You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
100 lines
3.6 KiB
100 lines
3.6 KiB
# Deploy Hybrid Fase 2 — PCC + Netwatch + check-gateway |
|
# Usage: .\scripts\apply-hybrid-mikrotik.ps1 |
|
# .\scripts\apply-hybrid-mikrotik.ps1 -DryRun |
|
# Restore Fase 1 jika gagal: .\scripts\restore-failover-phase1-mikrotik.ps1 |
|
# |
|
# PENTING: Default SSH ke 192.168.0.1 (office gateway) agar tidak putus saat import. |
|
|
|
param( |
|
[string]$HostAddr = "192.168.0.1", |
|
[string]$MgmtLaptopIp = "192.168.0.33", |
|
[switch]$DryRun |
|
) |
|
|
|
$SshPort = 255 |
|
$SshUser = "admin" |
|
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik" |
|
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-hybrid.rsc" |
|
$RscRemote = "hybrid.rsc" |
|
|
|
$SshBase = @( |
|
"-o", "BatchMode=yes", |
|
"-o", "ConnectTimeout=15", |
|
"-o", "IdentitiesOnly=yes", |
|
"-i", $KeyFile, |
|
"-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa", |
|
"-o", "StrictHostKeyChecking=accept-new", |
|
"-m", "hmac-sha1", |
|
"-p", $SshPort, |
|
"${SshUser}@${HostAddr}" |
|
) |
|
|
|
function Invoke-Mikrotik { |
|
param([string]$Cmd) |
|
if ($DryRun) { Write-Host "[dry-run] $Cmd"; return $true } |
|
$out = & ssh @SshBase $Cmd 2>&1 |
|
foreach ($line in $out) { Write-Host $line } |
|
return ($LASTEXITCODE -eq 0) |
|
} |
|
|
|
Write-Host "=== Apply Hybrid Mikrotik (Fase 2) ===" |
|
Write-Host "SSH target : ${SshUser}@${HostAddr}:${SshPort}" |
|
Write-Host "Mgmt bypass: $MgmtLaptopIp (hybrid mgmt bypass laptop)" |
|
Write-Host "Restore : .\scripts\restore-failover-phase1-mikrotik.ps1" |
|
Write-Host "" |
|
Write-Host "CHECKLIST sebelum lanjut:" |
|
Write-Host " [1] Failover Fase 1 aktif (cek mikrotik-failover-phase1-backup.txt)" |
|
Write-Host " [2] Laptop terhubung Ethernet office ($MgmtLaptopIp)" |
|
Write-Host " [3] Buka sesi SSH KEDUA ke 192.168.0.1 (cadangan)" |
|
Write-Host " [4] Aktifkan Safe Mode di Winbox/SSH (opsional, disarankan)" |
|
Write-Host " [5] Siapkan restore-failover-phase1 jika gagal" |
|
Write-Host "" |
|
|
|
if (-not $DryRun) { |
|
Write-Host "--- Pre-flight: tes SSH ---" |
|
if (-not (Invoke-Mikrotik "/system identity print")) { |
|
throw "SSH ke $HostAddr gagal — gunakan 192.168.0.1 dari jaringan office" |
|
} |
|
|
|
$rscContent = Get-Content $RscLocal -Raw |
|
if ($MgmtLaptopIp -ne "192.168.0.33" -and $rscContent -match "192.168.0.33") { |
|
Write-Warning "IP laptop di hybrid.rsc masih 192.168.0.33 — edit file atau set -MgmtLaptopIp" |
|
} |
|
|
|
Write-Host "`n--- Fase 0: Backup pre-hybrid ---" |
|
Invoke-Mikrotik "/export file=pre-hybrid-backup" | Out-Null |
|
|
|
Write-Host "`n--- Upload & import hybrid.rsc ---" |
|
& scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new ` |
|
-i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote" |
|
if ($LASTEXITCODE -ne 0) { throw "SCP gagal" } |
|
|
|
$importOut = & ssh @SshBase "/import file=$RscRemote" 2>&1 |
|
foreach ($line in $importOut) { Write-Host $line } |
|
if ($importOut -match "error|failure|expected") { |
|
throw "Import hybrid gagal — jalankan: .\scripts\restore-failover-phase1-mikrotik.ps1" |
|
} |
|
Invoke-Mikrotik "/file remove $RscRemote" | Out-Null |
|
|
|
Start-Sleep -Seconds 3 |
|
} |
|
|
|
Write-Host "`n=== Verifikasi ===" |
|
@( |
|
"/ip firewall mangle print where comment=`"hybrid mgmt bypass laptop`"", |
|
'/ip route print detail where dst-address=0.0.0.0/0', |
|
'/routing rule print', |
|
'/ip firewall mangle print where comment~"hybrid"', |
|
'/tool netwatch print', |
|
'/system script print where name~"hybrid"', |
|
'/ping 8.8.8.8 count=3', |
|
'/ping 10.100.1.24 count=2', |
|
'/ping 192.168.0.1 count=2' |
|
) | ForEach-Object { |
|
Write-Host "--- $_ ---" |
|
Invoke-Mikrotik $_ | Out-Null |
|
Write-Host "" |
|
} |
|
|
|
Write-Host "Selesai." |
|
Write-Host "Jika gagal: .\scripts\restore-failover-phase1-mikrotik.ps1 -HostAddr $HostAddr"
|
|
|