ABDURROZAK
HOME ABOUT ME MICROSITE KONTAK PERSEMBAHAN HELP
ABDURROZAK.MY.ID // MIKROTIK TUTORIAL

FAILOVER MIKROTIK

RB941 hAP LITE - FAILOVER KONEKSI INTERNET LENGKAP

Panduan mendalam implementasi failover dua koneksi internet dengan MikroTik RB941. Jika ISP utama down, otomatis pindah ke ISP backup. Redundancy untuk koneksi internet yang reliable. Konfigurasi dual: CLI (Terminal) & WinBox (GUI).

SPESIFIKASI HARDWARE RB941-2nD

RB941 hAP lite cocok untuk failover dual WAN. Dengan 2 port WAN dan 2 port LAN, router ini bisa handle failover 2 ISP dengan bandwidth total sesuai ISP yang aktif.

CPU
AR9344 - 650MHz
RAM
32 MB DDR2
STORAGE
16 MB FLASH
ETHERNET
4x 10/100 Mbps
WAN PORT
2 Port (ether1, ether2)
LAN PORT
2 Port (ether3, ether4)
FAILOVER
Check Gateway Ping
MAX BW
~50-70 Mbps
POWER
5V DC / USB
OS
RouterOS v6 L4
DIMENSI
113 x 89 x 28mm
BERAT
160 gram
KEUNGGULAN FAILOVER: RB941 punya 4 port ethernet yang fleksibel. Bisa di-setup sebagai 2 WAN + 2 LAN. Jika ISP utama down, traffic otomatis pindah ke ISP backup dalam hitungan detik.
KONSEP FAILOVER FUNDAMENTAL

Failover adalah mekanisme redundancy dimana jika koneksi utama (primary) down, sistem otomatis beralih ke koneksi cadangan (backup). Berbeda dengan load balancing yang membagi traffic ke kedua ISP secara bersamaan.

FAILOVER vs LOAD BALANCING
ASPEKFAILOVERLOAD BALANCING
Status ISP1 aktif, 1 standbyKedua ISP aktif
Traffic FlowSemua traffic via ISP aktifTraffic dibagi ke kedua ISP
TujuanRedundancyMeningkatkan bandwidth
KompleksitasSimpelLebih kompleks
Failover Time~10-30 detikInstant (kedua ISP aktif)
Use CaseReliability, uptimePerformance, throughput
CARA KERJA FAILOVER
DISTANCE BASED
Route dengan distance lebih kecil (1) = primary. Distance lebih besar (2) = backup. Router pilih route dengan distance terkecil.
CHECK GATEWAY PING
Router ping gateway secara periodik. Jika gateway tidak respond, route dianggap down dan route backup aktif.
AUTOMATIC SWITCH
Jika primary down, router otomatis switch ke backup. Jika primary up lagi, otomatis kembali ke primary.
SEAMLESS FAILOVER
Failover terjadi dalam hitungan detik. User mungkin tidak menyadari ada failover (kecuali session-based app).
PENTING: Failover tidak meningkatkan bandwidth. Total bandwidth tetap sesuai ISP yang aktif. Failover hanya untuk redundancy, bukan load balancing.
TOPOLOGI JARINGAN SCHEMA
// TOPOLOGI FAILOVER DUAL WAN // [ ISP 1 - PRIMARY ] [ ISP 2 - BACKUP ] 50 Mbps 50 Mbps | | | | v v +--------------------------------------+ | MIKROTIK RB941 | | FAILOVER ROUTER | | | | ether1: WAN 1 (Primary) | | ether2: WAN 2 (Backup) | | ether3: LAN | | ether4: LAN | | | | Route 1: via ISP1 (distance 1) | | Route 2: via ISP2 (distance 2) | | Check Gateway: ping | +--------------------------------------+ | | v v [ PC / LAPTOP ] [ HP / TABLET ] 192.168.10.x 192.168.10.x FAILOVER SCENARIO: Normal: Semua traffic via ISP1 (distance 1) ISP1 Down: Traffic otomatis pindah ke ISP2 (distance 2) ISP1 Up: Traffic kembali ke ISP1 (distance 1)
FAILOVER WORKING: Router selalu pilih route dengan distance terkecil. Jika ISP1 down (gateway tidak respond), route ISP1 inactive, router pilih route ISP2. Jika ISP1 up lagi, router kembali ke ISP1.
ANIMASI FAILOVER LIVE FLOW

Visualisasi failover:正常情况下 traffic via ISP1 (hijau). Jika ISP1 down, traffic pindah ke ISP2 (amber). Animasi menunjukkan proses failover otomatis.

