Give this a go: https://github.com/svlsResearch/ha-mikrotik
It does exactly what you are asking for, except for stateful connection synchronization. I have been using it to run 6 pairs of CCR1036 for over a year now.

Give this a go: https://github.com/svlsResearch/ha-mikrotik
It does exactly what you are asking for, except for stateful connection synchronization. I have been using it to run 6 pairs of CCR1036 for over a year now.

@nathan1 i was testing this on a lab using 2 450g, but for some reason on the first HA cyclce , the "B" became the active and the "A" the standby but the HA work normal only this Letter switch
do you have this problem ?

Give this a go: https://github.com/svlsResearch/ha-mikrotik
It does exactly what you are asking for, except for stateful connection synchronization. I have been using it to run 6 pairs of CCR1036 for over a year now.

@nathan1 i was testing this on a lab using 2 450g, but for some reason on the first HA cyclce , the "B" became the active and the "A" the standby but the HA work normal only this Letter switch
do you have this problem ?

There is no affinity for a primary right now. So this works as designed. Did you want to have an affinity for one vs. the other? In my setup - they are equal in terms of choice, at some sites my B is currently the active one just due to order in which I upgraded/cycled.

Give this a go: https://github.com/svlsResearch/ha-mikrotik
It does exactly what you are asking for, except for stateful connection synchronization. I have been using it to run 6 pairs of CCR1036 for over a year now.

@nathan1 i was testing this on a lab using 2 450g, but for some reason on the first HA cyclce , the "B" became the active and the "A" the standby but the HA work normal only this Letter switch
do you have this problem ?

There is no affinity for a primary right now. So this works as designed. Did you want to have an affinity for one vs. the other? In my setup - they are equal in terms of choice, at some sites my B is currently the active one just due to order in which I upgraded/cycled.

i know that work

but since A and B i think that when A became online again, in my mind need to be Active again
but it work very well

Give this a go: https://github.com/svlsResearch/ha-mikrotik
It does exactly what you are asking for, except for stateful connection synchronization. I have been using it to run 6 pairs of CCR1036 for over a year now.

@nathan1 i was testing this on a lab using 2 450g, but for some reason on the first HA cyclce , the "B" became the active and the "A" the standby but the HA work normal only this Letter switch
do you have this problem ?

There is no affinity for a primary right now. So this works as designed. Did you want to have an affinity for one vs. the other? In my setup - they are equal in terms of choice, at some sites my B is currently the active one just due to order in which I upgraded/cycled.

i know that work

but since A and B i think that when A became online again, in my mind need to be Active again
but it work very well

In theory, the VRRP could be adjusted to force A back to the primary when it is around. However, you will probably end up with extraneous reboots/connection breaks due to this. I simply treat them like one logical device in my head and the hostname that is currently active doesn't really come in to play. The A and B simple give me a hint as to which one is currently physically active, if I happen to be on site and dealing with them physically, this is useful. Otherwise, I just ignore it entirely and address the active one with the floating IP/hostname.

If you end up really wanting to see A active, I can add the feature when I have some more time. You can always force A to become active again by rebooting B when A is back. (hint: do an $HASyncStandby until it is GOOD before doing this).

@nathan1 i was testing this on a lab using 2 450g, but for some reason on the first HA cyclce , the "B" became the active and the "A" the standby but the HA work normal only this Letter switch
do you have this problem ?

There is no affinity for a primary right now. So this works as designed. Did you want to have an affinity for one vs. the other? In my setup - they are equal in terms of choice, at some sites my B is currently the active one just due to order in which I upgraded/cycled.

i know that work

but since A and B i think that when A became online again, in my mind need to be Active again
but it work very well

In theory, the VRRP could be adjusted to force A back to the primary when it is around. However, you will probably end up with extraneous reboots/connection breaks due to this. I simply treat them like one logical device in my head and the hostname that is currently active doesn't really come in to play. The A and B simple give me a hint as to which one is currently physically active, if I happen to be on site and dealing with them physically, this is useful. Otherwise, I just ignore it entirely and address the active one with the floating IP/hostname.

