From 7cb7c22b5b05411718c5c217a3cd521dfbf127a6 Mon Sep 17 00:00:00 2001
From: Jose Martinez <jose.martinez@armenteros.org>
Date: Thu, 26 Mar 2026 06:32:39 +0100
Subject: [PATCH] fix(bcn01-lab): corregir errores de apply en VLAN 111 y SSID
 EQT-CORPO

- meraki_appliance_vlan: filtrar VLANs sin subnet (if v.subnet != null)
  para que VLAN 111 WAN (L2-only) no se pase a la API del MX, que exige
  CIDR en el campo subnet.
- meraki_wireless_ssid: pasar wpa_encryption_mode = null cuando
  auth_mode = "open", ya que la API Meraki rechaza modos WPA con auth
  abierta. OWE/Enhanced Open se negocia a nivel beacon y no se expone
  como atributo API.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/meraki-site/main.tf       | 13 +++++++++----
 sites/BCN01-LAB/ssids.auto.tfvars |  1 +
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index 42cc74d..a51244a 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -134,15 +134,17 @@ resource "meraki_appliance_vlans_settings" "activate_vlans" {
 }
 
 # 2. Crear las interfaces L3 y VLANs en el MX
+# Solo se crean VLANs con subnet definida (VLANs L2-only como WAN se excluyen
+# porque la API de Meraki exige que subnet sea una dirección IPv4 en formato CIDR)
 resource "meraki_appliance_vlan" "mx_gateways" {
-  for_each   = var.switch_vlans
+  for_each   = { for k, v in var.switch_vlans : k => v if v.subnet != null }
   depends_on = [meraki_appliance_vlans_settings.activate_vlans]
 
   network_id         = local.network_id
   vlan_id            = each.key
   name               = each.value.name
-  subnet             = each.value.subnet        # null para VLANs sin L3
-  appliance_ip       = each.value.appliance_ip  # null para VLANs sin L3
+  subnet             = each.value.subnet
+  appliance_ip       = each.value.appliance_ip
   reserved_ip_ranges = each.value.reserved_ip_ranges
   dhcp_handling      = each.value.dhcp_handling
 }
@@ -158,7 +160,10 @@ resource "meraki_wireless_ssid" "ssids" {
   enabled             = each.value.enabled
   auth_mode           = each.value.auth_mode
   psk                 = each.value.psk
-  wpa_encryption_mode = each.value.wpa_encryption_mode
+  # wpa_encryption_mode solo es compatible con auth_mode != "open"
+  # Para OWE (open + WPA3) la API rechaza el campo; la encriptación Enhanced Open
+  # se negocia a nivel de beacon y no se expone como atributo de la API Meraki.
+  wpa_encryption_mode = each.value.auth_mode != "open" ? each.value.wpa_encryption_mode : null
   splash_page         = each.value.splash_page
   ip_assignment_mode  = each.value.ip_assignment_mode
   use_vlan_tagging    = each.value.use_vlan_tagging
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index ea1d376..7c4a777 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -8,6 +8,7 @@ wireless_ssids = [
     name                = "EQT-CORPO"
     enabled             = true
     auth_mode           = "open"
+    wpa_encryption_mode = "WPA3 only"
     splash_page         = "Password-protected with custom RADIUS"
     ip_assignment_mode  = "Bridge mode"
     use_vlan_tagging    = true