meraki_nat – Manage NAT rules in Meraki cloud

New in version 2.9.

Synopsis

• Allows for creation, management, and visibility of NAT rules (1:1, 1:many, port forwarding) within Meraki.

Parameters

Parameter			Choices/Defaults	Comments
auth_key string / required				Authentication key provided by the dashboard. Required if environmental variable MERAKI_KEY is not set.
host string			Default: "api.meraki.com"	Hostname for Meraki dashboard. Can be used to access regional Meraki environments, such as China.
internal_error_retry_time integer			Default: 60	Number of seconds to retry if server returns an internal server error.
net_id string				ID number of a network.
net_name string				Name of a network. aliases: name, network
one_to_many list				List of 1:many NAT rules.
	port_rules list			List of associated port rules.
		allowed_ips list		Remote IP addresses or ranges that are permitted to access the internal resource via this port forwarding rule, or 'any'.
		local_ip string		Local IP address to which traffic will be forwarded.
		local_port string		Destination port of the forwarded traffic that will be sent from the MX to the specified host on the LAN. If you simply wish to forward the traffic without translating the port, this should be the same as the Public port.
		name string		A description of the rule.
		protocol string	Choices: tcp udp	Protocol to apply NAT rule to.
		public_port string		Destination port of the traffic that is arriving on the WAN.
	public_ip string			The IP address that will be used to access the internal resource from the WAN.
	uplink string		Choices: both internet1 internet2	The physical WAN interface on which the traffic will arrive.
one_to_one list				List of 1:1 NAT rules.
	allowed_inbound list			The ports this mapping will provide access on, and the remote IPs that will be allowed access to the resource.
		allowed_ips list		ranges of WAN IP addresses that are allowed to make inbound connections on the specified ports or port ranges, or 'any'.
		destination_ports list		List of ports or port ranges that will be forwarded to the host on the LAN.
		protocol string	Choices: any ← icmp-ping tcp udp	Protocol to apply NAT rule to.
	lan_ip string			The IP address of the server or device that hosts the internal resource that you wish to make available on the WAN.
	name string			A descriptive name for the rule.
	public_ip string			The IP address that will be used to access the internal resource from the WAN.
	uplink -		Choices: both internet1 internet2	The physical WAN interface on which the traffic will arrive.
org_id string				ID of organization associated to a network.
org_name string				Name of organization. aliases: organization
output_format string			Choices: snakecase ← camelcase	Instructs module whether response keys should be snake case (ex. net_id) or camel case (ex. netId).
output_level string			Choices: debug normal ←	Set amount of debug output during module execution.
port_forwarding list				List of port forwarding rules.
	allowed_ips -			List of ranges of WAN IP addresses that are allowed to make inbound connections on the specified ports or port ranges (or any).
	lan_ip string			The IP address of the server or device that hosts the internal resource that you wish to make available on the WAN.
	local_port string			A port or port ranges that will receive the forwarded traffic from the WAN.
	name string			A descriptive name for the rule.
	protocol string		Choices: tcp udp	Protocol to forward traffic for.
	public_port string			A port or port ranges that will be forwarded to the host on the LAN.
	uplink string		Choices: both internet1 internet2	The physical WAN interface on which the traffic will arrive.
rate_limit_retry_time integer			Default: 165	Number of seconds to retry if rate limiter is triggered.
state string			Choices: present ← query	Create or modify an organization.
subset list			Choices: 1:1 1:many all ← port_forwarding	Specifies which NAT components to query.
timeout integer			Default: 30	Time to timeout for HTTP requests.
use_https boolean			Choices: no yes ←	If no, it will use HTTP. Otherwise it will use HTTPS. Only useful for internal Meraki developers.
use_proxy boolean			Choices: no yes	If no, it will not use a proxy, even if one is defined in an environment variable on the target hosts.
validate_certs boolean			Choices: no yes ←	Whether to validate HTTP certificates.

Notes

Note

• More information about the Meraki API can be found at https://dashboard.meraki.com/api_docs.
• Some of the options are likely only used for developers within Meraki.
• As of Ansible 2.9, Meraki modules output keys as snake case. To use camel case, set the ANSIBLE_MERAKI_FORMAT environment variable to camelcase.
• Ansible’s Meraki modules will stop supporting camel case output in Ansible 2.13. Please update your playbooks.