If you end up really wanting to see A active, I can add the feature when I have some more time. You can always force A to become active again by rebooting B when A is back. (hint: do an $HASyncStandby until it is GOOD before doing this).

Oh
You are the creator of the scripts
Very good work, I like do read codes and try to understand them, but your is very complex for one that don't made it,
Very good work
[emoji106]


Enviado de meu XT1580 usando Tapatalk

Dude, you should try to include this script you made in the Wiki.
It seems really solid and it solves one major need for enterprise needs.

Many thanks to Nathan1 for this solution. I tested first on a pair of small RB925ui-5ac2nD. Didn't succeed at first try because lack of instructions, but after 2 hours the pair was working as intended.
Then I installed the script on a pair of RB3011UiAS-RM and looks fine. It is still in my lab but next days will move them into production. The setup have 1 internet static IP Ethernet connection, 2 pppoe internet connections (static IP) one vlan connected to 2 RB925ui-5ac2nD providing guest wifi and separate LAN wifi and one wireless link to a remote connection using ubiquiti antennas.
Now I realized that I can connect antenna only to one router (I don't have redundant switch) so to avoid problems the router A must be always master. (of course I don't need fully redundant link to that ubiquiti since it is used only for nightly remote backups and anytime someone can plug the cable to router B )
Does anybody knows how to make always active the router A ?

Give this a go: https://github.com/svlsResearch/ha-mikrotik

Many thanks, you've saved me days! I tested this on virtualised routers first and had a problem that all interfaces would get disabled, including the VRRP parent, until I hashed out the following line in the ha_startup script:
/system routerboard settings set silent-boot=yes

It's a virtual x86, so it made sense that it failed. I additionally reduced the subnet in the ha_config from /24 to /29. The ha_switchrole script appears to have hardcore values which don't match the settings from ha_config so I set the HA sync interface and then assume it should ping the slave (169.254.23.2), right?

I see no references to the scripts using telnet or ssh so I additionally stopped it restricting those protocols to the HA addresses:
Edited ha_startup script from:
:foreach service in [:toarray "ftp,telnet,ssh"] do={
to:
:foreach service in [:toarray "ftp"] do={


Excellent work, we typically implement redundancy using OSPF, BGP and/or VRRP but bridging VPLS tunnels and retrofitting redundancy on complicated routers with allot of /30 subnets is very easy using the collection of scripts you're written!

Mikrotik should really incorporate your work as a heartbeat HA function, instead of wasting time on kid control...

Give this a go: https://github.com/svlsResearch/ha-mikrotik

• Changes '] > ' to stop rancid (configuration revision management) matching it to the RouterOS prompt.
• Changes netmask from /24 to /29 and moved VRRP IP from .10 to .3.
• Set schedulers' start date to Unix Epoch (Jan/01/1970).
• Set schedulers' intervals and start time to prevent overlapping.
• Only change FTP service, prevents SSH not being reachable on master or enabling Telnet.
• Replaces hard coded values with variables.
• Disables adding default route (makes loopback interfaces reachable).
• Disables silencing Routerboard boot process by default and handle errors (eg VM)

