Meraki Firewall Policy (Terraform)

Overview

This repository manages centralized L3 firewall policies for Cisco Meraki MX using Terraform. It does not create organizations, networks, or sites. Terraform is the single source of truth for firewall rules.

Key Points

• Centralized firewall policy management across Meraki MX networks
• One final rule list per network_id
• No manual changes in the Meraki Dashboard (they will be overwritten)

How It Works

For each site (network_id), Terraform:

1. Merges rules:
   • header (global)
   • middle (country-specific, optional)
   • footer (final default rules)
2. Filters each rule via include / exclude targeting
3. Builds one final list of rules
4. Sends it to Meraki in a single API call

Project Structure

terraform/ inventory_sites.tf inventory_groups.tf firewall_rules_header.tf firewall_rules_middle.tf firewall_rules_footer.tf firewall_build.tf apply_firewall.tf providers.tf

Inventory

terraform/inventory_sites.tf is the single source of truth for sites:

• site_code
• country
• network_id

From this, groups are automatically generated:

• all
• country groups (US, DE, ...)

terraform/inventory_groups.tf defines only custom groups (no countries).

Example:

custom_groups = {
  LAB     = ["US-NYC-01"]
  US_CORE = ["US-NYC-01", "US-SFO-01"]
}

Final groups = auto groups + custom groups.

Firewall Rules

terraform/firewall_rules_header.tf Global rules for all sites (DNS, NTP, etc.).

terraform/firewall_rules_middle.tf Country-specific rules. The file may be empty (no country rules is valid).

terraform/firewall_rules_footer.tf Footer rules such as default deny, always at the end.

Rule Targeting (include / exclude)

Each rule has its own targeting filter.

Examples (always use Any):

# all sites
include = { type = "all", value = null }

# single group (auto country group)
include = { type = "group", value = "US" }

# multiple groups
include = { type = "group", value = ["US", "DE"] }

# single site
include = { type = "sites", value = "US-NYC-01" }

# multiple sites
include = { type = "sites", value = ["US-NYC-01", "US-SFO-01"] }

# exclude a group
exclude = { type = "group", value = "LAB" }

# exclude a site
exclude = { type = "sites", value = ["US-NYC-01"] }

Supported types:

• all – all sites in inventory
• group – group list from inventory
• sites – list of site_code

The filter is applied per rule (not globally).

Builder

terraform/firewall_build.tf

• merges rules: header -> middle -> footer
• filters them via include / exclude
• builds a final rule list per network_id

Apply to Meraki

terraform/apply_firewall.tf

• one resource per network_id
• one rule list
• one API call

Usage

cd terraform
terraform init
terraform plan
terraform apply

Generating Inventory from Meraki

get_network_ids.sh can generate a sites_generated.txt file with network IDs from the Meraki API. The output file is gitignored.

Security Notes

• Manual changes in the Meraki Dashboard will be overwritten.
• Keep API keys out of Git and use MERAKI_DASHBOARD_API_KEY.