Examples

- name: Query all NAT rules
  meraki_nat:
    auth_key: abc123
    org_name: YourOrg
    net_name: YourNet
    state: query
    subset: all
  delegate_to: localhost

- name: Query 1:1 NAT rules
  meraki_nat:
    auth_key: abc123
    org_name: YourOrg
    net_name: YourNet
    state: query
    subset: '1:1'
  delegate_to: localhost

- name: Create 1:1 rule
  meraki_nat:
    auth_key: abc123
    org_name: YourOrg
    net_name: YourNet
    state: present
    one_to_one:
      - name: Service behind NAT
        public_ip: 1.2.1.2
        lan_ip: 192.168.128.1
        uplink: internet1
        allowed_inbound:
          - protocol: tcp
            destination_ports:
              - 80
            allowed_ips:
              - 10.10.10.10
  delegate_to: localhost

- name: Create 1:many rule
  meraki_nat:
    auth_key: abc123
    org_name: YourOrg
    net_name: YourNet
    state: present
    one_to_many:
      - public_ip: 1.1.1.1
        uplink: internet1
        port_rules:
          - name: Test rule
            protocol: tcp
            public_port: 10
            local_ip: 192.168.128.1
            local_port: 11
            allowed_ips:
              - any
  delegate_to: localhost

- name: Create port forwarding rule
  meraki_nat:
    auth_key: abc123
    org_name: YourOrg
    net_name: YourNet
    state: present
    port_forwarding:
      - name: Test map
        lan_ip: 192.168.128.1
        uplink: both
        protocol: tcp
        allowed_ips:
          - 1.1.1.1
        public_port: 10
        local_port: 11
  delegate_to: localhost

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key					Returned	Description
data complex					success	Information about the created or manipulated object.
	one_to_many complex				success, when 1:many NAT object is in task	Information about 1:many NAT object.
		rules complex			success, when 1:many NAT object is in task	List of 1:many NAT rules.
			portRules complex		success, when 1:many NAT object is in task	List of NAT port rules.
				allowedIps list	success, when 1:1 NAT object is in task	List of IP addresses to be forwarded.
				localIp string	success, when 1:1 NAT object is in task	Local IP address traffic will be forwarded.
				localPort integer	success, when 1:1 NAT object is in task	Destination port to be forwarded to.
				name string	success, when 1:many NAT object is in task	Name of NAT object.
				protocol string	success, when 1:1 NAT object is in task	Protocol to apply NAT rule to.
				publicPort integer	success, when 1:1 NAT object is in task	Destination port of the traffic that is arriving on WAN.
			publicIp string		success, when 1:many NAT object is in task	Public IP address to be mapped.
			uplink string		success, when 1:many NAT object is in task	Internet port where rule is applied.
	one_to_one complex				success, when 1:1 NAT object is in task	Information about 1:1 NAT object.
		rules complex			success, when 1:1 NAT object is in task	List of 1:1 NAT rules.
			allowedInbound complex		success, when 1:1 NAT object is in task	List of inbound forwarding rules.
				allowedIps list	success, when 1:1 NAT object is in task	List of IP addresses to be forwarded.
				destinationPorts string	success, when 1:1 NAT object is in task	Ports to apply NAT rule to.
				protocol string	success, when 1:1 NAT object is in task	Protocol to apply NAT rule to.
			lanIp string		success, when 1:1 NAT object is in task	Local IP address to be mapped.
			name string		success, when 1:1 NAT object is in task	Name of NAT object.
			publicIp string		success, when 1:1 NAT object is in task	Public IP address to be mapped.
			uplink string		success, when 1:1 NAT object is in task	Internet port where rule is applied.
	port_forwarding complex				success, when port forwarding is in task	Information about port forwarding rules.
		rules complex			success, when port forwarding is in task	List of port forwarding rules.
			allowedIps list		success, when port forwarding is in task	List of IP addresses to be forwarded.
			lanIp string		success, when port forwarding is in task	Local IP address to be mapped.
			localPort integer		success, when port forwarding is in task	Destination port to be forwarded to.
			name string		success, when port forwarding is in task	Name of NAT object.
			protocol string		success, when port forwarding is in task	Protocol to apply NAT rule to.
			publicPort integer		success, when port forwarding is in task	Destination port of the traffic that is arriving on WAN.
			uplink string		success, when port forwarding is in task	Internet port where rule is applied.

Status

• This module is not guaranteed to have a backwards compatible interface. [preview]
• This module is maintained by the Ansible Community. [community]

Authors

• Kevin Breit (@kbreit)

Hint

If you notice any issues in this documentation, you can edit this document to improve it.