diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index 96c70ae..6b3c672 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -8,7 +8,12 @@ wireless_ssids = [
     name                = "EQT-CORPO"
     enabled             = true
     auth_mode           = "open"
-    wpa_encryption_mode = "WPA3 only"
+    # OWE (Opportunistic Wireless Encryption / Enhanced Open):
+    # La API de Meraki no expone OWE como campo configurable — se negocia a nivel de beacon.
+    # auth_mode="open" + wpa_encryption_mode=null es la configuración correcta vía API.
+    # La opción "Opportunistic Wireless Encryption" del Dashboard debe activarse manualmente;
+    # Terraform no la sobreescribirá porque no es un atributo que el provider gestione.
+    wpa_encryption_mode = null
     splash_page         = "Password-protected with custom RADIUS"
     ip_assignment_mode  = "Bridge mode"
     use_vlan_tagging    = true
@@ -27,7 +32,7 @@ wireless_ssids = [
     enabled             = true
     auth_mode           = "psk"            # Modo para contraseña compartida
     encryption_mode     = "wpa"           # Requerido por la API Meraki para PSK
-    wpa_encryption_mode = "WPA2 only"     # Lo que pediste para compatibilidad
+    wpa_encryption_mode = "WPA3 Transition Mode"
     # psk se inyecta via TF_VAR_wifi_password_psk (GitHub secret WIFI_PASSWORD_PSK)
     ip_assignment_mode  = "Bridge mode"
     use_vlan_tagging    = true
diff --git a/sites/BCN01-LAB/switch.auto.tfvars b/sites/BCN01-LAB/switch.auto.tfvars
index a044f7e..681bf71 100644
--- a/sites/BCN01-LAB/switch.auto.tfvars
+++ b/sites/BCN01-LAB/switch.auto.tfvars
@@ -120,11 +120,47 @@ switch_stack_port_configs = [
     access_policy_type = "Open"
   },
   {
-    # Puerto 47: uplink trunk en ambos miembros del stack
-    # VLAN nativa 109 (MANAGEMENT), permite todas las VLANs
+    # Puerto 44: ISP router (acceso WAN)
+    stack_name         = "bcn01-lab-stack01"
+    port_range         = "44"
+    name               = "ISP router 1"
+    type               = "access"
+    vlan               = 111  # WAN
+    access_policy_type = "Open"
+  },
+  {
+    # Puerto 45: WAN1 del MX primary
+    stack_name         = "bcn01-lab-stack01"
+    port_range         = "45"
+    name               = "WAN 1 BCN01-F04-MX01"
+    type               = "access"
+    vlan               = 111  # WAN
+    access_policy_type = "Open"
+  },
+  {
+    # Puerto 46: WAN1 del MX spare
+    stack_name         = "bcn01-lab-stack01"
+    port_range         = "46"
+    name               = "WAN 1 BCN01-F04-MX02"
+    type               = "access"
+    vlan               = 111  # WAN
+    access_policy_type = "Open"
+  },
+  {
+    # Puerto 47: uplink LAN del MX primary
     stack_name         = "bcn01-lab-stack01"
     port_range         = "47"
-    name               = "Uplink trunk"
+    name               = "UPLINK LAN BCN01-F04-MX01"
+    type               = "trunk"
+    vlan               = 109  # MANAGEMENT - VLAN nativa (untagged)
+    allowed_vlans      = "all"
+    access_policy_type = "Open"
+  },
+  {
+    # Puerto 48: uplink LAN del MX spare
+    stack_name         = "bcn01-lab-stack01"
+    port_range         = "48"
+    name               = "UPLINK LAN BCN01-F04-MX02"
     type               = "trunk"
     vlan               = 109  # MANAGEMENT - VLAN nativa (untagged)
     allowed_vlans      = "all"