--- HA_init.rsc 2018-02-18 08:54:22.000000000 +0200
+++ ../../HA_init.rsc   2018-02-18 09:32:25.000000000 +0200
@@ -1,7 +1,7 @@
 :do {
 /system script
 remove [find name=ha_checkchanges_new]
-add name=ha_checkchanges_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":if ([:len [/system script job find where script=\"ha_checkchanges\"]] > 1) do={:error \"already running checkchanges\"; } \
+add name=ha_checkchanges_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":if ([:len [/system script job find where script=\"ha_checkchanges\"]]  > 1) do={:error \"already running checkchanges\"; } \
        \n:global isMaster\
        \n:global isStandbyInSync\
        \n:global haPassword\
@@ -39,11 +39,11 @@
 remove [find name=ha_config_new]
 add name=ha_config_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source="/system script run [find name=\"ha_config_base\"]\
        \n:global haNetwork \"169.254.23.0\"\
-       \n:global haNetmask \"255.255.255.0\"\
-       \n:global haNetmaskBits \"24\"\
+       \n:global haNetmask \"255.255.255.248\"\
+       \n:global haNetmaskBits \"29\"\
        \n:global haAddressA \"169.254.23.1\"\
        \n:global haAddressB \"169.254.23.2\"\
-       \n:global haAddressVRRP \"169.254.23.10\""
+       \n:global haAddressVRRP \"169.254.23.3\""
 remove [find name=ha_functions_new]
 add name=ha_functions_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":global HADebug do={\
        \n   :put \$1\
@@ -103,7 +103,7 @@
        \n   :error \"Are you sure the other device is configured properly? I am unable to ping MAC \$pingMac\"\
        \n}\
        \n\
-       \n:if ([:len [/ip address find where interface=\"\$haInterface\" and comment!=\"HA_AUTO\"]] > 0) do {\
+       \n:if ([:len [/ip address find where interface=\"\$haInterface\" and comment!=\"HA_AUTO\"]]  > 0) do {\
        \n   :error \"Interface \$haInterface has IP addresses. HA should completely own the interface and it cannot be used by anything else. Please correct\"\
        \n}\
        \n\
@@ -155,7 +155,7 @@
        \n:execute \"ha_setidentity\"\
        \n:do { :local k [/system script find name=\"on_master\"]; if ([:len \$k] = 1) do={ /system script run \$k } } on-error={ :put \"on_master failed\" }"
 remove [find name=ha_pushbackup_new]
-add name=ha_pushbackup_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":if ([:len [/system script job find where script=\"ha_pushbackup\"]] > 1) do={:error \"already running pushbackup\"; } \
+add name=ha_pushbackup_new owner=admin policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive source=":if ([:len [/system script job find where script=\"ha_pushbackup\"]]  > 1) do={:error \"already running pushbackup\"; } \
        \n:global haPassword\
        \n:global isMaster\
        \n:global haAddressOther\
@@ -247,7 +247,7 @@
        \n}\
        \n/log warning \"ha_startup: 0.3\"\
        \n/interface ethernet disable [find]\
-       \n:global haStartupHAVersion \"0.2alpha - ea961767e45b63b81aac87eed37301d8b70bedf7\"\
+       \n:global haStartupHAVersion \"0.2alpha - 858dc62b5a9e215a5e5896137a053d01d16695c6\"\
        \n:global isStandbyInSync false\
        \n:global isMaster false\
        \n:global haPassword\
@@ -268,7 +268,7 @@
        \n/system scheduler remove [find comment=\"HA_AUTO\"]\
        \n\
        \n#Pause on-error just in case we error out before the spin loop - hope 5 seconds is enough.\
-       \n/system scheduler add comment=HA_AUTO name=ha_startup on-event=\":do {:global haInterface; /system script run [find name=ha_startup]; } on-error={ :delay 5; /interface ethernet disable [find default-name!=\\\"\\\$haInterface\\\"]; /log error \\\"ha_startup: FAILED - DISABLED ALL INTERFACES\\\" }\" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup \
+       \n/system scheduler add comment=HA_AUTO name=ha_startup on-event=\":do {:global haInterface; /system script run [find name=ha_startup]; } on-error={ :delay 5; /interface ethernet disable [find default-name!=\\\"\\\$haInterface\\\"]; /log error \\\"ha_startup: FAILED - DISABLED ALL INTERFACES\\\" }\" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=startup \
        \n\
        \n#/interface ethernet reset-mac-address\
        \n/ip address remove [find interface=\"\$haInterface\"]\
@@ -315,8 +315,8 @@
        \n   }\
        \n}\
        \n\
-       \n/ip route remove [find comment=\"HA_AUTO\"]   \
-       \n/ip route add gateway=\$haAddressOther distance=250 comment=HA_AUTO\
+       \n#/ip route remove [find comment=\"HA_AUTO\"]   \
+       \n#/ip route add gateway=\$haAddressOther distance=250 comment=HA_AUTO\
        \n\
        \n/log warning \"ha_startup: 4\"\
        \n\
@@ -337,10 +337,10 @@
