MIKROTIK FAILOVER FASE 1 — BACKUP PRODUKSI (TERVERIFIKASI) ========================================================== Tanggal backup : 2026-06-13 Status : AKTIF & BERFUNGSI — jangan ubah sebelum Fase 2 Hybrid Router : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1 Tujuan dokumen : Restore point jika Fase 2 (Hybrid PCC+Netwatch) gagal >>> Gunakan restore ini untuk kembali ke Fase 1, BUKAN rollback single-ISP <<< (kecuali ingin hapus failover sepenuhnya) 1. RINGKASAN KONFIGURASI FASE 1 ------------------------------- Mode: Failover otomatis ISP1 → ISP2 (check-gateway=ping) BUKAN load-balance PCC. | Komponen | Nilai produksi | |-----------------------|-----------------------------------------| | ISP1 WAN | ether1, GW 117.102.73.97 | | ISP2 WAN | sfp-sfpplus1, DHCP 192.168.1.52/24 | | ISP2 GW | 192.168.1.1 | | Route primary | main, distance=1, check-gateway=ping | | Route backup | main, distance=2, check-gateway=ping | | Mangle PCC / hybrid | TIDAK ADA | | Routing rules | TIDAK ADA (dual-wan/hybrid dihapus) | | NAT catch-all #2 | ENABLED | 2. SNAPSHOT LIVE (2026-06-13) ----------------------------- Interface: ether1 : RUNNING (ISP1) sfp-sfpplus1 : RUNNING (ISP2 standby) DHCP client ISP2: interface=sfp-sfpplus1 status=bound address=192.168.1.52/24 gateway=192.168.1.1 add-default-route=no use-peer-dns=no Routes 0.0.0.0/0: [ACTIVE] failover ISP1 primary → 117.102.73.97%ether1 distance=1 check-gateway=ping [STANDBY] failover ISP2 backup → 192.168.1.1%sfp-sfpplus1 distance=2 check-gateway=ping [legacy] KE ISP 2 table → 192.168.1.1 (tidak dipakai failover user) Mangle aktif: hanya rule load-balance lama — semua DISABLED (X) Routing rules: kosong NAT srcnat: #0 masquerade out-interface=ether1 #1 masquerade out-interface=sfp-sfpplus1 #2 masquerade catch-all (enabled) #3-#5 Hairpin NAT office → 10.100.1.24 3. VERIFIKASI SUDAH DILAKUKAN ----------------------------- | Tes | Hasil | |----------------------------------|-------| | Ping 8.8.8.8 dari Mikrotik | OK | | Ping 192.168.1.1 (GW ISP2) | OK | | DHCP ISP2 bound | OK | | Simulasi failover (disable ISP1) | Internet OK via ISP2 | | Recovery enable ISP1 | Kembali ke ISP1 | | Laptop → 10.100.1.x | OK | | Laptop → 8.8.8.8 | OK | | Office ↔ server routing | OK | 4. FILE BACKUP -------------- | File | Lokasi | Keterangan | |------|--------|------------| | backup-failover-phase1.rsc | server/ (repo) | Export penuh dari router | | backup-failover-phase1.rsc | router Mikrotik | /file print — di perangkat | | pre-failover-backup.rsc | router Mikrotik | Sebelum apply Fase 1 | | mikrotik-failover.rsc | server/ | Config minimal deploy Fase 1 | | mikrotik-restore-failover-phase1.rsc | server/ | Restore setelah Hybrid gagal | Download ulang export dari router: scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \ admin@10.100.1.1:backup-failover-phase1.rsc server/ 5. RESTORE SETELAH FASE 2 GAGAL ------------------------------- Gejala Fase 2 gagal: - Internet putus-putus (~50% loss) → PCC aktif saat ISP down - Office tidak bisa ke 10.100.1.x → mangle PCC tanpa bypass - Routing kacau → routing-mark / Netwatch error Langkah restore ke Fase 1 (RECOMMENDED): .\scripts\restore-failover-phase1-mikrotik.ps1 Manual: /import file=restore-failover-phase1.rsc Verifikasi setelah restore: /ip route print detail where dst-address=0.0.0.0/0 /ip firewall mangle print where comment~"hybrid" → harus kosong /routing rule print → harus kosong /ping 8.8.8.8 count=3 /ping 10.100.1.10 count=2 Tes dari laptop kantor: ping 8.8.8.8 ping 10.100.1.1 ping 10.100.1.10 6. ROLLBACK KE SINGLE-ISP (HANYA JIKA PERLU) -------------------------------------------- Hapus failover sepenuhnya — kembali ke baseline awal audit: .\scripts\rollback-single-wan-mikrotik.ps1 Acuan: server/existing-network-geonet.txt (versi single-ISP) 7. PERINTAH CONFIG FASE 1 (REFERENSI CEPAT) ------------------------------------------- /interface ethernet set sfp-sfpplus1 disabled=no /ip dhcp-client set [find interface=sfp-sfpplus1] add-default-route=no use-peer-dns=no disabled=no /ip route set [find dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main] distance=1 check-gateway=ping comment="failover ISP1 primary" /ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main distance=2 check-gateway=ping comment="failover ISP2 backup" 8. YANG TIDAK BOLEH BERUBAH SAAT FASE 2 --------------------------------------- Pertahankan dari Fase 1: - Route failover main table (distance 1 + 2, check-gateway) - NAT masquerade ether1 + sfp-sfpplus1 + catch-all - Hairpin NAT ke 10.100.1.24 - dst-nat publik 117.102.73.x - Tidak ada PCC aktif tanpa Netwatch health check Fase 2 Hybrid MENAMBAH (bukan mengganti): - Mangle PCC + bypass office→server - Routing rules KE ISP 1/2 - Netwatch + script mode 9. REFERENSI ------------ server/mikrotik-failover-phase1-backup.txt ← dokumen ini server/mikrotik-failover.rsc server/mikrotik-restore-failover-phase1.rsc server/backup-failover-phase1.rsc ← export router server/mikrotik-failover-design.txt server/mikrotik-hybrid-design.txt ← Fase 2 (belum dieksekusi) server/mikrotik-hybrid-apply-checklist.txt ← checklist apply aman Fase 2 server/existing-network-geonet.txt scripts/apply-failover-mikrotik.ps1 scripts/restore-failover-phase1-mikrotik.ps1 scripts/rollback-single-wan-mikrotik.ps1