MIKROTIK FAILOVER FASE 1 — BACKUP PRODUKSI (TERVERIFIKASI)
==========================================================
Tanggal backup    : 2026-06-13
Status            : AKTIF & BERFUNGSI — jangan ubah sebelum Fase 2 Hybrid
Router            : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1
Tujuan dokumen    : Restore point jika Fase 2 (Hybrid PCC+Netwatch) gagal

>>> Gunakan restore ini untuk kembali ke Fase 1, BUKAN rollback single-ISP <<<
    (kecuali ingin hapus failover sepenuhnya)


1. RINGKASAN KONFIGURASI FASE 1
-------------------------------

Mode: Failover otomatis ISP1 → ISP2 (check-gateway=ping)
BUKAN load-balance PCC.

| Komponen              | Nilai produksi                          |
|-----------------------|-----------------------------------------|
| ISP1 WAN              | ether1, GW 117.102.73.97                |
| ISP2 WAN              | sfp-sfpplus1, DHCP 192.168.1.52/24      |
| ISP2 GW               | 192.168.1.1                             |
| Route primary         | main, distance=1, check-gateway=ping  |
| Route backup          | main, distance=2, check-gateway=ping  |
| Mangle PCC / hybrid   | TIDAK ADA                               |
| Routing rules         | TIDAK ADA (dual-wan/hybrid dihapus)     |
| NAT catch-all #2      | ENABLED                                 |


2. SNAPSHOT LIVE (2026-06-13)
-----------------------------

Interface:
  ether1         : RUNNING (ISP1)
  sfp-sfpplus1   : RUNNING (ISP2 standby)

DHCP client ISP2:
  interface=sfp-sfpplus1
  status=bound address=192.168.1.52/24
  gateway=192.168.1.1
  add-default-route=no use-peer-dns=no

Routes 0.0.0.0/0:
  [ACTIVE] failover ISP1 primary → 117.102.73.97%ether1 distance=1 check-gateway=ping
  [STANDBY] failover ISP2 backup  → 192.168.1.1%sfp-sfpplus1 distance=2 check-gateway=ping
  [legacy] KE ISP 2 table → 192.168.1.1 (tidak dipakai failover user)

Mangle aktif: hanya rule load-balance lama — semua DISABLED (X)
Routing rules: kosong

NAT srcnat:
  #0 masquerade out-interface=ether1
  #1 masquerade out-interface=sfp-sfpplus1
  #2 masquerade catch-all (enabled)
  #3-#5 Hairpin NAT office → 10.100.1.24


3. VERIFIKASI SUDAH DILAKUKAN
-----------------------------

| Tes                              | Hasil |
|----------------------------------|-------|
| Ping 8.8.8.8 dari Mikrotik       | OK    |
| Ping 192.168.1.1 (GW ISP2)       | OK    |
| DHCP ISP2 bound                  | OK    |
| Simulasi failover (disable ISP1) | Internet OK via ISP2 |
| Recovery enable ISP1             | Kembali ke ISP1 |
| Laptop → 10.100.1.x              | OK    |
| Laptop → 8.8.8.8                 | OK    |
| Office ↔ server routing          | OK    |


4. FILE BACKUP
--------------

| File | Lokasi | Keterangan |
|------|--------|------------|
| backup-failover-phase1.rsc | server/ (repo) | Export penuh dari router |
| backup-failover-phase1.rsc | router Mikrotik | /file print — di perangkat |
| pre-failover-backup.rsc | router Mikrotik | Sebelum apply Fase 1 |
| mikrotik-failover.rsc | server/ | Config minimal deploy Fase 1 |
| mikrotik-restore-failover-phase1.rsc | server/ | Restore setelah Hybrid gagal |

Download ulang export dari router:
  scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \
      admin@10.100.1.1:backup-failover-phase1.rsc server/


5. RESTORE SETELAH FASE 2 GAGAL
-------------------------------

Gejala Fase 2 gagal:
  - Internet putus-putus (~50% loss) → PCC aktif saat ISP down
  - Office tidak bisa ke 10.100.1.x → mangle PCC tanpa bypass
  - Routing kacau → routing-mark / Netwatch error

Langkah restore ke Fase 1 (RECOMMENDED):

  .\scripts\restore-failover-phase1-mikrotik.ps1

Manual:
  /import file=restore-failover-phase1.rsc

Verifikasi setelah restore:
  /ip route print detail where dst-address=0.0.0.0/0
  /ip firewall mangle print where comment~"hybrid"    → harus kosong
  /routing rule print                                  → harus kosong
  /ping 8.8.8.8 count=3
  /ping 10.100.1.10 count=2

Tes dari laptop kantor:
  ping 8.8.8.8
  ping 10.100.1.1
  ping 10.100.1.10


6. ROLLBACK KE SINGLE-ISP (HANYA JIKA PERLU)
--------------------------------------------

Hapus failover sepenuhnya — kembali ke baseline awal audit:

  .\scripts\rollback-single-wan-mikrotik.ps1

Acuan: server/existing-network-geonet.txt (versi single-ISP)


7. PERINTAH CONFIG FASE 1 (REFERENSI CEPAT)
-------------------------------------------

/interface ethernet set sfp-sfpplus1 disabled=no
/ip dhcp-client set [find interface=sfp-sfpplus1] add-default-route=no use-peer-dns=no disabled=no
/ip route set [find dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main] distance=1 check-gateway=ping comment="failover ISP1 primary"
/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main distance=2 check-gateway=ping comment="failover ISP2 backup"


8. YANG TIDAK BOLEH BERUBAH SAAT FASE 2
---------------------------------------

Pertahankan dari Fase 1:
  - Route failover main table (distance 1 + 2, check-gateway)
  - NAT masquerade ether1 + sfp-sfpplus1 + catch-all
  - Hairpin NAT ke 10.100.1.24
  - dst-nat publik 117.102.73.x
  - Tidak ada PCC aktif tanpa Netwatch health check

Fase 2 Hybrid MENAMBAH (bukan mengganti):
  - Mangle PCC + bypass office→server
  - Routing rules KE ISP 1/2
  - Netwatch + script mode


9. REFERENSI
------------

  server/mikrotik-failover-phase1-backup.txt  ← dokumen ini
  server/mikrotik-failover.rsc
  server/mikrotik-restore-failover-phase1.rsc
  server/backup-failover-phase1.rsc           ← export router
  server/mikrotik-failover-design.txt
  server/mikrotik-hybrid-design.txt           ← Fase 2 (belum dieksekusi)
  server/mikrotik-hybrid-apply-checklist.txt ← checklist apply aman Fase 2
  server/existing-network-geonet.txt
  scripts/apply-failover-mikrotik.ps1
  scripts/restore-failover-phase1-mikrotik.ps1
  scripts/rollback-single-wan-mikrotik.ps1