        \n/ip address add address=\$haAddressVRRP netmask=255.255.255.255 interface=HA_VRRP comment=\"HA_AUTO\"\
        \n\
        \n/log warning \"ha_startup: 6\"\
-       \n/system scheduler add comment=HA_AUTO interval=30m name=ha_exportcurrent on-event=\"/export file=\\\"HA_current.rsc\\\"\" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/20/2000 start-time=22:37:10\
-       \n/system scheduler add interval=10m name=ha_checkchanges on-event=ha_checkchanges policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/1/2000 start-time=18:00:30 comment=HA_AUTO\
+       \n/system scheduler add comment=HA_AUTO interval=10m name=ha_exportcurrent on-event=\"/export file=\\\"HA_current.rsc\\\"\" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=00:05:00\
+       \n/system scheduler add interval=10m name=ha_checkchanges on-event=ha_checkchanges policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=00:10:00 comment=HA_AUTO\
        \n#Still need this - things like DHCP leases dont cause a system config change, we want to backup periodically.\
-       \n/system scheduler add comment=HA_AUTO interval=24h name=ha_auto_pushbackup on-event=ha_pushbackup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/20/2000 start-time=05:00:00\
+       \n/system scheduler add comment=HA_AUTO interval=24h name=ha_auto_pushbackup on-event=ha_pushbackup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=05:00:00\
        \n/log warning \"ha_startup: 7\"\
        \n:if ([:len [/file find name=\"HA_dsa\"]] = 1) do={\
        \n   /ip ssh import-host-key private-key-file=HA_rsa\
@@ -352,9 +352,9 @@
        \n/user add address=\"\$haNetwork/\$haNetmaskBits\" comment=HA_AUTO group=full name=ha password=\"\$haPassword\"\
        \n/log warning \"ha_startup: 8\"\
        \n#So you dont get annoyed with constant beeping\
-       \n/system routerboard settings set silent-boot=yes\
+       \n#:do {/system routerboard settings set silent-boot=yes} on-error={};\
        \n\
-       \n:foreach service in [:toarray \"ftp,telnet,ssh\"] do={\
+       \n:foreach service in [:toarray \"ftp\"] do={\
        \n   :local serviceAddresses \"\"\
        \n   :foreach k in=[/ip service get [find name=\$service] address] do={\
        \n      :if (\$k != \"\$haAddressA/32\" and \$k != \"\$haAddressB/32\" and \$k != \"\$haAddressVRRP/32\") do {\
@@ -365,7 +365,7 @@
        \n   /ip service set [find name=\$service] address=[:toarray \$serviceAddresses]\
        \n}\
        \n\
-       \n:if ([:len [/file find where name=\"HA_run-after-hastartup.rsc\"]] > 0) do {\
+       \n:if ([:len [/file find where name=\"HA_run-after-hastartup.rsc\"]]  > 0) do {\
        \n   /import HA_run-after-hastartup.rsc\
        \n}\
        \n/delay 5\
@@ -388,7 +388,7 @@
        \n   /system script run [find name=\"ha_pushbackup\"]\
        \n   :put \"delaying 60\"\
        \n   /delay 60\
-       \n   :if (\$isMaster && [/ping 169.254.23.3 count=1 interface=ether1 ttl=1] >= 1) do {\
+       \n   :if (\$isMaster && [/ping \$haAddressOther count=1 interface=\$haInterface ttl=1]  >= 1) do {\
        \n      :put \"REBOOTING MYSELF\"\
        \n      :execute \"/system reboot\"\
        \n   } else {\
diff -uNr scripts/ha_checkchanges.script ../../scripts/ha_checkchanges.script
--- scripts/ha_checkchanges.script      2018-02-17 11:58:46.000000000 +0200
+++ ../../scripts/ha_checkchanges.script        2018-02-17 12:35:29.000000000 +0200
@@ -1,4 +1,4 @@
-:if ([:len [/system script job find where script="ha_checkchanges"]] > 1) do={:error "already running checkchanges"; }
+:if ([:len [/system script job find where script="ha_checkchanges"]]  > 1) do={:error "already running checkchanges"; }
 :global isMaster
 :global isStandbyInSync
 :global haPassword
diff -uNr scripts/ha_config.script ../../scripts/ha_config.script
--- scripts/ha_config.script    2018-02-18 08:54:28.000000000 +0200
+++ ../../scripts/ha_config.script      2018-02-18 08:54:06.000000000 +0200
@@ -1,7 +1,7 @@
 /system script run [find name="ha_config_base"]
 :global haNetwork "169.254.23.0"
-:global haNetmask "255.255.255.0"
-:global haNetmaskBits "24"
+:global haNetmask "255.255.255.248"
+:global haNetmaskBits "29"
 :global haAddressA "169.254.23.1"
 :global haAddressB "169.254.23.2"
-:global haAddressVRRP "169.254.23.10"
\ No newline at end of file
+:global haAddressVRRP "169.254.23.3"
\ No newline at end of file
diff -uNr scripts/ha_install.script ../../scripts/ha_install.script
--- scripts/ha_install.script   2018-02-17 12:13:18.000000000 +0200
+++ ../../scripts/ha_install.script     2018-02-17 12:37:49.000000000 +0200
@@ -29,7 +29,7 @@
    :error "Are you sure the other device is configured properly? I am unable to ping MAC $pingMac"
 }

