You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
165 lines
5.8 KiB
165 lines
5.8 KiB
MIKROTIK FAILOVER FASE 1 — BACKUP PRODUKSI (TERVERIFIKASI) |
|
========================================================== |
|
Tanggal backup : 2026-06-13 |
|
Status : AKTIF & BERFUNGSI — jangan ubah sebelum Fase 2 Hybrid |
|
Router : MikroTik CCR2004, RouterOS 7.5, 10.100.1.1 |
|
Tujuan dokumen : Restore point jika Fase 2 (Hybrid PCC+Netwatch) gagal |
|
|
|
>>> Gunakan restore ini untuk kembali ke Fase 1, BUKAN rollback single-ISP <<< |
|
(kecuali ingin hapus failover sepenuhnya) |
|
|
|
|
|
1. RINGKASAN KONFIGURASI FASE 1 |
|
------------------------------- |
|
|
|
Mode: Failover otomatis ISP1 → ISP2 (check-gateway=ping) |
|
BUKAN load-balance PCC. |
|
|
|
| Komponen | Nilai produksi | |
|
|-----------------------|-----------------------------------------| |
|
| ISP1 WAN | ether1, GW 117.102.73.97 | |
|
| ISP2 WAN | sfp-sfpplus1, DHCP 192.168.1.52/24 | |
|
| ISP2 GW | 192.168.1.1 | |
|
| Route primary | main, distance=1, check-gateway=ping | |
|
| Route backup | main, distance=2, check-gateway=ping | |
|
| Mangle PCC / hybrid | TIDAK ADA | |
|
| Routing rules | TIDAK ADA (dual-wan/hybrid dihapus) | |
|
| NAT catch-all #2 | ENABLED | |
|
|
|
|
|
2. SNAPSHOT LIVE (2026-06-13) |
|
----------------------------- |
|
|
|
Interface: |
|
ether1 : RUNNING (ISP1) |
|
sfp-sfpplus1 : RUNNING (ISP2 standby) |
|
|
|
DHCP client ISP2: |
|
interface=sfp-sfpplus1 |
|
status=bound address=192.168.1.52/24 |
|
gateway=192.168.1.1 |
|
add-default-route=no use-peer-dns=no |
|
|
|
Routes 0.0.0.0/0: |
|
[ACTIVE] failover ISP1 primary → 117.102.73.97%ether1 distance=1 check-gateway=ping |
|
[STANDBY] failover ISP2 backup → 192.168.1.1%sfp-sfpplus1 distance=2 check-gateway=ping |
|
[legacy] KE ISP 2 table → 192.168.1.1 (tidak dipakai failover user) |
|
|
|
Mangle aktif: hanya rule load-balance lama — semua DISABLED (X) |
|
Routing rules: kosong |
|
|
|
NAT srcnat: |
|
#0 masquerade out-interface=ether1 |
|
#1 masquerade out-interface=sfp-sfpplus1 |
|
#2 masquerade catch-all (enabled) |
|
#3-#5 Hairpin NAT office → 10.100.1.24 |
|
|
|
|
|
3. VERIFIKASI SUDAH DILAKUKAN |
|
----------------------------- |
|
|
|
| Tes | Hasil | |
|
|----------------------------------|-------| |
|
| Ping 8.8.8.8 dari Mikrotik | OK | |
|
| Ping 192.168.1.1 (GW ISP2) | OK | |
|
| DHCP ISP2 bound | OK | |
|
| Simulasi failover (disable ISP1) | Internet OK via ISP2 | |
|
| Recovery enable ISP1 | Kembali ke ISP1 | |
|
| Laptop → 10.100.1.x | OK | |
|
| Laptop → 8.8.8.8 | OK | |
|
| Office ↔ server routing | OK | |
|
|
|
|
|
4. FILE BACKUP |
|
-------------- |
|
|
|
| File | Lokasi | Keterangan | |
|
|------|--------|------------| |
|
| backup-failover-phase1.rsc | server/ (repo) | Export penuh dari router | |
|
| backup-failover-phase1.rsc | router Mikrotik | /file print — di perangkat | |
|
| pre-failover-backup.rsc | router Mikrotik | Sebelum apply Fase 1 | |
|
| mikrotik-failover.rsc | server/ | Config minimal deploy Fase 1 | |
