Jose Martinez
c86569436b
- Management VLAN switches → 109 - Puerto 47 stack: trunk, native VLAN 109 - SVI stack bcn01-lab-stack01: VLAN 109, 10.2.55.2/24, GW 10.2.55.1 - MX puerto 7: trunk, native VLAN 109 - Firewall: allow MANAGEMENT → internet (primera regla) - Puerto 1 eqt-lab-st01-sw01: VLAN 110 (SERVERS)
45 lines
1.3 KiB
HCL
Executable File
45 lines
1.3 KiB
HCL
Executable File
# Reglas de firewall L3
|
|
firewall_rules = [
|
|
{
|
|
# Permite que los switches (VLAN MANAGEMENT) lleguen a internet para acceder al Dashboard de Meraki
|
|
comment = "Permitir MANAGEMENT a internet (acceso Dashboard Meraki)"
|
|
policy = "allow"
|
|
protocol = "any"
|
|
src_cidr = "10.2.55.0/24" # VLAN 109 - MANAGEMENT
|
|
src_port = "any"
|
|
dest_cidr = "any"
|
|
dest_port = "any"
|
|
syslog_enabled = false
|
|
},
|
|
{
|
|
comment = "Bloqueo temporal switch a 8.8.8.8"
|
|
policy = "deny"
|
|
protocol = "any"
|
|
src_cidr = "192.168.8.50/32"
|
|
src_port = "any"
|
|
dest_cidr = "8.8.8.8/32"
|
|
dest_port = "any"
|
|
syslog_enabled = false
|
|
},
|
|
{
|
|
comment = "Bloqueo especifico DNS Cloudflare 1.1.1.1 desde VC"
|
|
policy = "deny"
|
|
protocol = "any"
|
|
src_cidr = "10.2.48.0/24" # VLAN 102 - VC
|
|
src_port = "any"
|
|
dest_cidr = "1.1.1.1/32"
|
|
dest_port = "any"
|
|
syslog_enabled = false
|
|
},
|
|
{
|
|
comment = "Denegar el resto del trafico de salida"
|
|
policy = "deny"
|
|
protocol = "any"
|
|
src_cidr = "any"
|
|
src_port = "any"
|
|
dest_cidr = "any"
|
|
dest_port = "any"
|
|
syslog_enabled = false
|
|
}
|
|
]
|