-:if ([:len [/ip address find where interface="$haInterface" and comment!="HA_AUTO"]] > 0) do {
+:if ([:len [/ip address find where interface="$haInterface" and comment!="HA_AUTO"]]  > 0) do {
    :error "Interface $haInterface has IP addresses. HA should completely own the interface and it cannot be used by anything else. Please correct"
 }

diff -uNr scripts/ha_pushbackup.script ../../scripts/ha_pushbackup.script
--- scripts/ha_pushbackup.script        2018-02-17 12:13:47.000000000 +0200
+++ ../../scripts/ha_pushbackup.script  2018-02-17 12:38:25.000000000 +0200
@@ -1,4 +1,4 @@
-:if ([:len [/system script job find where script="ha_pushbackup"]] > 1) do={:error "already running pushbackup"; }
+:if ([:len [/system script job find where script="ha_pushbackup"]]  > 1) do={:error "already running pushbackup"; }
 :global haPassword
 :global isMaster
 :global haAddressOther
diff -uNr scripts/ha_startup.script ../../scripts/ha_startup.script
--- scripts/ha_startup.script   2018-02-17 12:39:39.000000000 +0200
+++ ../../scripts/ha_startup.script     2018-02-18 09:32:33.000000000 +0200
@@ -35,7 +35,7 @@
 /system scheduler remove [find comment="HA_AUTO"]

 #Pause on-error just in case we error out before the spin loop - hope 5 seconds is enough.
-/system scheduler add comment=HA_AUTO name=ha_startup on-event=":do {:global haInterface; /system script run [find name=ha_startup]; } on-error={ :delay 5; /interface ethernet disable [find default-name!=\"\$haInterface\"]; /log error \"ha_startup: FAILED - DISABLED ALL INTERFACES\" }" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup
+/system scheduler add comment=HA_AUTO name=ha_startup on-event=":do {:global haInterface; /system script run [find name=ha_startup]; } on-error={ :delay 5; /interface ethernet disable [find default-name!=\"\$haInterface\"]; /log error \"ha_startup: FAILED - DISABLED ALL INTERFACES\" }" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=startup

