diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index 42cc74d..a51244a 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -134,15 +134,17 @@ resource "meraki_appliance_vlans_settings" "activate_vlans" {
 }
 
 # 2. Crear las interfaces L3 y VLANs en el MX
+# Solo se crean VLANs con subnet definida (VLANs L2-only como WAN se excluyen
+# porque la API de Meraki exige que subnet sea una dirección IPv4 en formato CIDR)
 resource "meraki_appliance_vlan" "mx_gateways" {
-  for_each   = var.switch_vlans
+  for_each   = { for k, v in var.switch_vlans : k => v if v.subnet != null }
   depends_on = [meraki_appliance_vlans_settings.activate_vlans]
 
   network_id         = local.network_id
   vlan_id            = each.key
   name               = each.value.name
-  subnet             = each.value.subnet        # null para VLANs sin L3
-  appliance_ip       = each.value.appliance_ip  # null para VLANs sin L3
+  subnet             = each.value.subnet
+  appliance_ip       = each.value.appliance_ip
   reserved_ip_ranges = each.value.reserved_ip_ranges
   dhcp_handling      = each.value.dhcp_handling
 }
@@ -158,7 +160,10 @@ resource "meraki_wireless_ssid" "ssids" {
   enabled             = each.value.enabled
   auth_mode           = each.value.auth_mode
   psk                 = each.value.psk
-  wpa_encryption_mode = each.value.wpa_encryption_mode
+  # wpa_encryption_mode solo es compatible con auth_mode != "open"
+  # Para OWE (open + WPA3) la API rechaza el campo; la encriptación Enhanced Open
+  # se negocia a nivel de beacon y no se expone como atributo de la API Meraki.
+  wpa_encryption_mode = each.value.auth_mode != "open" ? each.value.wpa_encryption_mode : null
   splash_page         = each.value.splash_page
   ip_assignment_mode  = each.value.ip_assignment_mode
   use_vlan_tagging    = each.value.use_vlan_tagging
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index ea1d376..7c4a777 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -8,6 +8,7 @@ wireless_ssids = [
     name                = "EQT-CORPO"
     enabled             = true
     auth_mode           = "open"
+    wpa_encryption_mode = "WPA3 only"
     splash_page         = "Password-protected with custom RADIUS"
     ip_assignment_mode  = "Bridge mode"
     use_vlan_tagging    = true