DESAIN FAILOVER MIKROTIK — GEONET (BELUM DIEKSEKUSI)
====================================================
Tanggal desain  : 2026-06-13
Router          : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1
Baseline aktif  : server/existing-network-geonet.txt (single-ISP)
Tujuan          : ISP2 mengambil alih otomatis saat ISP1 down — BUKAN load-balance PCC

Status: FASE 1 DITERAPKAN & TERVERIFIKASI — 2026-06-13
Backup restore point: server/mikrotik-failover-phase1-backup.txt


1. PERBEDAAN DENGAN DUAL-WAN PCC (YANG SUDAH DICOBA)
----------------------------------------------------

| Aspek              | PCC (dual-wan lama)        | Failover (desain ini)        |
|--------------------|----------------------------|------------------------------|
| Tujuan             | Bagi beban 50/50           | Backup saat ISP1 mati        |
| Satu download cepat| Tidak                      | Tidak (tetap satu ISP aktif) |
| ISP2 down + PCC on | ~50% traffic gagal         | Tidak terjadi (hanya 1 route aktif) |
| Deteksi ISP mati   | Tidak ada                  | check-gateway=ping           |
| Kompleksitas       | Mangle + routing-mark      | 2 default route + NAT        |


2. TOPOLOGI FISIK
-----------------

                    INTERNET
                        |
          +-------------+-------------+
          |                           |
    [ ISP 1 — statis ]          [ ISP 2 — DHCP ]
    117.102.73.96/29            modem 192.168.1.0/24
    GW 117.102.73.97              GW 192.168.1.1
          |                           |
       ether1                   sfp-sfpplus1
          |                           |
          +───────────┬───────────────┘
                      |
              [ MikroTik CCR2004 ]
              10.100.1.1 / 192.168.0.1
                      |
        +-------------+-------------+
        |             |             |
   bridge server  bridge office  bridge vpn
   10.100.1.0/24  192.168.0.0/24 100.100.1.0/24
        |             |
   server infra    user kantor


3. DIAGRAM — KONDISI NORMAL (ISP1 SEHAT)
----------------------------------------

```mermaid
flowchart TB
  subgraph users [User]
    OFF[Office 192.168.0.x]
    VPN[VPN 100.100.1.x]
  end

  subgraph mt [MikroTik]
    RT[Routing main table]
    NAT[NAT masquerade]
  end

  subgraph wan [WAN]
    ISP1[ISP1 ether1<br/>117.102.73.97<br/>distance=1 ACTIVE]
    ISP2[ISP2 sfp-sfpplus1<br/>192.168.1.1<br/>distance=2 STANDBY]
  end

  subgraph srv [Server LAN]
    SRV[10.100.1.0/24]
  end

  OFF --> RT
  VPN --> RT
  SRV --> RT
  RT -->|semua traffic keluar| NAT
  NAT --> ISP1
  ISP2 -.->|tidak dipakai| NAT

  INBOUND[Internet inbound<br/>dst-nat 117.102.73.x] --> ISP1
  ISP1 --> SRV
```

Traffic keluar:
  - Satu default route aktif → ISP1 (distance 1)
  - Route ISP2 ada tapi tidak dipilih (distance 2)
  - NAT masquerade via ether1 (IP publik 117.102.73.x)


4. DIAGRAM — KONDISI FAILOVER (ISP1 DOWN)
-----------------------------------------

```mermaid
flowchart TB
  subgraph users [User]
    OFF[Office 192.168.0.x]
    VPN[VPN 100.100.1.x]
  end

  subgraph mt [MikroTik]
    RT[Routing main table]
    CG[check-gateway<br/>ISP1 route INACTIVE]
    NAT[NAT masquerade]
  end

  subgraph wan [WAN]
    ISP1[ISP1 ether1<br/>GW tidak pingable<br/>distance=1 INACTIVE]
    ISP2[ISP2 sfp-sfpplus1<br/>192.168.1.1<br/>distance=2 ACTIVE]
  end

  subgraph srv [Server LAN]
    SRV[10.100.1.0/24]
  end

  CG -.-> ISP1
  OFF --> RT
  VPN --> RT
  SRV --> RT
  RT --> NAT
  NAT --> ISP2

  INBOUND[Internet inbound<br/>117.102.73.x] -.->|TIDAK MASUK| ISP1
```

