# Reglas de firewall L3
firewall_rules = [
  {
    # Permite que los switches (VLAN MANAGEMENT) lleguen a internet para acceder al Dashboard de Meraki
    comment        = "Permitir MANAGEMENT a internet (acceso Dashboard Meraki)"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.55.0/24"  # VLAN 109 - MANAGEMENT
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    # Permite que los APs (VLAN APs) lleguen a internet para acceder al Dashboard de Meraki
    comment        = "Permitir APs a internet (acceso Dashboard Meraki)"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.54.0/24" # VLAN 108 - APs
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    # Permite que los clientes GUEST (VLAN GUEST) lleguen a internet
    comment        = "Permitir GUEST a internet"
    policy         = "allow"
    protocol       = "any"
    src_cidr       = "10.2.40.0/21"  # VLAN 101 - GUEST
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  },
  {
    comment        = "Denegar el resto del trafico de salida"
    policy         = "deny"
    protocol       = "any"
    src_cidr       = "any"
    src_port       = "any"
    dest_cidr      = "any"
    dest_port      = "any"
    syslog_enabled = false
  }
]