 #/interface ethernet reset-mac-address
 /ip address remove [find interface="$haInterface"]
@@ -82,8 +82,8 @@
    }
 }

-/ip route remove [find comment="HA_AUTO"]
-/ip route add gateway=$haAddressOther distance=250 comment=HA_AUTO
+#/ip route remove [find comment="HA_AUTO"]
+#/ip route add gateway=$haAddressOther distance=250 comment=HA_AUTO

 /log warning "ha_startup: 4"

@@ -104,10 +104,10 @@
 /ip address add address=$haAddressVRRP netmask=255.255.255.255 interface=HA_VRRP comment="HA_AUTO"

 /log warning "ha_startup: 6"
-/system scheduler add comment=HA_AUTO interval=30m name=ha_exportcurrent on-event="/export file=\"HA_current.rsc\"" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/20/2000 start-time=22:37:10
-/system scheduler add interval=10m name=ha_checkchanges on-event=ha_checkchanges policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/1/2000 start-time=18:00:30 comment=HA_AUTO
+/system scheduler add comment=HA_AUTO interval=10m name=ha_exportcurrent on-event="/export file=\"HA_current.rsc\"" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=00:05:00
+/system scheduler add interval=10m name=ha_checkchanges on-event=ha_checkchanges policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=00:10:00 comment=HA_AUTO
 #Still need this - things like DHCP leases dont cause a system config change, we want to backup periodically.
-/system scheduler add comment=HA_AUTO interval=24h name=ha_auto_pushbackup on-event=ha_pushbackup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=jan/20/2000 start-time=05:00:00
+/system scheduler add comment=HA_AUTO interval=24h name=ha_auto_pushbackup on-event=ha_pushbackup policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=05:00:00
 /log warning "ha_startup: 7"
 :if ([:len [/file find name="HA_dsa"]] = 1) do={
    /ip ssh import-host-key private-key-file=HA_rsa
@@ -119,9 +119,9 @@
 /user add address="$haNetwork/$haNetmaskBits" comment=HA_AUTO group=full name=ha password="$haPassword"
 /log warning "ha_startup: 8"
 #So you dont get annoyed with constant beeping
-/system routerboard settings set silent-boot=yes
+#:do {/system routerboard settings set silent-boot=yes} on-error={};

-:foreach service in [:toarray "ftp,telnet,ssh"] do={
+:foreach service in [:toarray "ftp"] do={
    :local serviceAddresses ""
    :foreach k in=[/ip service get [find name=$service] address] do={
       :if ($k != "$haAddressA/32" and $k != "$haAddressB/32" and $k != "$haAddressVRRP/32") do {
@@ -132,7 +132,7 @@
    /ip service set [find name=$service] address=[:toarray $serviceAddresses]
 }

-:if ([:len [/file find where name="HA_run-after-hastartup.rsc"]] > 0) do {
+:if ([:len [/file find where name="HA_run-after-hastartup.rsc"]]  > 0) do {
    /import HA_run-after-hastartup.rsc
 }
 /delay 5
diff -uNr scripts/ha_switchrole.script ../../scripts/ha_switchrole.script
--- scripts/ha_switchrole.script        2018-02-17 12:14:19.000000000 +0200
+++ ../../scripts/ha_switchrole.script  2018-02-18 09:17:57.000000000 +0200
@@ -4,7 +4,7 @@
    /system script run [find name="ha_pushbackup"]
    :put "delaying 60"
    /delay 60
-   :if ($isMaster && [/ping 169.254.23.3 count=1 interface=ether1 ttl=1] >= 1) do {
+   :if ($isMaster && [/ping $haAddressOther count=1 interface=$haInterface ttl=1]  >= 1) do {
       :put "REBOOTING MYSELF"
       :execute "/system reboot"
    } else {

Good catch on the switchrole, it is actually a script I very rarely use and wasn't intended to be committed. It needs to be changed to use $haOtherAddress and $haInterface rather than the fixed IP and interface.

