Jose MartinezandClaude Sonnet 4.6
cecf38efd7
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
123 lines
4.0 KiB
Terraform
Executable File
123 lines
4.0 KiB
Terraform
Executable File
# Definición de la Organización
|
|
variable "organization_name" {
|
|
type = string
|
|
description = "Nombre exacto de tu organización en el Dashboard de Meraki"
|
|
}
|
|
|
|
# Definición de la Red
|
|
variable "network_name" {
|
|
type = string
|
|
description = "Nombre de la red (Network)"
|
|
}
|
|
|
|
|
|
# Reglas de firewall L3
|
|
variable "firewall_rules" {
|
|
type = list(object({
|
|
comment = string
|
|
policy = string
|
|
protocol = string
|
|
src_cidr = string
|
|
src_port = string
|
|
dest_cidr = string
|
|
dest_port = string
|
|
syslog_enabled = optional(bool, false)
|
|
}))
|
|
default = []
|
|
description = "Reglas de firewall L3 para el site. Se aplican en orden, antes de la regla allow-all implícita de Meraki"
|
|
}
|
|
|
|
# SSIDs wireless
|
|
variable "wireless_ssids" {
|
|
type = list(object({
|
|
number = number
|
|
name = string
|
|
enabled = optional(bool, true)
|
|
auth_mode = string
|
|
splash_page = optional(string, "None")
|
|
wpa_encryption_mode = optional(string, "WPA3 only")
|
|
ip_assignment_mode = optional(string, "Bridge mode")
|
|
use_vlan_tagging = optional(bool, false)
|
|
default_vlan_id = optional(number, null)
|
|
redirect_url = optional(string, "")
|
|
radius_servers = optional(list(object({
|
|
host = string
|
|
port = number
|
|
})), [])
|
|
}))
|
|
default = []
|
|
description = "Lista de SSIDs wireless a configurar en el site"
|
|
}
|
|
|
|
# Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
|
|
variable "radius_secret" {
|
|
type = string
|
|
sensitive = true
|
|
default = ""
|
|
description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
|
|
}
|
|
|
|
# Definición del mapa de VLANs
|
|
variable "switch_vlans" {
|
|
type = map(object({
|
|
name = string
|
|
subnet = string
|
|
appliance_ip = string
|
|
dhcp_handling = optional(string, "Run a DHCP server")
|
|
reserved_ip_ranges = optional(list(object({
|
|
comment = string
|
|
id = string
|
|
start = string
|
|
end = string
|
|
})), [])
|
|
}))
|
|
description = "VLANs para el site"
|
|
|
|
validation {
|
|
condition = alltrue([
|
|
for v in values(var.switch_vlans) :
|
|
contains(["Run a DHCP server", "Relay DHCP to another server", "Do not respond to DHCP requests"], v.dhcp_handling)
|
|
])
|
|
error_message = "dhcp_handling debe ser uno de: 'Run a DHCP server', 'Relay DHCP to another server', 'Do not respond to DHCP requests'."
|
|
}
|
|
}
|
|
|
|
# Políticas de acceso 802.1X para switches
|
|
variable "switch_access_policies" {
|
|
type = list(object({
|
|
name = string
|
|
access_policy_type = optional(string, "802.1x")
|
|
host_mode = optional(string, "Multi-Auth")
|
|
radius_accounting_enabled = optional(bool, false)
|
|
radius_testing_enabled = optional(bool, false)
|
|
radius_coa_support_enabled = optional(bool, false)
|
|
radius_failed_auth_vlan_id = optional(number, null)
|
|
radius_re_authentication_interval = optional(number, 0)
|
|
url_redirect_walled_garden_enabled = optional(bool, false)
|
|
radius_servers = list(object({
|
|
host = string
|
|
port = number
|
|
}))
|
|
}))
|
|
default = []
|
|
description = "Políticas de acceso 802.1X para switches MS. El shared secret se toma de radius_secret."
|
|
}
|
|
|
|
# Configuración de puertos de switch con 802.1X
|
|
# Requiere serial del switch (visible en Dashboard > Switches > nombre del switch)
|
|
variable "switch_port_configs" {
|
|
type = list(object({
|
|
serial = string
|
|
port_id = string
|
|
name = optional(string, "")
|
|
type = optional(string, "access")
|
|
vlan = optional(number, null)
|
|
voice_vlan_id = optional(number, null)
|
|
access_policy_type = optional(string, "Open")
|
|
access_policy_number = optional(number, null)
|
|
}))
|
|
default = []
|
|
description = "Puertos de switch a configurar. access_policy_number referencia el número de la política creada en switch_access_policies."
|
|
}
|
|
|