You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
310 lines
10 KiB
310 lines
10 KiB
DESAIN FAILOVER MIKROTIK — GEONET (BELUM DIEKSEKUSI) |
|
==================================================== |
|
Tanggal desain : 2026-06-13 |
|
Router : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1 |
|
Baseline aktif : server/existing-network-geonet.txt (single-ISP) |
|
Tujuan : ISP2 mengambil alih otomatis saat ISP1 down — BUKAN load-balance PCC |
|
|
|
Status: FASE 1 DITERAPKAN & TERVERIFIKASI — 2026-06-13 |
|
Backup restore point: server/mikrotik-failover-phase1-backup.txt |
|
|
|
|
|
1. PERBEDAAN DENGAN DUAL-WAN PCC (YANG SUDAH DICOBA) |
|
---------------------------------------------------- |
|
|
|
| Aspek | PCC (dual-wan lama) | Failover (desain ini) | |
|
|--------------------|----------------------------|------------------------------| |
|
| Tujuan | Bagi beban 50/50 | Backup saat ISP1 mati | |
|
| Satu download cepat| Tidak | Tidak (tetap satu ISP aktif) | |
|
| ISP2 down + PCC on | ~50% traffic gagal | Tidak terjadi (hanya 1 route aktif) | |
|
| Deteksi ISP mati | Tidak ada | check-gateway=ping | |
|
| Kompleksitas | Mangle + routing-mark | 2 default route + NAT | |
|
|
|
|
|
2. TOPOLOGI FISIK |
|
----------------- |
|
|
|
INTERNET |
|
| |
|
+-------------+-------------+ |
|
| | |
|
[ ISP 1 — statis ] [ ISP 2 — DHCP ] |
|
117.102.73.96/29 modem 192.168.1.0/24 |
|
GW 117.102.73.97 GW 192.168.1.1 |
|
| | |
|
ether1 sfp-sfpplus1 |
|
| | |
|
+───────────┬───────────────┘ |
|
| |
|
[ MikroTik CCR2004 ] |
|
10.100.1.1 / 192.168.0.1 |
|
| |
|
+-------------+-------------+ |
|
| | | |
|
bridge server bridge office bridge vpn |
|
10.100.1.0/24 192.168.0.0/24 100.100.1.0/24 |
|
| | |
|
server infra user kantor |
|
|
|
|
|
3. DIAGRAM — KONDISI NORMAL (ISP1 SEHAT) |
|
---------------------------------------- |
|
|
|
```mermaid |
|
flowchart TB |
|
subgraph users [User] |
|
OFF[Office 192.168.0.x] |
|
VPN[VPN 100.100.1.x] |
|
end |
|
|
|
subgraph mt [MikroTik] |
|
RT[Routing main table] |
|
NAT[NAT masquerade] |
|
end |
|
|
|
subgraph wan [WAN] |
|
ISP1[ISP1 ether1<br/>117.102.73.97<br/>distance=1 ACTIVE] |
|
ISP2[ISP2 sfp-sfpplus1<br/>192.168.1.1<br/>distance=2 STANDBY] |
|
end |
|
|
|
subgraph srv [Server LAN] |
|
SRV[10.100.1.0/24] |
|
end |
|
|
|
OFF --> RT |
|
VPN --> RT |
|
SRV --> RT |
|
RT -->|semua traffic keluar| NAT |
|
NAT --> ISP1 |
|
ISP2 -.->|tidak dipakai| NAT |
|
|
|
INBOUND[Internet inbound<br/>dst-nat 117.102.73.x] --> ISP1 |
|
ISP1 --> SRV |
|
``` |
|
|
|
Traffic keluar: |
|
- Satu default route aktif → ISP1 (distance 1) |
|
- Route ISP2 ada tapi tidak dipilih (distance 2) |
|
- NAT masquerade via ether1 (IP publik 117.102.73.x) |
|
|
|
|
|
4. DIAGRAM — KONDISI FAILOVER (ISP1 DOWN) |
|
----------------------------------------- |
|
|
|
```mermaid |
|
flowchart TB |
|
subgraph users [User] |
|
OFF[Office 192.168.0.x] |
|
VPN[VPN 100.100.1.x] |
|
end |
|
|
|
subgraph mt [MikroTik] |
|
RT[Routing main table] |
|
CG[check-gateway<br/>ISP1 route INACTIVE] |
|
NAT[NAT masquerade] |
|
end |
|
|
|
subgraph wan [WAN] |
|
ISP1[ISP1 ether1<br/>GW tidak pingable<br/>distance=1 INACTIVE] |
|
ISP2[ISP2 sfp-sfpplus1<br/>192.168.1.1<br/>distance=2 ACTIVE] |
|
end |
|
|
|
subgraph srv [Server LAN] |
|
SRV[10.100.1.0/24] |
|
end |
|
|
|
CG -.-> ISP1 |
|
OFF --> RT |
|
VPN --> RT |
|
SRV --> RT |
|
RT --> NAT |
|
NAT --> ISP2 |
|
|
|
INBOUND[Internet inbound<br/>117.102.73.x] -.->|TIDAK MASUK| ISP1 |
