Jose MartinezandClaude Sonnet 4.6
5cdc09747e
SSIDs: - EQT-CORPO: wpa_encryption_mode → null (OWE / Enhanced Open) - EQT-GUEST: wpa_encryption_mode → WPA3 Transition Mode Puertos stack bcn01-lab-stack01 (sw01 y sw02): - Puerto 44: access VLAN 111 WAN — ISP router 1 - Puerto 45: access VLAN 111 WAN — WAN 1 BCN01-F04-MX01 - Puerto 46: access VLAN 111 WAN — WAN 1 BCN01-F04-MX02 - Puerto 47: trunk VLAN nativa 109, todas — UPLINK LAN BCN01-F04-MX01 - Puerto 48: trunk VLAN nativa 109, todas — UPLINK LAN BCN01-F04-MX02 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
211 lines
6.8 KiB
HCL
211 lines
6.8 KiB
HCL
# Configuración de switches MS - BCN01-LAB
|
|
# El shared secret de RADIUS se pasa via TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)
|
|
|
|
# --- POLÍTICAS DE ACCESO 802.1X ---
|
|
switch_access_policies = [
|
|
{
|
|
name = "DOT1X-CORPO"
|
|
access_policy_type = "Hybrid authentication"
|
|
host_mode = "Multi-Auth"
|
|
radius_accounting_enabled = false
|
|
radius_re_authentication_interval = 0
|
|
url_redirect_walled_garden_enabled = false
|
|
|
|
# VLAN a la que cae el puerto si el RADIUS no responde
|
|
radius_failed_auth_vlan_id = 101 # GUEST
|
|
|
|
radius_servers = [
|
|
{
|
|
host = "15.15.15.15"
|
|
port = 1912
|
|
}
|
|
]
|
|
}
|
|
]
|
|
|
|
# --- PUERTOS DE SWITCH ---
|
|
# El serial aparece en Dashboard > Switches > nombre del switch > Overview.
|
|
# access_policy_number: número auto-asignado por Meraki a la política creada arriba
|
|
# (visible en Dashboard > Switches > Switch settings > Access policies)
|
|
#
|
|
# Ejemplo con los tres tipos de puerto:
|
|
# switch_port_configs = [
|
|
#
|
|
# # Puertos de acceso general con 802.1X (PCs, portátiles)
|
|
# # Autenticación: 802.1X → MAB → VLAN GUEST si falla RADIUS
|
|
# # La VLAN final la asigna Okta dinámicamente; vlan=100 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "1-20"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos designados para impresoras (sin 802.1X)
|
|
# # VLAN asignada estáticamente en el puerto - las Group Policies en switches no asignan VLAN
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "21-24"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos designados para APs (sin 802.1X)
|
|
# # Igual que impresoras: VLAN fija en el puerto
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "25-27"
|
|
# type = "access"
|
|
# vlan = 108 # APs - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puerto de uplink (trunk, sin autenticación)
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "28"
|
|
# type = "trunk"
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_port_configs = []
|
|
|
|
# --- PUERTOS DE STACK ---
|
|
# Terraform resuelve automáticamente los seriales de todos los miembros del stack.
|
|
# El stack_name debe coincidir exactamente con el nombre en Dashboard > Switches > Stacks.
|
|
# Terraform aplicará el mismo port_range a CADA switch del stack (ambos de 48 puertos).
|
|
#
|
|
# Ejemplo para bnc01-lab-stack01 (2x 48 puertos):
|
|
# switch_stack_port_configs = [
|
|
#
|
|
# # Puertos 1-44: acceso general con 802.1X (PCs, portátiles)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "1-44"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos 45-46: impresoras (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "45-46"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos 47-48: APs (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "47-48"
|
|
# type = "access"
|
|
# vlan = 108 # APs
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_stack_port_configs = [
|
|
{
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "6"
|
|
type = "access"
|
|
vlan = 101 # GUEST
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 44: ISP router (acceso WAN)
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "44"
|
|
name = "ISP router 1"
|
|
type = "access"
|
|
vlan = 111 # WAN
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 45: WAN1 del MX primary
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "45"
|
|
name = "WAN 1 BCN01-F04-MX01"
|
|
type = "access"
|
|
vlan = 111 # WAN
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 46: WAN1 del MX spare
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "46"
|
|
name = "WAN 1 BCN01-F04-MX02"
|
|
type = "access"
|
|
vlan = 111 # WAN
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 47: uplink LAN del MX primary
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "47"
|
|
name = "UPLINK LAN BCN01-F04-MX01"
|
|
type = "trunk"
|
|
vlan = 109 # MANAGEMENT - VLAN nativa (untagged)
|
|
allowed_vlans = "all"
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puerto 48: uplink LAN del MX spare
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "48"
|
|
name = "UPLINK LAN BCN01-F04-MX02"
|
|
type = "trunk"
|
|
vlan = 109 # MANAGEMENT - VLAN nativa (untagged)
|
|
allowed_vlans = "all"
|
|
access_policy_type = "Open"
|
|
},
|
|
]
|
|
|
|
# Puertos de un switch concreto (miembro individual del stack)
|
|
# El serial se encuentra en: Dashboard > Switches > eqt-lab-st01-sw01 > Overview
|
|
switch_named_port_configs = [
|
|
{
|
|
# Puerto 1 de eqt-lab-st01-sw01 → VLAN SERVERS (estática, sin autenticación)
|
|
switch_name = "eqt-lab-st01-sw01"
|
|
port_range = "1"
|
|
name = "Servers"
|
|
type = "access"
|
|
vlan = 101 # SERVERS
|
|
access_policy_type = "Open"
|
|
},
|
|
{
|
|
# Puertos 2 y 3 de eqt-lab-st01-sw01 → APs (trunk, nativa 108 APs, tageadas 100 ACCESS y 101 GUEST)
|
|
switch_name = "eqt-lab-st01-sw01"
|
|
port_range = "2,3"
|
|
name = "AP"
|
|
type = "trunk"
|
|
vlan = 108 # APs - VLAN nativa (untagged)
|
|
allowed_vlans = "100,101,108" # ACCESS + GUEST + APs
|
|
access_policy_type = "Open"
|
|
},
|
|
]
|
|
|
|
# VLAN de gestión de los switches del site
|
|
switch_management_vlan = 109
|
|
|
|
# Interfaces L3 en el stack para acceso de gestión al Dashboard de Meraki
|
|
stack_routing_interfaces = [
|
|
{
|
|
stack_name = "bcn01-lab-stack01"
|
|
name = "MANAGEMENT"
|
|
vlan_id = 109
|
|
ip_address = "10.2.55.2"
|
|
subnet = "10.2.55.0/24"
|
|
default_gateway = "10.2.55.1"
|
|
dns1 = "8.8.8.8"
|
|
dns2 = "8.8.4.4"
|
|
},
|
|
]
|