Jose MartinezandClaude Sonnet 4.6
711dfa79bf
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
76 lines
2.6 KiB
HCL
76 lines
2.6 KiB
HCL
# Configuración de switches MS - BCN01-LAB
|
|
# El shared secret de RADIUS se pasa via TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)
|
|
|
|
# --- POLÍTICAS DE ACCESO 802.1X ---
|
|
switch_access_policies = [
|
|
{
|
|
name = "DOT1X-CORPO"
|
|
access_policy_type = "Hybrid authentication"
|
|
host_mode = "Multi-Auth"
|
|
radius_accounting_enabled = false
|
|
radius_re_authentication_interval = 0
|
|
url_redirect_walled_garden_enabled = false
|
|
|
|
# VLAN a la que cae el puerto si el RADIUS no responde
|
|
radius_failed_auth_vlan_id = 101 # GUEST
|
|
|
|
radius_servers = [
|
|
{
|
|
host = "15.15.15.15"
|
|
port = 1912
|
|
}
|
|
]
|
|
}
|
|
]
|
|
|
|
# --- PUERTOS DE SWITCH ---
|
|
# El serial aparece en Dashboard > Switches > nombre del switch > Overview.
|
|
# access_policy_number: número auto-asignado por Meraki a la política creada arriba
|
|
# (visible en Dashboard > Switches > Switch settings > Access policies)
|
|
#
|
|
# Ejemplo con los tres tipos de puerto:
|
|
# switch_port_configs = [
|
|
#
|
|
# # Puertos de acceso general con 802.1X (PCs, portátiles)
|
|
# # Autenticación: 802.1X → MAB → VLAN GUEST si falla RADIUS
|
|
# # La VLAN final la asigna Okta dinámicamente; vlan=100 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "1-20"
|
|
# type = "access"
|
|
# vlan = 100 # ACCESS - fallback si Okta no devuelve VLAN
|
|
# access_policy_type = "Custom access policy"
|
|
# access_policy_number = 1 # id de la política DOT1X-CORPO
|
|
# },
|
|
#
|
|
# # Puertos designados para impresoras (sin 802.1X)
|
|
# # La VLAN la asigna Meraki Group Policy por MAC; vlan=103 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "21-24"
|
|
# type = "access"
|
|
# vlan = 103 # PRINTERS - fallback si la MAC no tiene Group Policy
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puertos designados para APs (sin 802.1X)
|
|
# # Igual que impresoras: Open + Group Policy por MAC; vlan=108 es el fallback estático
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "25-27"
|
|
# type = "access"
|
|
# vlan = 108 # APs - fallback si la MAC no tiene Group Policy
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# # Puerto de uplink (trunk, sin autenticación)
|
|
# {
|
|
# serial = "XXXX-XXXX-XXXX"
|
|
# port_range = "28"
|
|
# type = "trunk"
|
|
# access_policy_type = "Open"
|
|
# },
|
|
#
|
|
# ]
|
|
switch_port_configs = []
|