ISP 1 PRIMARY ISP 2 BACKUP MIKROTIK RB941 Failover Router WAN1: Primary (D=1) WAN2: Backup (D=2) LAN: ether3, ether4 CLIENT 192.168.10.10 CLIENT 192.168.10.11 // FAILOVER FLOW // GREEN = ISP1 ACTIVE | AMBER = ISP2 STANDBY | AUTO SWITCH IF ISP1 DOWN
ISP 1 (Primary - Active)
ISP 2 (Backup - Standby)
LAN Traffic
FAILOVER PROCESS: Router ping gateway ISP1 setiap beberapa detik. Jika tidak ada response, router anggap ISP1 down dan switch ke ISP2. Proses ini otomatis dan transparan untuk user.
PERSIAPAN SEBELUM KONFIGURASI STEP 01

Pastikan Anda memiliki informasi berikut sebelum konfigurasi failover:

INFORMASI ISP
ISPTIPE KONEKSIUSERNAMEPASSWORDBANDWIDTH
ISP 1 (Primary)DHCP / PPPoE / Static(jika PPPoE)(jika PPPoE)50 Mbps
ISP 2 (Backup)DHCP / PPPoE / Static(jika PPPoE)(jika PPPoE)50 Mbps
INFORMASI JARINGAN
ITEMVALUEKETERANGAN
WAN1 Interfaceether1Interface untuk ISP 1 (Primary)
WAN2 Interfaceether2Interface untuk ISP 2 (Backup)
LAN Interfaceether3, ether4Interface untuk LAN
LAN Subnet192.168.10.0/24Subnet untuk LAN
LAN Gateway192.168.10.1Gateway untuk LAN
PENTING: Pastikan kedua ISP sudah connected dan bisa akses internet secara terpisah sebelum konfigurasi failover. Test dulu satu per satu.
RESET & AKSES ROUTER STEP 02

Reset router ke factory default sebelum konfigurasi.

VIA HARDWARE
1
Tekan tombol RESET sambil colok power
2
Tunggu LED ACT berkedip (~5 detik)
3
Lepas tombol RESET
4
Akses via WinBox: MAC address
5
Login: admin / password: (kosong)
VIA WINBOX
1
Colok kabel UTP dari PC ke ether3
2
Buka WinBox
3
Tab Neighbors, klik MAC address
4
Login: admin / password: (kosong)
IDENTITY & GANTI PASSWORD STEP 03

Beri nama router dan ganti password admin.

VIA CLI
# 1. Set identity [admin@MikroTik] > /system identity set name="FAILOVER-ROUTER # 2. Ganti password admin [admin@FAILOVER-ROUTER] > /user set admin password="Rozak@Fail2024!" # 3. Verifikasi [admin@FAILOVER-ROUTER] > /user print
VIA WINBOX
1
Menu: System -> Identity
2
Name: FAILOVER-ROUTER
3
Menu: System -> Users
4
Double-click admin
5
New Password: Rozak@Fail2024!
KONFIGURASI WAN 1 (ISP 1 - PRIMARY) STEP 04

Konfigurasi ether1 sebagai WAN 1 untuk ISP 1 (Primary).

VIA CLI
# 1. Rename interface [admin@FAILOVER-ROUTER] > /interface set ether1 name="WAN1" # 2. DHCP Client (jika ISP pakai DHCP) [admin@FAILOVER-ROUTER] > /ip dhcp-client add interface=WAN1 disabled=no use-peer-dns=yes add-default-route=no # 3. PPPoE Client (jika ISP pakai PPPoE) [admin@FAILOVER-ROUTER] > /interface pppoe-client add name="pppoe-out1" interface=WAN1 user="user@isp1" password="pass1" add-default-route=no disabled=no # 4. Verifikasi [admin@FAILOVER-ROUTER] > /ip address print [admin@FAILOVER-ROUTER] > /ping 8.8.8.8
VIA WINBOX
1
Menu: Interfaces -> Rename ether1 ke WAN1
2
Menu: IP -> DHCP Client -> + Add
3
Interface: WAN1, Add Default Route: no
4
Atau: PPP -> + Add -> PPPoE Client
5
Test: Tools -> Ping -> 8.8.8.8
PENTING: Set add-default-route=no karena kita akan buat default route manual untuk failover. Jangan biarkan DHCP/PPPoE buat default route otomatis.
KONFIGURASI WAN 2 (ISP 2 - BACKUP) STEP 05

Konfigurasi ether2 sebagai WAN 2 untuk ISP 2 (Backup).

