Jose MartinezandClaude Sonnet 4.6
67268df12d
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
123 lines
4.0 KiB
HCL
123 lines
4.0 KiB
HCL
# Configuración de switches MS - BCN01-LAB
|
|
# El shared secret de RADIUS se pasa via TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)
|
|
|
|
# --- POLÍTICAS DE ACCESO 802.1X ---
|
|
switch_access_policies = [
|
|
{
|
|
name = "DOT1X-CORPO"
|
|
access_policy_type = "Hybrid authentication"
|
|
host_mode = "Multi-Auth"
|
|
radius_accounting_enabled = false
|
|
radius_re_authentication_interval = 0
|
|
url_redirect_walled_garden_enabled = false
|
|
|
|
# VLAN a la que cae el puerto si el RADIUS no responde
|
|
radius_failed_auth_vlan_id = 101 # GUEST
|
|
|
|
radius_servers = [
|
|
{
|
|
host = "15.15.15.15"
|
|
port = 1912
|
|
}
|
|
]
|
|
}
|
|
]
|
|
|
|
# --- PUERTOS DE SWITCH ---
|
|
# El serial aparece en Dashboard > Switches > nombre del switch > Overview.
|
|
# access_policy_number: número auto-asignado por Meraki a la política creada arriba
|
|
# (visible en Dashboard > Switches > Switch settings > Access policies)
|
|
#
|
|
# Ejemplo con los tres tipos de puerto:
|
|
# switch_port_configs = [
|
|
#
|
|
# # Puertos de acceso general con 802.1X (PCs, portátiles)
|
|
# # Autenticación: 802.1X → MAB → VLAN GUEST si falla RADIUS
|
|
# # La VLAN final la asigna Okta dinámicamente; vlan=100 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "1-20"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos designados para impresoras (sin 802.1X)
|
|
# # VLAN asignada estáticamente en el puerto - las Group Policies en switches no asignan VLAN
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "21-24"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos designados para APs (sin 802.1X)
|
|
# # Igual que impresoras: VLAN fija en el puerto
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "25-27"
|
|
# type = "access"
|
|
# vlan = 108 # APs - VLAN fija en el puerto
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puerto de uplink (trunk, sin autenticación)
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "28"
|
|
# type = "trunk"
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_port_configs = []
|
|
|
|
# --- PUERTOS DE STACK ---
|
|
# Terraform resuelve automáticamente los seriales de todos los miembros del stack.
|
|
# El stack_name debe coincidir exactamente con el nombre en Dashboard > Switches > Stacks.
|
|
# Terraform aplicará el mismo port_range a CADA switch del stack (ambos de 48 puertos).
|
|
#
|
|
# Ejemplo para bnc01-lab-stack01 (2x 48 puertos):
|
|
# switch_stack_port_configs = [
|
|
#
|
|
# # Puertos 1-44: acceso general con 802.1X (PCs, portátiles)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "1-44"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos 45-46: impresoras (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "45-46"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos 47-48: APs (VLAN fija, sin 802.1X)
|
|
# {
|
|
# stack_name = "bnc01-lab-stack01"
|
|
# port_range = "47-48"
|
|
# type = "access"
|
|
# vlan = 108 # APs
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_stack_port_configs = [
|
|
{
|
|
stack_name = "bcn01-lab-stack01"
|
|
port_range = "6"
|
|
type = "access"
|
|
vlan = 101 # GUEST
|
|
access_policy_type = "Open"
|
|
},
|
|
]
|