Mikrotik automatic failover is one of those topics with lots of materials on the internet. However, most of these materials, created by inexperienced network engineers, do not address the users’ requirements. In this article, I will not only simplify the configuration of Mikrotik automatic failover using netwatch, I will ensure that this solution will address your end.
Why Mikrotik Automatic failover?
If you have a dual-ISP connection where one is preferred over the other, you need a system that will route all user traffics out of the primary link but with the ability to automatically switch control to the secondary whenever a failure is detected on the primary link. Also, the system must be able to return control to the primary link immediately the failure is resolved.
Mikrotik automatic failover configuration
On my router, Ether1 is connected to ISP1 while Ether2 is connected to ISP2. The bridge port is used for the LAN. The static address 192.168.11.4/24 is used for ISP1 on ether1. 10.0.0.19/16 was statically assigned to Ether2 for connection to ISP2, and 192.168.88.1/24 was assigned to the LAN interface. All these are shown in the image below.
Next, create an interface list and add Ether1 and Ether2 to the WAN interface. The bridge port or whatever interface you are using for your LAN should be added to the LAN interface list. After that, go to IP > firewall > NAT and create a masquerade rule. Choose WAN (the one created earlier) as your out interface list. The reason I created the WAN interfece list was to simplify the NAT configuration. Otherwise, two nat rules will be created for both out interfaces.
The next step is the configuration of static default routes for both links. The preferred link should have the administrative distance of 1 while the backup link should have a higher AD, e.g. 10. The lower the AD, the better the link. At this point, connected users should have internet access via the primary link. The backup link, though in the routing table, is inactive and can only become active when the primary link has its cable unplugged or the its static default route disabled or removed from the routing table. That is not efficient.
You may also like: How to configure automatic failover with load balancing on a Cisco router
To efficiently automate the path selection process, we need to do three things: firstly, mark the connection and packets for all traffics originating from the router and destined to a relaible internet IP address like 22.214.171.124 or 126.96.36.199. Secondly, create a routing rule that uses the routing mark created in step one above to ensure that traffics to the listed address are routed out the primary ISP link at all time. What does this do? Simple! As long as the address is reachble, we can ask Netwatch to do something. Netwatch will enable the primary ISP’s static default route in the routing table. Otherwise, the primary route will be disabled to allow the secondary become active.
In the images above, the connection mark was first created, it was then used to create the routing mark. With the routing mark, a static route is created for all traffics from the router to 188.8.131.52 to go through the primary link at all times. See the image below for guide on static defualt route with routing mark.
Finnally, netwatch is enabled to track reachability to 184.108.40.206 and enable the default route to the primary link when the IP is up and disable the same default route when the IP is down (unreachable).
With the Mikrotik automatic failover setup above, netwatch will continue to test reachability to 220.127.116.11 every 5 seconds. As long as that IP is reachable, the primary link will be in use. Otherwise, the secondary link becomes active. This solution has been tested and found efficient.