box name for all three VMs.)
+
+3. Run `vagrant up`, and when the VM is up use `vagrant ssh` to access the generic Debian VM.
+
+Enjoy!
diff --git a/ssh-bastion/Vagrantfile b/ssh-bastion/Vagrantfile
new file mode 100644
index 0000000..92dd6c3
--- /dev/null
+++ b/ssh-bastion/Vagrantfile
@@ -0,0 +1,95 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+# Specify Vagrant version, Vagrant API version, and Vagrant clone location
+Vagrant.require_version ">= 1.6.0"
+VAGRANTFILE_API_VERSION = "2"
+ENV['VAGRANT_VMWARE_CLONE_DIRECTORY'] = '~/.vagrant'
+#ENV['VAGRANT_DEFAULT_PROVIDER'] = 'virtualbox'
+#ENV['VAGRANT_DEFAULT_PROVIDER'] = 'vmware_appcatalyst'
+
+# Require 'yaml' module
+require 'yaml'
+
+# Read YAML file with VM details (box, CPU, and RAM)
+servers = YAML.load_file('servers.yml')
+
+# Create and configure the VMs
+Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
+
+  # Always use Vagrant's default insecure key
+  config.ssh.insert_key = false
+
+  # Iterate through entries in YAML file to create VMs
+  servers.each do |servers|
+    config.vm.define servers["name"] do |srv|
+
+      # Don't check for box updates
+      srv.vm.box_check_update = false
+      srv.vm.hostname = servers["name"]
+      srv.vm.box = servers["box"]
+
+      # Configure default synced folder (disable by default)
+      if servers["sync_disabled"] != nil
+        srv.vm.synced_folder ".", "/vagrant", disabled: servers["sync_disabled"]
+      else
+        srv.vm.synced_folder ".", "/vagrant", disabled: true
+      end #if servers["sync_disabled"]
+
+      # Assign additional private network, if specified in servers.yml
+      if servers["ip_addr"] != nil
+        srv.vm.network "private_network", ip: servers["ip_addr"]
+      end # if servers["ip_addr"]
+
+      # Configure CPU & RAM per settings in servers.yml (Fusion)
+      srv.vm.provider :vmware_fusion do |vmw|
+        vmw.vmx["memsize"] = servers["ram"]
+        vmw.vmx["numvcpus"] = servers["vcpu"]
+        if servers["nested"] == true
+          vmw.vmx["vhv.enable"] = "TRUE"
+        end #if servers["nested"]
+      end # srv.vm.provider vmware_fusion
+
+      # Configure CPU & RAM per settings in servers.yml (AppCatalyst)
+      srv.vm.provider :vmware_appcatalyst do |vmw|
+        vmw.vmx["memsize"] = servers["ram"]
+        vmw.vmx["numvcpus"] = servers["vcpu"]
+        #vmw.vmx['guestos'] = "other3xlinux-64"
+        if servers["nested"] == true
+          vmw.vmx["vhv.enable"] = "TRUE"