Perilaku failover:
  1. MikroTik ping gateway ISP1 (117.102.73.97) secara berkala
  2. Jika gagal → route ISP1 ditandai inactive
  3. Route backup ISP2 (distance 2) otomatis dipakai
  4. NAT masquerade out-interface=sfp-sfpplus1 mengeluarkan traffic user
  5. User kantor & VPN internet kembali jalan (IP keluar = IP publik ISP2)

Recovery otomatis:
  - Saat ISP1 hidup kembali → route distance 1 aktif lagi → traffic kembali ke ISP1


5. APA YANG FAILOVER — APA YANG TIDAK
-------------------------------------

FAILOVER OTOMATIS (desain ini):
  [x] Internet user kantor 192.168.0.x
  [x] Internet user VPN 100.100.1.x
  [x] Routing internal office ↔ server (tidak terpengaruh — tetap lokal)

TIDAK FAILOVER (batasan teknis):
  [ ] Layanan publik inbound (dst-nat) ke 117.102.73.x
      → IP publik melekat di ether1; ISP2 tidak punya IP tersebut
      → Saat ISP1 down: gisportal.id / geonet.co.id TIDAK bisa diakses dari internet
  [ ] Server 10.100.1.x akses internet langsung (jika pakai ether1)
      → Bisa tetap di ISP1 only; saat ISP1 down server tidak keluar internet
      → Rekomendasi: server infra tetap pakai ISP1; user yang di-failover
  [ ] Hairpin NAT (office → domain publik internal)
      → Bergantung ether1; perlu rule tambahan jika ingin hairpin saat failover
  [ ] Kecepatan = ISP1 + ISP2 digabung
      → Bukan desain ini; hanya satu ISP aktif pada satu waktu


6. KOMPONEN KONFIGURASI (RENCANA)
---------------------------------

F1. Interface & DHCP ISP2
  /interface ethernet set sfp-sfpplus1 disabled=no
  /ip dhcp-client set [find interface=sfp-sfpplus1] \
      add-default-route=no use-peer-dns=no disabled=no

  Catatan: add-default-route=no — default route ditambah manual dengan check-gateway,
  agar kontrol failover di tangan admin (bukan DHCP otomatis).

F2. Default routes dengan check-gateway (routing-table main)

  Route PRIMARY (ISP1):
    dst-address=0.0.0.0/0
    gateway=117.102.73.97
    interface=ether1
    distance=1
    check-gateway=ping
    comment=failover ISP1 primary

  Route BACKUP (ISP2):
    dst-address=0.0.0.0/0
    gateway=192.168.1.1
    interface=sfp-sfpplus1
    distance=2
    check-gateway=ping
    comment=failover ISP2 backup

  Jika route lama tanpa check-gateway sudah ada, UPDATE route existing —
  jangan duplikasi 0.0.0.0/0.

F3. NAT (sudah ada di baseline — verifikasi saja)
  masquerade out-interface=ether1        — untuk kondisi normal
  masquerade out-interface=sfp-sfpplus1  — untuk kondisi failover
  masquerade catch-all (rule #2)         — tetap enabled sebagai cadangan

F4. Yang TIDAK ditambahkan
  - Tidak ada mangle PCC
  - Tidak ada routing-mark / routing rule dual-wan
  - Tidak ada per-connection-classifier
  - Tabel KE ISP 1 / KE ISP 2 tidak dipakai untuk failover user

F5. Opsional — Netwatch (lapisan kedua)
  Jika check-gateway saja kurang (ISP1 link up tapi internet mati):
    /tool netwatch add host=8.8.8.8 interval=30s timeout=3s \
      up-script="" down-script="..." comment=failover monitor ISP1

  Disarankan fase 2 setelah check-gateway terbukti cukup.


