- AnsibleFest
- Products
- Community
- Webinars & Training
- Blog

Documentation

# meraki_mr_l3_firewall – Manage MR access point layer 3 firewalls in the Meraki cloud

New in version 2.7.

- Synopsis
- Parameters
- Notes
- Examples
- Status

## Synopsis

- Allows for creation, management, and visibility into layer 3 firewalls implemented on Meraki MR access points.
- Module is not idempotent as of current release.

## Parameters

Parameter | Choices/Defaults | Comments
--- | --- | ---
allow_lan_access boolean | Choices: no yes ← | Sets whether devices can talk to other devices on the same LAN.
auth_key string / required |  | Authentication key provided by the dashboard. Required if environmental variable `MERAKI_KEY` is not set.
host string | Default: "api.meraki.com" | Hostname for Meraki dashboard. Can be used to access regional Meraki environments, such as China.
internal_error_retry_time integer | Default: 60 | Number of seconds to retry if server returns an internal server error.
net_id string |  | ID of network containing access points.
net_name string |  | Name of network containing access points.
number integer |  | Number of SSID to apply firewall rule to. aliases: ssid_number
org_id string |  | ID of organization.
org_name string |  | Name of organization. aliases: organization
output_format string | Choices: snakecase ← camelcase | Instructs module whether response keys should be snake case (ex. `net_id`) or camel case (ex. `netId`).
output_level string | Choices: debug normal ← | Set amount of debug output during module execution.
rate_limit_retry_time integer | Default: 165 | Number of seconds to retry if rate limiter is triggered.
rules list |  | List of firewall rules.
| comment string |  | Optional comment describing the firewall rule.
| dest_cidr string |  | Comma-separated list of CIDR notation networks to match.
| dest_port string |  | Comma-seperated list of destination ports to match.
| policy string | Choices: allow deny | Specifies the action that should be taken when rule is hit.
| protocol string | Choices: any icmp tcp udp | Specifies protocol to match against.
ssid_name string |  | Name of SSID to apply firewall rule to. aliases: ssid
state string | Choices: present ← query | Create or modify an organization.
timeout integer | Default: 30 | Time to timeout for HTTP requests.
use_https boolean | Choices: no yes ← | If `no`, it will use HTTP. Otherwise it will use HTTPS. Only useful for internal Meraki developers.
use_proxy boolean | Choices: no yes | If `no`, it will not use a proxy, even if one is defined in an environment variable on the target hosts.
validate_certs boolean | Choices: no yes ← | Whether to validate HTTP certificates.

## Notes

Note

- More information about the Meraki API can be found at https://dashboard.meraki.com/api_docs.
- Some of the options are likely only used for developers within Meraki.
- As of Ansible 2.9, Meraki modules output keys as snake case. To use camel case, set the `ANSIBLE_MERAKI_FORMAT` environment variable to `camelcase`.
- Ansible’s Meraki modules will stop supporting camel case output in Ansible 2.13. Please update your playbooks.

## Examples

    - name: Create single firewall rule
      meraki_mr_l3_firewall:
        auth_key: abc123
        state: present
        org_name: YourOrg
        net_id: 12345
        number: 1
        rules:
          - comment: Integration test rule
            policy: allow
            protocol: tcp
            dest_port: 80
            dest_cidr: 192.0.2.0/24
        allow_lan_access: no
      delegate_to: localhost

    - name: Enable local LAN access
      meraki_mr_l3_firewall:
        auth_key: abc123
        state: present
        org_name: YourOrg
        net_id: 123
        number: 1
        rules:
        allow_lan_access: yes
      delegate_to: localhost

    - name: Query firewall rules
      meraki_mr_l3_firewall:
        auth_key: abc123
        state: query
        org_name: YourOrg
        net_name: YourNet
        number: 1
      delegate_to: localhost

## Status

- This module is not guaranteed to have a backwards compatible interface. [preview]
- This module is maintained by the Ansible Community. [community]

### Authors

- Kevin Breit (@kbreit)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.