VIA CLI
# 1. Rename interface [admin@FAILOVER-ROUTER] > /interface set ether2 name="WAN2" # 2. DHCP Client [admin@FAILOVER-ROUTER] > /ip dhcp-client add interface=WAN2 disabled=no use-peer-dns=yes add-default-route=no # 3. PPPoE Client (jika perlu) [admin@FAILOVER-ROUTER] > /interface pppoe-client add name="pppoe-out2" interface=WAN2 user="user@isp2" password="pass2" add-default-route=no disabled=no # 4. Verifikasi [admin@FAILOVER-ROUTER] > /ip address print [admin@FAILOVER-ROUTER] > /ping 8.8.8.8
VIA WINBOX
1
Menu: Interfaces -> Rename ether2 ke WAN2
2
Menu: IP -> DHCP Client -> + Add
3
Interface: WAN2, Add Default Route: no
4
Test: Tools -> Ping -> 8.8.8.8
KONFIGURASI LAN STEP 06

Konfigurasi ether3 dan ether4 sebagai LAN dengan bridge.

VIA CLI
# 1. Rename interface [admin@FAILOVER-ROUTER] > /interface set ether3 name="LAN1" [admin@FAILOVER-ROUTER] > /interface set ether4 name="LAN2" # 2. Buat bridge [admin@FAILOVER-ROUTER] > /interface bridge add name="bridge-lan" # 3. Tambah port ke bridge [admin@FAILOVER-ROUTER] > /interface bridge port add bridge=bridge-lan interface=LAN1 [admin@FAILOVER-ROUTER] > /interface bridge port add bridge=bridge-lan interface=LAN2 # 4. Beri IP ke bridge [admin@FAILOVER-ROUTER] > /ip address add address=192.168.10.1/24 interface=bridge-lan # 5. DHCP Server [admin@FAILOVER-ROUTER] > /ip pool add name="pool-lan" ranges=192.168.10.100-192.168.10.200 [admin@FAILOVER-ROUTER] > /ip dhcp-server add name="dhcp-lan" interface=bridge-lan address-pool="pool-lan" lease-time=10m [admin@FAILOVER-ROUTER] > /ip dhcp-server network add address=192.168.10.0/24 gateway=192.168.10.1 dns-server=8.8.8.8,1.1.1.1 # 6. NAT Masquerade untuk kedua ISP [admin@FAILOVER-ROUTER] > /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN1 [admin@FAILOVER-ROUTER] > /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN2
VIA WINBOX
1
Menu: Interfaces -> Rename ether3, ether4
2
Menu: Bridge -> + Add -> Name: bridge-lan
3
Tab Ports -> + Add LAN1, LAN2
4
Menu: IP -> Addresses -> + Add 192.168.10.1/24
5
Menu: IP -> DHCP Server -> DHCP Setup
6
Menu: IP -> Firewall -> NAT -> + Add masquerade WAN1 & WAN2
KONFIGURASI FAILOVER STEP 07 - INTI

Konfigurasi inti failover: buat dua default route dengan distance berbeda dan check-gateway=ping.

VIA CLI
# 1. Default route via ISP1 (distance 1 - primary) [admin@FAILOVER-ROUTER] > /ip route add dst-address=0.0.0.0/0 gateway=WAN1 distance=1 check-gateway=ping # 2. Default route via ISP2 (distance 2 - backup) [admin@FAILOVER-ROUTER] > /ip route add dst-address=0.0.0.0/0 gateway=WAN2 distance=2 check-gateway=ping # 3. Verifikasi routing table [admin@FAILOVER-ROUTER] > /ip route print # DST-ADDRESS GATEWAY DISTANCE STATUS 0 0.0.0.0/0 WAN1 1 active 1 0.0.0.0/0 WAN2 2 inactive # Router pilih route dengan distance terkecil (1) # Jika WAN1 down, route 0 inactive, route 1 active
VIA WINBOX
1
Menu: IP -> Routes -> + Add
2
Dst Address: 0.0.0.0/0
3
Gateway: WAN1
4
Distance: 1
5
Check Gateway: ping
6
+ Add lagi untuk WAN2: Distance: 2, Check Gateway: ping
7
Route dengan distance lebih kecil = primary
PENJELASAN FAILOVER
PARAMETERVALUEPENJELASAN
distance1 (primary), 2 (backup)Route dengan distance lebih kecil lebih diprioritaskan
check-gatewaypingRouter ping gateway untuk cek status
check-gateway-interval1m (default)Interval ping gateway
check-gateway-timeout1s (default)Timeout ping gateway
CARA KERJA: Router ping gateway ISP1 setiap 1 menit. Jika tidak ada response, router anggap ISP1 down dan switch ke ISP2 (distance 2). Jika ISP1 up lagi, router kembali ke ISP1 (distance 1).
CHECK GATEWAY PING STEP 08