|
| mikrotik-restore-failover-phase1.rsc | server/ | Restore setelah Hybrid gagal | |
|
|
|
Download ulang export dari router: |
|
scp -P 255 -m hmac-sha1 -i %USERPROFILE%\.ssh\id_rsa_mikrotik \ |
|
admin@10.100.1.1:backup-failover-phase1.rsc server/ |
|
|
|
|
|
5. RESTORE SETELAH FASE 2 GAGAL |
|
------------------------------- |
|
|
|
Gejala Fase 2 gagal: |
|
- Internet putus-putus (~50% loss) → PCC aktif saat ISP down |
|
- Office tidak bisa ke 10.100.1.x → mangle PCC tanpa bypass |
|
- Routing kacau → routing-mark / Netwatch error |
|
|
|
Langkah restore ke Fase 1 (RECOMMENDED): |
|
|
|
.\scripts\restore-failover-phase1-mikrotik.ps1 |
|
|
|
Manual: |
|
/import file=restore-failover-phase1.rsc |
|
|
|
Verifikasi setelah restore: |
|
/ip route print detail where dst-address=0.0.0.0/0 |
|
/ip firewall mangle print where comment~"hybrid" → harus kosong |
|
/routing rule print → harus kosong |
|
/ping 8.8.8.8 count=3 |
|
/ping 10.100.1.10 count=2 |
|
|
|
Tes dari laptop kantor: |
|
ping 8.8.8.8 |
|
ping 10.100.1.1 |
|
ping 10.100.1.10 |
|
|
|
|
|
6. ROLLBACK KE SINGLE-ISP (HANYA JIKA PERLU) |
|
-------------------------------------------- |
|
|
|
Hapus failover sepenuhnya — kembali ke baseline awal audit: |
|
|
|
.\scripts\rollback-single-wan-mikrotik.ps1 |
|
|
|
Acuan: server/existing-network-geonet.txt (versi single-ISP) |
|
|
|
|
|
7. PERINTAH CONFIG FASE 1 (REFERENSI CEPAT) |
|
------------------------------------------- |
|
|
|
/interface ethernet set sfp-sfpplus1 disabled=no |
|
/ip dhcp-client set [find interface=sfp-sfpplus1] add-default-route=no use-peer-dns=no disabled=no |
|
/ip route set [find dst-address=0.0.0.0/0 gateway=117.102.73.97 routing-table=main] distance=1 check-gateway=ping comment="failover ISP1 primary" |
|
/ip route add dst-address=0.0.0.0/0 gateway=192.168.1.1 routing-table=main distance=2 check-gateway=ping comment="failover ISP2 backup" |
|
|
|
|
|
8. YANG TIDAK BOLEH BERUBAH SAAT FASE 2 |
|
--------------------------------------- |
|
|
|
Pertahankan dari Fase 1: |
|
- Route failover main table (distance 1 + 2, check-gateway) |
|
- NAT masquerade ether1 + sfp-sfpplus1 + catch-all |
|
- Hairpin NAT ke 10.100.1.24 |
|
- dst-nat publik 117.102.73.x |
|
- Tidak ada PCC aktif tanpa Netwatch health check |
|
|
|
Fase 2 Hybrid MENAMBAH (bukan mengganti): |
|
- Mangle PCC + bypass office→server |
|
- Routing rules KE ISP 1/2 |
|
- Netwatch + script mode |
|
|
|
|
|
9. REFERENSI |
|
------------ |
|
|
|
server/mikrotik-failover-phase1-backup.txt ← dokumen ini |
|
server/mikrotik-failover.rsc |
|
server/mikrotik-restore-failover-phase1.rsc |
|
server/backup-failover-phase1.rsc ← export router |
|
server/mikrotik-failover-design.txt |
|
server/mikrotik-hybrid-design.txt ← Fase 2 (belum dieksekusi) |
|
server/mikrotik-hybrid-apply-checklist.txt ← checklist apply aman Fase 2 |
|
server/existing-network-geonet.txt |
|
scripts/apply-failover-mikrotik.ps1 |
|
scripts/restore-failover-phase1-mikrotik.ps1 |
|
scripts/rollback-single-wan-mikrotik.ps1
|
|
|