7. ALUR KEPUTUSAN ROUTING (STATE MACHINE)
-----------------------------------------

```mermaid
stateDiagram-v2
  [*] --> ISP1_Active: Router boot / ISP1 GW pingable
  ISP1_Active --> ISP2_Active: GW 117.102.73.97 tidak pingable
  ISP2_Active --> ISP1_Active: GW 117.102.73.97 pingable lagi

  state ISP1_Active {
    [*] --> Route1: distance=1 ACTIVE
    Route1 --> NAT1: masquerade ether1
  }

  state ISP2_Active {
    [*] --> Route2: distance=2 ACTIVE
    Route2 --> NAT2: masquerade sfp-sfpplus1
  }
```


8. PRA-SYARAT SEBELUM EKSEKUSI
------------------------------

  [ ] ISP2 fisik aktif: kabel SFP+ terpasang, link UP
  [ ] DHCP sfp-sfpplus1 bound (dapat IP, mis. 192.168.1.52/24)
  [ ] Gateway ISP2 192.168.1.1 pingable dari Mikrotik
  [ ] Internet via ISP2 terbukti: /ping 8.8.8.8 routing-table=main (saat ISP1 route disabled manual test)
  [ ] Backup config: /export file=pre-failover-backup
  [ ] Stakeholder paham: layanan publik 117.102.73.x TIDAK failover ke ISP2
  [ ] Jadwal maintenance: siang hari, siap rollback ke existing-network-geonet


9. TAHAP EKSEKUSI (NANTI)
-------------------------

Fase 0 — Backup
  .\scripts\ssh-mikrotik.ps1 -Command "/export file=pre-failover-backup"

Fase 1 — Aktifkan ISP2 (tanpa ubah route utama)
  Enable sfp-sfpplus1 + dhcp-client
  Verifikasi IP & ping 192.168.1.1

Fase 2 — Tambah route backup
  Tambah 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping
  Belum ubah route ISP1

Fase 3 — Aktifkan check-gateway pada route ISP1
  Set check-gateway=ping pada route 117.102.73.97 distance=1
  Verifikasi kedua route terlihat di /ip route print detail

Fase 4 — Tes failover terkontrol
  a) Simulasi: disable ether1 sementara ATAU block ping ke GW (lab)
  b) Dari laptop kantor: ping 8.8.8.8 harus OK via ISP2
  c) Restore ether1: traffic kembali ke ISP1
  d) Tes office → 10.100.1.x tetap OK di kedua kondisi

Fase 5 — Dokumentasi
  Update existing-network-geonet.txt jika failover jadi produksi


10. ROLLBACK
------------

Jika gagal / tidak stabil:
  .\scripts\rollback-single-wan-mikrotik.ps1

Atau manual:
  Hapus route backup failover
  Hapus check-gateway dari route ISP1
  Disable sfp-sfpplus1 + dhcp-client
  Kembali ke baseline existing-network-geonet.txt


11. RISIKO & MITIGASI
---------------------

| Risiko                              | Dampak              | Mitigasi                          |
|-------------------------------------|---------------------|-----------------------------------|
| Flapping ISP1 (on/off cepat)        | Internet putus-nyambung | check-gateway interval; Netwatch |
| ISP2 dapat IP tapi tidak internet  | Failover gagal total | Tes fase 1 wajib sebelum fase 3   |
| dst-nat mati saat ISP1 down         | Layanan publik down | Ekspektasi jelas; monitor Zabbix  |
| Route duplikat 0.0.0.0/0            | Routing kacau       | Audit /ip route sebelum apply     |
| Server keluar internet saat failover| Backup DB gagal     | Server tetap ISP1-only (default)  |


12. FILE EKSEKUSI
-----------------

  server/mikrotik-failover.rsc           — config import (DITERAPKAN)
  scripts/apply-failover-mikrotik.ps1    — deploy + verifikasi
  (rollback: scripts/rollback-single-wan-mikrotik.ps1)


13. REFERENSI
-------------

  server/existing-network-geonet.txt   — baseline produksi saat ini
  server/mikrotik-audit.txt            — audit lengkap
  server/mikrotik-dual-wan.rsc         — PCC (JANGAN dipakai untuk failover)
  server/mikrotik-failover-design.txt  — dokumen ini
  server/mikrotik-hybrid-design.txt    — lanjutan: failover + PCC + Netwatch