--- mtrancid.orig	2018-02-18 07:55:03.199828386 -0500
+++ mtrancid	2018-02-18 07:55:20.856371114 -0500
@@ -235,9 +235,13 @@
 	print STDERR "    In Export: $_" if ($debug);
 	my $buffer = "";
 
+    #Be much stricter on the quit prompt when exporting. If scripts contain ] > then it is incorrectly terminated early.
+    my $prompt_quit = "${prompt}quit\$";
+	print STDERR "    Quit prompt for export: $prompt_quit\n" if ($debug);
+
 	while (<INPUT>) {
 		tr/\015//d;
-		if (/$prompt/) { $found_end=1; $clean_run=1; return 0};
+		if (/$prompt_quit/) { $found_end=1; $clean_run=1; return 0};
 		next if(/^(\s*|\s*$cmd\s*)$/);
 		next if(/^#/);
 		return(1) if /(bad command name )/;

Would you please consider accepting the following patch, it does the following:

• Changes '] > ' to stop rancid (configuration revision management) matching it to the RouterOS prompt.
• Changes netmask from /24 to /29 and moved VRRP IP from .10 to .3.
• Set schedulers' start date to Unix Epoch (Jan/01/1970).
• Set schedulers' intervals and start time to prevent overlapping.
• Only change FTP service, prevents SSH not being reachable on master or enabling Telnet.
• Replaces hard coded values with variables.
• Disables adding default route (makes loopback interfaces reachable).
• Disables silencing Routerboard boot process by default and handle errors (eg VM)

/system logging action
set 3 remote=54.119.65.26 src-address=54.79.22.1

• Upgraded acting master, which switches it to standby mode
• Connected to new standby router, upgraded firmware to complete the process and rebooted
• Validated configuration via mac telnet
• Repeated the steps above on the current master

Can you help me understand the "Disables adding default route" and how it interacts with the loopbacks for you?
I actually use the default because I have a MASQUERADE rule in my setup that allows the ha-mikrotik network to get out to the internet. I do this to test RouterOS upgrades: I login to the standby, do a RouterOS upgrade, then do a push from the primary, check if the standby looks right, then switch roles and repeat on the new secondary (old master).

Additionally, I've been thinking about giving the secondary a stable known address in addition to the floating ones (ie: .3 is always master, .4 is always secondary). If I do this, it would allow for a NAT setup to allow easier external access to the secondary for monitoring. Additionally, maybe an simple that can be used with the Mikrotik SNMP script GET to monitor the state of the pair. Any thoughts on how you might want to monitor the secondary in general?

I agree that the user should be able to select their own network but I think I'd rather do it with the existence of an alternate configuration that overrides the standard configuration.
It can also be done as extra parameters to $HAInstall to make it easier to deploy clusters that are similar.

PS: Any interest in taking this to the github project so we can track the features/issues a little cleaner?

• No rancid escape fix here. If you still want to do this escaping, let's do it with the generate script. The rancid fix appears to be working OK for me though.

• Kept the default gateway for now. I understand your use case though, you don't want your secondary getting out.

• Keeps original /24 addressing until we can sort out the ha-mikrotik upgrade path.

No problem not using CCRs, they are definitely expensive for many deployments. I just wanted to let you know that you are the first one that I know of to test alternative platforms, so good for all of us. I would like to hear how well it works for you after you run for a while.

The boot delay sounds like a great solution if you just want one to always become primary when they are both booted nearly simultaneously (i.e. after power recovery). This wouldn't force A to become primary again after A was primary and then rebooted but that is the feature I could add if you really wanted it. I think this could work based on a pretty simply change that enables VRRP preemption.

It sounds like you have found a pretty workable solution though. Maybe you run it for a while and then see if you generally find it stable and if you still want this feature after a while of running, I will add it. How does that sound?