check-gateway=ping membuat router ping gateway secara periodik untuk mendeteksi jika gateway down.

KONFIGURASI CHECK GATEWAY
# Edit route untuk set check-gateway [admin@FAILOVER-ROUTER] > /ip route set [find gateway=WAN1] check-gateway=ping [admin@FAILOVER-ROUTER] > /ip route set [find gateway=WAN2] check-gateway=ping # Set interval ping (default 1 menit) [admin@FAILOVER-ROUTER] > /ip route set [find gateway=WAN1] check-gateway-interval=30s # Set timeout ping (default 1 detik) [admin@FAILOVER-ROUTER] > /ip route set [find gateway=WAN1] check-gateway-timeout=1s # Verifikasi [admin@FAILOVER-ROUTER] > /ip route print detail # DST-ADDRESS GATEWAY DISTANCE CHECK-GATEWAY STATUS 0 0.0.0.0/0 WAN1 1 ping active 1 0.0.0.0/0 WAN2 2 ping inactive
CARA KERJA CHECK GATEWAY
PING GATEWAY
Router ping gateway setiap interval (30s). Jika reply, gateway dianggap up.
DETECT DOWN
Jika tidak ada reply setelah timeout, gateway dianggap down. Route dengan gateway ini menjadi inactive.
AUTO SWITCH
Jika primary route inactive, router pilih route backup (distance lebih besar). Failover otomatis.
AUTO RECOVER
Jika primary gateway up lagi, route primary kembali active. Router kembali ke primary route.
PENTING: Check gateway ping hanya cek gateway, bukan internet. Jika gateway up tapi internet down, failover tidak terjadi. Untuk deteksi internet down, perlu script tambahan.
TESTING FAILOVER STEP 09

Test failover untuk memastikan konfigurasi bekerja dengan benar.

CHECKLIST TESTING
TESTCARAEXPECTED RESULT
ISP1 connectivityPing 8.8.8.8Reply via WAN1
ISP2 connectivityDisable WAN1, ping 8.8.8.8Reply via WAN2
Failover timeDisconnect WAN1, time failover~10-30 detik
RecoveryReconnect WAN1Kembali ke ISP1
Client connectivityBrowse internet dari clientBisa akses internet
COMMAND TESTING
# 1. Test normal (ISP1 active) [admin@FAILOVER-ROUTER] > /ip route print # DST-ADDRESS GATEWAY DISTANCE STATUS 0 0.0.0.0/0 WAN1 1 active 1 0.0.0.0/0 WAN2 2 inactive [admin@FAILOVER-ROUTER] > /ping 8.8.8.8 count=4 HOST SIZE TTL TIME STATUS 8.8.8.8 56 117 12ms # 2. Test failover (disable WAN1) [admin@FAILOVER-ROUTER] > /interface disable WAN1 # Tunggu 30-60 detik [admin@FAILOVER-ROUTER] > /ip route print # DST-ADDRESS GATEWAY DISTANCE STATUS 0 0.0.0.0/0 WAN1 1 inactive 1 0.0.0.0/0 WAN2 2 active [admin@FAILOVER-ROUTER] > /ping 8.8.8.8 count=4 HOST SIZE TTL TIME STATUS 8.8.8.8 56 117 15ms # 3. Test recovery (enable WAN1) [admin@FAILOVER-ROUTER] > /interface enable WAN1 # Tunggu 30-60 detik [admin@FAILOVER-ROUTER] > /ip route print # DST-ADDRESS GATEWAY DISTANCE STATUS 0 0.0.0.0/0 WAN1 1 active 1 0.0.0.0/0 WAN2 2 inactive
TROUBLESHOOTING: Jika failover tidak bekerja, cek: (1) Check gateway enabled, (2) Distance berbeda, (3) Kedua ISP connected, (4) NAT masquerade untuk kedua ISP.
TROUBLESHOOTING FAILOVER SUPPORT

Masalah umum failover dan solusinya.