|
``` |
|
|
|
Perilaku failover: |
|
1. MikroTik ping gateway ISP1 (117.102.73.97) secara berkala |
|
2. Jika gagal → route ISP1 ditandai inactive |
|
3. Route backup ISP2 (distance 2) otomatis dipakai |
|
4. NAT masquerade out-interface=sfp-sfpplus1 mengeluarkan traffic user |
|
5. User kantor & VPN internet kembali jalan (IP keluar = IP publik ISP2) |
|
|
|
Recovery otomatis: |
|
- Saat ISP1 hidup kembali → route distance 1 aktif lagi → traffic kembali ke ISP1 |
|
|
|
|
|
5. APA YANG FAILOVER — APA YANG TIDAK |
|
------------------------------------- |
|
|
|
FAILOVER OTOMATIS (desain ini): |
|
[x] Internet user kantor 192.168.0.x |
|
[x] Internet user VPN 100.100.1.x |
|
[x] Routing internal office ↔ server (tidak terpengaruh — tetap lokal) |
|
|
|
TIDAK FAILOVER (batasan teknis): |
|
[ ] Layanan publik inbound (dst-nat) ke 117.102.73.x |
|
→ IP publik melekat di ether1; ISP2 tidak punya IP tersebut |
|
→ Saat ISP1 down: gisportal.id / geonet.co.id TIDAK bisa diakses dari internet |
|
[ ] Server 10.100.1.x akses internet langsung (jika pakai ether1) |
|
→ Bisa tetap di ISP1 only; saat ISP1 down server tidak keluar internet |
|
→ Rekomendasi: server infra tetap pakai ISP1; user yang di-failover |
|
[ ] Hairpin NAT (office → domain publik internal) |
|
→ Bergantung ether1; perlu rule tambahan jika ingin hairpin saat failover |
|
[ ] Kecepatan = ISP1 + ISP2 digabung |
|
→ Bukan desain ini; hanya satu ISP aktif pada satu waktu |
|
|
|
|
|
6. KOMPONEN KONFIGURASI (RENCANA) |
|
--------------------------------- |
|
|
|
F1. Interface & DHCP ISP2 |
|
/interface ethernet set sfp-sfpplus1 disabled=no |
|
/ip dhcp-client set [find interface=sfp-sfpplus1] \ |
|
add-default-route=no use-peer-dns=no disabled=no |
|
|
|
Catatan: add-default-route=no — default route ditambah manual dengan check-gateway, |
|
agar kontrol failover di tangan admin (bukan DHCP otomatis). |
|
|
|
F2. Default routes dengan check-gateway (routing-table main) |
|
|
|
Route PRIMARY (ISP1): |
|
dst-address=0.0.0.0/0 |
|
gateway=117.102.73.97 |
|
interface=ether1 |
|
distance=1 |
|
check-gateway=ping |
|
comment=failover ISP1 primary |
|
|
|
Route BACKUP (ISP2): |
|
dst-address=0.0.0.0/0 |
|
gateway=192.168.1.1 |
|
interface=sfp-sfpplus1 |
|
distance=2 |
|
check-gateway=ping |
|
comment=failover ISP2 backup |
|
|
|
Jika route lama tanpa check-gateway sudah ada, UPDATE route existing — |
|
jangan duplikasi 0.0.0.0/0. |
|
|
|
F3. NAT (sudah ada di baseline — verifikasi saja) |
|
masquerade out-interface=ether1 — untuk kondisi normal |
|
masquerade out-interface=sfp-sfpplus1 — untuk kondisi failover |
|
masquerade catch-all (rule #2) — tetap enabled sebagai cadangan |
|
|
|
F4. Yang TIDAK ditambahkan |
|
- Tidak ada mangle PCC |
|
- Tidak ada routing-mark / routing rule dual-wan |
|
- Tidak ada per-connection-classifier |
|
- Tabel KE ISP 1 / KE ISP 2 tidak dipakai untuk failover user |
|
|
|
F5. Opsional — Netwatch (lapisan kedua) |
|
Jika check-gateway saja kurang (ISP1 link up tapi internet mati): |
|
/tool netwatch add host=8.8.8.8 interval=30s timeout=3s \ |
|
up-script="" down-script="..." comment=failover monitor ISP1 |
|
|
|
Disarankan fase 2 setelah check-gateway terbukti cukup. |
|
|
|
|
|
7. ALUR KEPUTUSAN ROUTING (STATE MACHINE) |
|
----------------------------------------- |
|
|
|
```mermaid |
|
stateDiagram-v2 |
|
[*] --> ISP1_Active: Router boot / ISP1 GW pingable |
|
ISP1_Active --> ISP2_Active: GW 117.102.73.97 tidak pingable |
