diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index be2a189..afcb9e9 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -186,6 +186,30 @@ resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" { rules = var.firewall_rules } +# 4b. Configuración WAN estática de los MX (primary y spare) +# El serial se resuelve dinámicamente a partir del nombre del dispositivo +# usando el mismo data source meraki_network_devices que ya se usa para los switches +resource "meraki_device_management_interface" "mx_wan" { + for_each = { for mx in var.mx_wan_uplinks : mx.name => mx } + + serial = local.device_serials[each.key] + wan1_static_ip = each.value.wan1_static_ip + wan1_static_subnet_mask = each.value.wan1_static_subnet_mask + wan1_static_gateway_ip = each.value.wan1_static_gateway_ip + wan1_static_dns = each.value.wan1_static_dns +} + +# 4c. Warm Spare (HA) — VIP flotante entre primary y spare +resource "meraki_appliance_warm_spare" "ha" { + count = var.mx_warm_spare != null ? 1 : 0 + + network_id = local.network_id + enabled = var.mx_warm_spare.enabled + spare_serial = local.device_serials[var.mx_warm_spare.spare_name] + uplink_mode = var.mx_warm_spare.uplink_mode + virtual_ip1 = var.mx_warm_spare.virtual_ip1 +} + # --- CONFIGURACIÓN SWITCHES (MS) --- # 5. Políticas de acceso 802.1X diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf index ceb1403..2b52c3e 100755 --- a/modules/meraki-site/variables.tf +++ b/modules/meraki-site/variables.tf @@ -184,6 +184,31 @@ variable "stack_routing_interfaces" { description = "Interfaces L3 (SVIs) en stacks de switches para acceso de gestión al Dashboard de Meraki." } +# Configuración WAN de los firewalls MX (primary y spare) +variable "mx_wan_uplinks" { + type = list(object({ + name = string # Nombre del dispositivo en el Dashboard + wan1_static_ip = optional(string, null) + wan1_static_subnet_mask = optional(string, null) + wan1_static_gateway_ip = optional(string, null) + wan1_static_dns = optional(list(string), null) + })) + default = [] + description = "Configuración de interfaz WAN1 estática para cada MX. El serial se resuelve automáticamente por nombre de dispositivo." +} + +# Warm Spare (HA) del firewall MX +variable "mx_warm_spare" { + type = object({ + enabled = optional(bool, true) + spare_name = string # Nombre del MX spare en el Dashboard + uplink_mode = optional(string, "virtual") + virtual_ip1 = optional(string, null) # VIP WAN1 + }) + default = null + description = "Configuración Warm Spare (HA) del MX. El serial del spare se resuelve por nombre." +} + # Puertos del firewall MX variable "appliance_ports" { type = list(object({ diff --git a/sites/BCN01-LAB/firewall.auto.tfvars b/sites/BCN01-LAB/firewall.auto.tfvars index 6c49c55..55d752e 100755 --- a/sites/BCN01-LAB/firewall.auto.tfvars +++ b/sites/BCN01-LAB/firewall.auto.tfvars @@ -33,6 +33,16 @@ firewall_rules = [ dest_port = "any" syslog_enabled = false }, + { + comment = "Acceso Javi a synology" + policy = "allow" + protocol = "any" + src_cidr = "10.2.40.0/21" # VLAN 101 - GUEST + src_port = "any" + dest_cidr = "10.2.56.0/24" + dest_port = "any" + syslog_enabled = false + }, { comment = "Bloqueo temporal switch a 8.8.8.8" policy = "deny" diff --git a/sites/BCN01-LAB/main.tf b/sites/BCN01-LAB/main.tf index c4f0b92..c93df61 100755 --- a/sites/BCN01-LAB/main.tf +++ b/sites/BCN01-LAB/main.tf @@ -36,5 +36,7 @@ module "bcn01_lab" { switch_management_vlan = var.switch_management_vlan stack_routing_interfaces = var.stack_routing_interfaces appliance_ports = var.appliance_ports - wifi_password_psk = var.wifi_password_psk + mx_wan_uplinks = var.mx_wan_uplinks + mx_warm_spare = var.mx_warm_spare + wifi_password_psk = var.wifi_password_psk } diff --git a/sites/BCN01-LAB/switch.auto.tfvars b/sites/BCN01-LAB/switch.auto.tfvars index 694f391..a044f7e 100644 --- a/sites/BCN01-LAB/switch.auto.tfvars +++ b/sites/BCN01-LAB/switch.auto.tfvars @@ -141,7 +141,7 @@ switch_named_port_configs = [ port_range = "1" name = "Servers" type = "access" - vlan = 110 # SERVERS + vlan = 101 # SERVERS access_policy_type = "Open" }, { diff --git a/sites/BCN01-LAB/variables.tf b/sites/BCN01-LAB/variables.tf index c1ba7c4..6c094be 100755 --- a/sites/BCN01-LAB/variables.tf +++ b/sites/BCN01-LAB/variables.tf @@ -183,3 +183,26 @@ variable "appliance_ports" { default = [] description = "Configuración de puertos LAN del firewall MX." } + +variable "mx_warm_spare" { + type = object({ + enabled = optional(bool, true) + spare_name = string + uplink_mode = optional(string, "virtual") + virtual_ip1 = optional(string, null) + }) + default = null + description = "Configuración Warm Spare (HA) del MX." +} + +variable "mx_wan_uplinks" { + type = list(object({ + name = string # Nombre del dispositivo en el Dashboard + wan1_static_ip = optional(string, null) + wan1_static_subnet_mask = optional(string, null) + wan1_static_gateway_ip = optional(string, null) + wan1_static_dns = optional(list(string), null) + })) + default = [] + description = "Configuración WAN1 estática de los MX. El serial se resuelve automáticamente por nombre de dispositivo." +} diff --git a/sites/BCN01-LAB/wan.auto.tfvars b/sites/BCN01-LAB/wan.auto.tfvars new file mode 100644 index 0000000..f2505ad --- /dev/null +++ b/sites/BCN01-LAB/wan.auto.tfvars @@ -0,0 +1,31 @@ +# Configuración WAN1 estática de los firewalls MX +# El nombre debe coincidir exactamente con el nombre del dispositivo en el Dashboard +# Dashboard > Security & SD-WAN > Appliance > nombre del dispositivo + +# Warm Spare (HA): VIP flotante entre primary y spare +# La IP de salida del tráfico será siempre la VIP +mx_warm_spare = { + enabled = true + spare_name = "BCN01-F04-MX02" + uplink_mode = "virtual" + virtual_ip1 = "213.229.159.148" # VIP WAN1 +} + +mx_wan_uplinks = [ + { + # MX Primary + name = "BCN01-F04-MX01" # TODO: ajustar al nombre real en el Dashboard + wan1_static_ip = "213.229.159.145" + wan1_static_subnet_mask = "255.255.255.240" # /28 + wan1_static_gateway_ip = "213.229.159.147" + wan1_static_dns = ["8.8.8.8", "8.8.4.4"] + }, + { + # MX Spare (Warm Spare / HA) + name = "BCN01-F04-MX02" # TODO: ajustar al nombre real en el Dashboard + wan1_static_ip = "213.229.159.146" + wan1_static_subnet_mask = "255.255.255.240" # /28 + wan1_static_gateway_ip = "213.229.159.147" + wan1_static_dns = ["8.8.8.8", "8.8.4.4"] + }, +]