FAILOVER TIDAK BEKERJA
KEMUNGKINAN PENYEBAB:
1. Check gateway tidak enabled
2. Distance kedua route sama (seharusnya beda)
3. Backup ISP tidak connected
4. NAT masquerade tidak ada untuk backup ISP
SOLUSI: Cek check-gateway=ping. Cek distance berbeda. Cek backup ISP connected. Cek NAT masquerade untuk kedua ISP.
FAILOVER LAMBAT
KEMUNGKINAN PENYEBAB:
1. Check gateway interval terlalu lama
2. Check gateway timeout terlalu lama
3. Network latency tinggi
SOLUSI: Kurangi check-gateway-interval (30s). Kurangi check-gateway-timeout (1s). Cek network latency.
ROUTER TIDAK KEMBALI KE PRIMARY
KEMUNGKINAN PENYEBAB:
1. Primary ISP belum fully up
2. Check gateway interval terlalu lama
3. Route priority issue
SOLUSI: Tunggu lebih lama. Cek primary ISP connected. Cek routing table. Kurangi check-gateway-interval.
CLIENT CONNECTION BROKEN SAAT FAILOVER
KEMUNGKINAN PENYEBAB:
1. Session-based protocol (VPN, online game) tidak support failover
2. Connection timeout terlalu pendek
SOLUSI: Ini normal untuk session-based protocol. Connection akan broken saat failover. User perlu reconnect. Untuk aplikasi non-session, failover transparan.
DIAGNOSTIC COMMANDS
# Cek routing table > /ip route print > /ip route print detail # Test connectivity > /ping 8.8.8.8 > /ping 8.8.8.8 interface=WAN1 > /ping 8.8.8.8 interface=WAN2 # Cek interface status > /interface print # Cek NAT rules > /ip firewall nat print # Test failover > /interface disable WAN1 # Tunggu 30-60 detik > /ip route print > /interface enable WAN1
BEST PRACTICE FAILOVER TIPS
USE CHECK GATEWAY
Selalu gunakan check-gateway=ping untuk deteksi gateway down secara otomatis.
DIFFERENT DISTANCE
Pastikan distance primary (1) dan backup (2) berbeda. Router pilih distance terkecil.
NAT BOTH ISP
Pastikan NAT masquerade ada untuk kedua ISP. Tanpa NAT, client tidak bisa akses internet via ISP tersebut.
TEST FAILOVER
Test failover secara berkala. Disable primary ISP, pastikan backup aktif. Enable primary, pastikan kembali.
MONITOR ROUTING
Monitor routing table secara berkala. Pastikan route primary active dan backup inactive.
DOCUMENT CONFIG
Dokumentasikan konfigurasi failover. Backup config sebelum dan sesudah perubahan.
ADJUST INTERVAL
Adjust check-gateway-interval sesuai kebutuhan. 30s untuk fast failover, 1m untuk normal.
TEST BOTH ISP
Test masing-masing ISP terpisah sebelum failover. Pastikan kedua ISP working dengan baik.
BACKUP CONFIGURATION
Backup konfigurasi sebelum dan sesudah perubahan. Restore jika ada masalah.
MONITOR CPU USAGE
Monitor CPU usage secara berkala. Failover bisa meningkatkan CPU usage.
USE STABLE ROUTEROS
Gunakan RouterOS versi stable. Jangan pakai testing/long-term kecuali perlu.
PLAN FOR GROWTH
Plan untuk growth. Jika butuh load balancing, pertimbangkan upgrade router atau tambah router.
FAILOVER CHEATSHEET QUICK REF
FAILOVER COMMANDS
# FAILOVER CONFIGURATION > /ip route add dst-address=0.0.0.0/0 gateway=WAN1 distance=1 check-gateway=ping > /ip route add dst-address=0.0.0.0/0 gateway=WAN2 distance=2 check-gateway=ping # NAT MASQUERADE > /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN1 > /ip firewall nat add chain=srcnat action=masquerade out-interface=WAN2 # CHECK GATEWAY > /ip route set [find gateway=WAN1] check-gateway=ping > /ip route set [find gateway=WAN1] check-gateway-interval=30s # TESTING > /ip route print > /ping 8.8.8.8 > /interface disable WAN1 # Tunggu 30-60 detik > /ip route print > /interface enable WAN1 # MONITORING > /ip route print detail > /interface print
ABDURROZAK.MY.ID // JARINGAN SOSIAL