+        end #if servers["nested"]
+      end # srv.vm.provider vmware_appcatalyst
+
+      # Configure CPU & RAM per settings in servers.yml (VirtualBox)
+      srv.vm.provider :virtualbox do |vb|
+        vb.memory = servers["ram"]
+        vb.cpus = servers["vcpu"]
+      end # srv.vm.provider virtualbox
+
+      # Provision key pairs according to VM name
+      if servers["name"] == "outer"
+        srv.vm.provision "file", source: "bastion_rsa", 
+          destination: "/home/vagrant/.ssh/bastion_rsa"
+        srv.vm.provision "file", source: "bastion_rsa.pub", 
+          destination: "/home/vagrant/.ssh/bastion_rsa.pub"
+        srv.vm.provision "file", source: "remote_rsa", 
+          destination: "/home/vagrant/.ssh/remote_rsa"
+        srv.vm.provision "file", source: "remote_rsa.pub", 
+          destination: "/home/vagrant/.ssh/remote_rsa.pub"
+      end # if "outer"
+      if servers["name"] == "bastion"
+        srv.vm.provision "file", source: "bastion_rsa.pub", 
+          destination: "/home/vagrant/bastion_rsa.pub"
+        srv.vm.provision "shell", 
+          inline: "cat /home/vagrant/bastion_rsa.pub >> /home/vagrant/.ssh/authorized_keys"
+        srv.vm.provision "shell", inline: "rm /home/vagrant/bastion_rsa.pub"
+      end # if "bastion"
+      if servers["name"] == "remote1"
+        srv.vm.provision "file", source: "remote_rsa.pub", destination: "~/.ssh/authorized_keys"
+      end # if "remote1"
+      if servers["name"] == "remote2"
+        srv.vm.provision "file", source: "remote_rsa.pub", destination: "~/.ssh/authorized_keys"
+      end # if "remote2"
+    end # config.vm.define
+  end # servers.each
+end # Vagrant.configure
diff --git a/ssh-bastion/bastion_rsa b/ssh-bastion/bastion_rsa
new file mode 100644
index 0000000..95a72ab
--- /dev/null
+++ b/ssh-bastion/bastion_rsa
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,7FE49F27BE773D4FFC45681AAFBE2100
+
+D1WCSSy7EhsNjDNw+2bI0P2T3WmriJjHHY7UVwOUShD+yw2JU0Q5Z/6YHiOm9h92
+iU2ZHZzR8HurQ6rDD0KBQI++nmDerkKSdxjTu+3dSHRPG51WniwqmNEriOvSW0RO
+cdq1NdIYCDN8YE/r+htJAfhgVU7d+2yOJ9DGKEsm0PQrdEY1tlFfVPJbCNyZkI7M
+GPg9RRYdM4qgE5v3wu2KWPbuMkjqltIUOGeJfEl6D4ER8y5sHTxvSXA/gNJUsQuX
+9ZUb0fLAwRtfRiRPBIbNbv2HXkGdugo8srqF+7rWxmCk4f14ONekIgtlxxDUIdYK
+G7Wx2j9kf2ES8PBdZ3Udl/U404F5LEoIqBLo23zfDmuSK8LF47u5VS5enW68CyIi
+mzFw6yCoysdzk76QxrAfqGPtIxTGvemy3NTgk/PgQxRcM1dOca34kJm+36yU+N+w
+0Grxw+chNLVYv8VjdBgaJvQiZ/IPx1Zj9gZoQrOErLXGc04NqUFIgFT/M39EaB29
