You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
96 lines
3.2 KiB
96 lines
3.2 KiB
# Failover Mikrotik Fase 1 — ISP1 primary, ISP2 backup (check-gateway) |
|
# Usage: .\scripts\apply-failover-mikrotik.ps1 |
|
# .\scripts\apply-failover-mikrotik.ps1 -DryRun |
|
# .\scripts\apply-failover-mikrotik.ps1 -TestFailover # tes singkat failover |
|
|
|
param( |
|
[string]$HostAddr = "10.100.1.1", |
|
[switch]$DryRun, |
|
[switch]$TestFailover |
|
) |
|
|
|
$SshPort = 255 |
|
$SshUser = "admin" |
|
$KeyFile = Join-Path $env:USERPROFILE ".ssh\id_rsa_mikrotik" |
|
$RscLocal = Join-Path (Split-Path $PSScriptRoot -Parent) "server\mikrotik-failover.rsc" |
|
$RscRemote = "failover.rsc" |
|
|
|
$SshBase = @( |
|
"-o", "BatchMode=yes", |
|
"-o", "ConnectTimeout=15", |
|
"-o", "IdentitiesOnly=yes", |
|
"-i", $KeyFile, |
|
"-o", "PubkeyAcceptedAlgorithms=rsa-sha2-256,rsa-sha2-512,ssh-rsa", |
|
"-o", "StrictHostKeyChecking=accept-new", |
|
"-m", "hmac-sha1", |
|
"-p", $SshPort, |
|
"${SshUser}@${HostAddr}" |
|
) |
|
|
|
function Invoke-Mikrotik { |
|
param([string]$Cmd) |
|
if ($DryRun) { |
|
Write-Host "[dry-run] $Cmd" |
|
return $true |
|
} |
|
$out = & ssh @SshBase $Cmd 2>&1 |
|
foreach ($line in $out) { Write-Host $line } |
|
return ($LASTEXITCODE -eq 0) |
|
} |
|
|
|
Write-Host "=== Apply Failover Mikrotik (Fase 1) ===" |
|
Write-Host "Target: $HostAddr" |
|
|
|
if (-not $DryRun) { |
|
Write-Host "`n--- Fase 0: Backup config ---" |
|
if (-not (Invoke-Mikrotik "/export file=pre-failover-backup")) { |
|
throw "Backup export gagal" |
|
} |
|
|
|
Write-Host "`n--- Fase 1-3: Upload & import failover.rsc ---" |
|
& scp -P $SshPort -o MACs=hmac-sha1 -o StrictHostKeyChecking=accept-new ` |
|
-i $KeyFile $RscLocal "${SshUser}@${HostAddr}:$RscRemote" |
|
if ($LASTEXITCODE -ne 0) { throw "SCP gagal" } |
|
|
|
if (-not (Invoke-Mikrotik "/import file=$RscRemote")) { |
|
throw "Import failover gagal" |
|
} |
|
Invoke-Mikrotik "/file remove $RscRemote" | Out-Null |
|
|
|
Write-Host "`n--- Tunggu DHCP ISP2 (max 30s) ---" |
|
$bound = $false |
|
for ($i = 0; $i -lt 6; $i++) { |
|
Start-Sleep -Seconds 5 |
|
$dhcp = & ssh @SshBase '/ip dhcp-client print detail where interface=sfp-sfpplus1' 2>&1 |
|
if ($dhcp -match 'status=bound') { $bound = $true; break } |
|
Write-Host " ... menunggu DHCP ($($i+1)/6)" |
|
} |
|
if (-not $bound) { Write-Warning "DHCP ISP2 belum bound — cek kabel/modem ISP2" } |
|
} |
|
|
|
Write-Host "`n=== Verifikasi ===" |
|
$checks = @( |
|
'/interface ethernet print where name=sfp-sfpplus1', |
|
'/ip dhcp-client print where interface=sfp-sfpplus1', |
|
'/ping 192.168.1.1 count=3', |
|
'/ip route print detail where dst-address=0.0.0.0/0', |
|
'/ip firewall nat print where chain=srcnat', |
|
'/ping 8.8.8.8 count=3' |
|
) |
|
foreach ($c in $checks) { |
|
Write-Host "--- $c ---" |
|
Invoke-Mikrotik $c | Out-Null |
|
Write-Host "" |
|
} |
|
|
|
if ($TestFailover -and -not $DryRun) { |
|
Write-Host "=== Tes failover terkontrol (disable route ISP1 sementara) ===" |
|
Invoke-Mikrotik '/ip route disable [find comment="failover ISP1 primary"]' | Out-Null |
|
Start-Sleep -Seconds 3 |
|
Write-Host "--- Ping internet via ISP2 ---" |
|
Invoke-Mikrotik '/ping 8.8.8.8 count=3' | Out-Null |
|
Invoke-Mikrotik '/ip route enable [find comment="failover ISP1 primary"]' | Out-Null |
|
Write-Host "Route ISP1 di-enable kembali." |
|
} |
|
|
|
Write-Host "Selesai. Rollback: .\scripts\rollback-single-wan-mikrotik.ps1"
|
|
|