|
ISP2_Active --> ISP1_Active: GW 117.102.73.97 pingable lagi |
|
|
|
state ISP1_Active { |
|
[*] --> Route1: distance=1 ACTIVE |
|
Route1 --> NAT1: masquerade ether1 |
|
} |
|
|
|
state ISP2_Active { |
|
[*] --> Route2: distance=2 ACTIVE |
|
Route2 --> NAT2: masquerade sfp-sfpplus1 |
|
} |
|
``` |
|
|
|
|
|
8. PRA-SYARAT SEBELUM EKSEKUSI |
|
------------------------------ |
|
|
|
[ ] ISP2 fisik aktif: kabel SFP+ terpasang, link UP |
|
[ ] DHCP sfp-sfpplus1 bound (dapat IP, mis. 192.168.1.52/24) |
|
[ ] Gateway ISP2 192.168.1.1 pingable dari Mikrotik |
|
[ ] Internet via ISP2 terbukti: /ping 8.8.8.8 routing-table=main (saat ISP1 route disabled manual test) |
|
[ ] Backup config: /export file=pre-failover-backup |
|
[ ] Stakeholder paham: layanan publik 117.102.73.x TIDAK failover ke ISP2 |
|
[ ] Jadwal maintenance: siang hari, siap rollback ke existing-network-geonet |
|
|
|
|
|
9. TAHAP EKSEKUSI (NANTI) |
|
------------------------- |
|
|
|
Fase 0 — Backup |
|
.\scripts\ssh-mikrotik.ps1 -Command "/export file=pre-failover-backup" |
|
|
|
Fase 1 — Aktifkan ISP2 (tanpa ubah route utama) |
|
Enable sfp-sfpplus1 + dhcp-client |
|
Verifikasi IP & ping 192.168.1.1 |
|
|
|
Fase 2 — Tambah route backup |
|
Tambah 0.0.0.0/0 → 192.168.1.1 distance=2 check-gateway=ping |
|
Belum ubah route ISP1 |
|
|
|
Fase 3 — Aktifkan check-gateway pada route ISP1 |
|
Set check-gateway=ping pada route 117.102.73.97 distance=1 |
|
Verifikasi kedua route terlihat di /ip route print detail |
|
|
|
Fase 4 — Tes failover terkontrol |
|
a) Simulasi: disable ether1 sementara ATAU block ping ke GW (lab) |
|
b) Dari laptop kantor: ping 8.8.8.8 harus OK via ISP2 |
|
c) Restore ether1: traffic kembali ke ISP1 |
|
d) Tes office → 10.100.1.x tetap OK di kedua kondisi |
|
|
|
Fase 5 — Dokumentasi |
|
Update existing-network-geonet.txt jika failover jadi produksi |
|
|
|
|
|
10. ROLLBACK |
|
------------ |
|
|
|
Jika gagal / tidak stabil: |
|
.\scripts\rollback-single-wan-mikrotik.ps1 |
|
|
|
Atau manual: |
|
Hapus route backup failover |
|
Hapus check-gateway dari route ISP1 |
|
Disable sfp-sfpplus1 + dhcp-client |
|
Kembali ke baseline existing-network-geonet.txt |
|
|
|
|
|
11. RISIKO & MITIGASI |
|
--------------------- |
|
|
|
| Risiko | Dampak | Mitigasi | |
|
|-------------------------------------|---------------------|-----------------------------------| |
|
| Flapping ISP1 (on/off cepat) | Internet putus-nyambung | check-gateway interval; Netwatch | |
|
| ISP2 dapat IP tapi tidak internet | Failover gagal total | Tes fase 1 wajib sebelum fase 3 | |
|
| dst-nat mati saat ISP1 down | Layanan publik down | Ekspektasi jelas; monitor Zabbix | |
|
| Route duplikat 0.0.0.0/0 | Routing kacau | Audit /ip route sebelum apply | |
|
| Server keluar internet saat failover| Backup DB gagal | Server tetap ISP1-only (default) | |
|
|
|
|
|
12. FILE EKSEKUSI |
|
----------------- |
|
|
|
server/mikrotik-failover.rsc — config import (DITERAPKAN) |
|
scripts/apply-failover-mikrotik.ps1 — deploy + verifikasi |
|
(rollback: scripts/rollback-single-wan-mikrotik.ps1) |
|
|
|
|
|
13. REFERENSI |
|
------------- |
|
|
|
server/existing-network-geonet.txt — baseline produksi saat ini |
|
server/mikrotik-audit.txt — audit lengkap |
|
server/mikrotik-dual-wan.rsc — PCC (JANGAN dipakai untuk failover) |
|
server/mikrotik-failover-design.txt — dokumen ini |
|
server/mikrotik-hybrid-design.txt — lanjutan: failover + PCC + Netwatch
|
|
|