+wyQMYwwumySmFdIxWzAWCYw0KH5okjSR34SdaijYA/YZ16btEg58UNleBcZtyyzz
+A6zI9u2DZKdx1Dhgd8ScT8OZ3SFCbbMOTLHLowDQzLgpvK1L9v2+l/h6sa0Mr82U
+OeTOnvtuNSZYt3ZK46db5NVia9LcIFuqXbHiNY5pmw0EGZqsndBs4M6h5ijlgJ2D
+vG3P3nkYBJ58cnHZjv2yR9JMSqF6NcNGkViH4wEdFBtiye6tQF+Bv4PpAMz3jC/6
+X8JIKsPnbFzsl1HfEeSMcNcPxafqQaxZE18wrHZhn57ppluxvR7X0cGD8kWOMkB5
+v02Gf2NL76VvawbXFAWnOuNioQzzf1nlFU6yvLkuLdFu6W3ZBP86hpHNRZKhl9rt
+WGAzpc+cQ2cwRdQ9RPyQBURh3iK2bjWu2Ylje3JxZL5E1KJJk68FFx5NQOram58o
+giVulwQGjdmSymcSca4KKTgpoLL2A2uTFyJp0nCJkNhrtAQqd8kKGGGCovh3Z+i3
+hg8SArkvHnqind6/CTdsUCD7DZKtloHCgUoiI2ZXhw1IDn7gUZk0RqCVJX0fz039
+BEoaQCq1mnru6jS+N18qr2oU0BOEZ29id8grzgzyRR2QSYuQcsqygqRcc8b8meos
+zP70Z12W4b3qptClyyNcOVngdGiG///tqoVS4kHMB0tignlOjGpP7C8yi3nXxIY/
+lh2cPNfPTFCYEQJA/8nvxQxiVKf6MfmUIcamShG2hQY/WBSfVSsCqWlzSgG1298T
+9LCapkujQ+FoXOPE08krDcMWFFgsJuXL8S0c7wnaak0Y+He3LpFTbzuTJJe7jmW8
+e40ezFZyJlbcXjxhS/vifdk4E36VL6oaaE4dwx4nabuI1nVAMt2eGni/QzqbWbgf
+lahYnI2GzsF2x/gEEqp+QjORql/5wFZABGhZ7Xiwtj8sKP0Qaw43vXqnEvkpbIL7
+p74yHn4aW2jGMM1Sr68pUZGj8w9dOboARsHACsAnzsf5Sa+3ruegiu+KS1YidZDq
+TNMxZ7tyB5x4A39KY7Enz69c9WHQMlEv5q4PJwEqkth1pCAOVFEFoGtlP6ZboqOZ
+-----END RSA PRIVATE KEY-----
diff --git a/ssh-bastion/bastion_rsa.pub b/ssh-bastion/bastion_rsa.pub
new file mode 100644
index 0000000..3bab203
--- /dev/null
+++ b/ssh-bastion/bastion_rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8ED3jLmtB0o4NCqT4XirE2lGNt4M+WKd5PjIZj1/dgb4Be+IntdrWPAfkbgUoZaAGxp9Apj3asZJKVjFXqHIthu2AUoRGpBI75CQJ/8qXGtkazEhyE9kccIRKsTrngPBw7/uB7o6qXUWVkCjIJ6+QBOF5oTn5LB/FgB4FTxgezyVoRsakuFsuGRpTfndJE/YxK05/w+2Q21znfccORblLPASNnJ6H0vsX5glbF5RqhCLHHlIRLNMGNiUoleVojG60Z5m65fiDJvMSdexGcCZuk9eKxQ0sVwLmEabSZ3muW9SmuyJM1DjKD2/l2Ia+2RKrez1JLJFVmZ6GAsfvAzGX vagrant@outer
diff --git a/ssh-bastion/remote_rsa b/ssh-bastion/remote_rsa
new file mode 100644
index 0000000..19162f1
--- /dev/null
+++ b/ssh-bastion/remote_rsa
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-128-CBC,059D08D45581C2138081DD04CAED14E2
+
+jTTPJzsuMpgS9AjsQ3ebLT17PfB23pzzYE2rSuCdIbz+Zp/tG8dpUlH1CNzPw32F
+7A7PrGGE9neGCHAdQa18G+hW7hB5nwjfxnDOY5V+/IwMj+FTmyU5GH+KHT2ffTvp
+Cdb4xnsRDSPPsfJsaON78TrSbmmoVjwuRo/8ERt8HK7GixlE9/Ht65NrQFe3CfUc
+mSpLDhnjuRA54sLaCIaUJl0iKbUAGB0qPV8+W2RXGkz/x/CBSRrP7GB5FrZDWUlI
+Mu6RhYyt74VHX7hPlUExIxKuKqjKXwx4X8gV7cn5qLZuULg8EyPGTgfCziOfNjZF
+OdLAMRfYhwyjmhvEVqQsE8dmZTB7/w9wEcN8NIKLG6ECSKsOJ1a/UvnqUMFAIIx6
+cB655+Y57E93LQXZ6JpqOjf48Rf/FWngnODERkkJ/N7tXPNeoahFvLEH+PosMOvy
+hpqSBAZWEStXcInqkzXZr4Amk/voXZwCLKiJlpyvGlSkgG6jxrdGKdGZ5JOJ5Ezj
+mXgNnOTZuym5lXx97bdJAoVNXSQ6xMgb9iWJQOJ+wRUPKZgQALChEDtU8ije8KlV
+OUxBfL+t3zPnOQ7FfrN0xglswS3Bo/jdnch3fagGL7WimTtpR5OiYNo3/kXmfF1K
+RpMG3VbAS6poDHiezEqqObFZCxFMzVRm5tiNOQb5YoLldFmM7XIegd7dAJ5HFF1b
+vgpPSmUMRQoeyT2a+K0sdzzhphXZOzyfemRJG/EDV/ohrWqPhMCDfJ9NEWeCaej0
+M0WO02DXvnA6SVeATrMD1YMO0UYK+fP9YLrLafnqFVmH32LIoCLLDTkLc1weD+Fq
+dSbSMtoBsW/CwCuAqseim9UMBZS6iNUmTnnaqQBbHitIU6ujQh5ECWUC5TfznqTd
+2WVzFFtYYcB5YlMG7ZEfoCvezgjXr15Qfh5lg7D2YlOER59p8Q0jPFUMw06ARStQ
+GxozCmHHlFxIIxPWdfZHpfkCcr77l+s1Rqm3WW5h0zSv7Rjdd4ptvp6J3hKoHJnM
+jRnGiyj6BpkNQryMui/I7ZncgpA0yD2HVL3g05ZcbF9nM++zr0K9AaSwUGt5cvrV
+5OS9CgvGl9Tlxs6KT80rMayRN4pWaEOVCKHp//QRl0W1OsUxlvOAWW57tLh08wQb
+TKb4ZjCiJntyT6rFAVC6L1cvIJIsxLiOt1TQINycRsHpY3QSDvNYPjdbRDQI8tls
+bkjtBKnQjAUs4JXPIfxdXdCxLBfKUc0DrtSLIAe4opD0QU8pIqW7aPRurE9FY61X
+oeKPXiJk735oR/ije7XY8WxNj3a/a5nCR62FqfCuTHRNizDR5MPONS0K7kaHx2i+
+5ZIapO+3DbKDN+Jrer5/IK9KJLxPA70soabHkj2ecnLNncSPZUZqnc7IuxJuw/Th
+QUrmnfJnMkMzGhnOO6aaU9+Hd3wKkiiNAzjFFEgaWkh3BrteePxvURYKlNHOPlzt
+1i/BC3f1LaPDig2avp4JmWBV6OqWor2cEdTWF+azfOYH1g4u14U0E176G+G1SIRm
+pC3NK3V526S6isGnyng3kuzhLF7x/y/NKiaW4Gpk6m1rIrkyHPCNM7xRxGmR5SJp
+-----END RSA PRIVATE KEY-----
diff --git a/ssh-bastion/remote_rsa.pub b/ssh-bastion/remote_rsa.pub
new file mode 100644
index 0000000..cdc308e
--- /dev/null
+++ b/ssh-bastion/remote_rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0CZCDAEBX1QPzo3dV2IkSWaAgDuqLBjQc4r8TDFN8epTXauo8IzDJ4L7UuRDdw64X54wSqwK+Z+WzvITHujWtIvznXUTf4M67odDbvWt5T8gT/7bi9+Y2DMFsKQI2CjrQ+lEeiGAZYt/XGGQW9nIhKpSO6m8Vw4JUTfFxrZFkbQ6RyU4kvwOyHlbNYktmfxXTrWp3NHyfWRQC3ywSX19QvVFMeRIu9mmzZWtDaj2k44uwUkBlFjb6ijXzBuQNBtjWlDfwge1XVPfTVVyXSqDZJerHqDfFhqwPB8ZHRvg4YcnOz1ryjpkESJGl3BM3ZFBZHsrjfHhkG2kypn5Xefr vagrant@outer
diff --git a/ssh-bastion/servers.yml b/ssh-bastion/servers.yml
new file mode 100644
index 0000000..9f72e63
--- /dev/null
+++ b/ssh-bastion/servers.yml
@@ -0,0 +1,20 @@
+---
+- name: outer
+  box: slowe/ubuntu-trusty-x64
+  ram: 512
+  vcpu: 1
+- name: bastion
+  box: slowe/ubuntu-trusty-x64
+  ram: 512
+  vcpu: 1
+  ip_addr: 10.100.60.1
+- name: remote1
+  box: slowe/ubuntu-trusty-x64
+  ram: 512
+  vcpu: 1
+  ip_addr: 10.100.60.2
+- name: remote2
+  box: slowe/ubuntu-trusty-x64
+  ram: 512
+  vcpu: 1
+  ip_addr: 10.100.60.3
diff --git a/ssh-bastion/ssh-bastion-diagram.png b/ssh-bastion/ssh-bastion-diagram.png
new file mode 100644
index 0000000..364ed59
Binary files /dev/null and b/ssh-bastion/ssh-bastion-diagram.png differ