Anyone tested and confirmed this works exactly as expected on 6.42.x ?
We're running this on a couple of routers in a data center and it seems to work fine. However 2 problems i've noticed and I don't know if they are an issue with the later firmware or something going on with the script
1) I can't seem to make either of them a preemptive Master. I've tried adjusting VRRP priorities but if I reboot A and then B takes over, A will never be master until B reboots. We would rather have A always be the active master if it's online
2) I noticed the VRRP instance flaps a lot. I currently have B totally disconnected because it was flapping every few hours. We've tried changing ethernet cables and the same problem still happens. This is a big problem because these routers run BGP as well as PPPoE connections, resulting in extended downtime during a change over. Fine if we have an actual router failure, but not fine during normal day to day operation. There doesn't appear to be a physical interface issue, i'm not sure if its VRRP or the script. Can I just increase the VRRP timers to start with? (Won't break anything on the script or pairs?)

I also have another question regarding firmware updates. Is there any special care that must be taken? i.e. do I need to update both routers at same time or can I do 1, bring it online, reboot the other so the one with latest firmware becomes active, check everything is working fine and then update the backup?

Quick question, if I may: why is it neccessary to reboot the standby router once it receives new configuration?

So we have had a hardware failure on one of the routers and this script saved us a lot of downtime
However now comes the time to replace with another router. I have an identical model here

There are no instructions on what to do to bring a new standby router back into the mix (preferably without any downtime). Do I simply install the new backup router, connect the 2 via ether8 then run the ha_init script on the existing router once again and do through the same procedure?
Or is there something else I need to do only on the new backup to bring it in

Will it know to keep the existing primary config, and not override the primary with the backup?
Can this be done with little to no downtime?

$HAInstall interface=$haInterface macA=$haMacMe macB="[NEW MAC FOR B]" password=$haPassword

$HAInstall interface=$haInterface macB=$haMacMe macA="[NEW MAC FOR A]" password=$haPassword

:put "interface=$haInterface macA=$haMacA macA=$haMacB macMe=$haMacMe password=$haPassword"

Went to change out the dead router and noticed MikroTik has a new hardware revision of CCR series which require 6.43.5 as the minimum RouterOS version and cannot be downgraded any further. I've read on the github page there's a known bug with 6.43.x and its causing reboots and intermittent issues

Can anyone confirm if this has been fixed?

how can i do a software upgrade after installing your ha sytem?

Just update the primary and then the secondary goes active when the primary reboots
after that upgrade the second one

will the patch be still there after upgrade?

You're a legend for following up with this so quickly and in depth. Thank you very much
I'll wait for the tested update

/file remove [find]; /system reset-configuration keep-users=no no-defaults=yes skip-backup=yes

@millenium7 You mentioned a new hardware release of the CCR model you had. I don't have any of this updated gear, is it done as the same exact model # (/system routerboard print)?

One thing that's not so clear in your rebuild instructions

[NEW MAC FOR A]

Because you say 'FOR' A. Do you mean the new MAC you are going to give out, or put in the existing MAC that A has?

I.e.
OldA (dead)
- Ether1: 11:11:11:11:11:11
- ....
- Ether8: 11:11:11:11:11:18
OldB
- Ether1: 22:22:22:22:22:21
- ....
- Ether8: 22:22:22:22:22:28


NewA
- Ether1: 33:33:33:33:33:31
- ....
- Ether8: 33:33:33:33:33:38

So do I put in 11:11:11:11:11:18 or 33:33:33:33:33:38 when running $HAInstall on OldB?


And would that cause NewA's MAC addresses to be used on OldB. Or would it make NewA use the MAC addresses of OldB?
If its the former wouldn't that cause downtime as all MAC addresses would change?

It does yes. Can I suggest changing the wording though?, 'FOR A' implies the mac you are giving it
Maybe 'NEW MAC OF A' is clearer?

It does yes. Can I suggest changing the wording though?, 'FOR A' implies the mac you are giving it
Maybe 'NEW MAC OF A' is clearer?

Havn't updated yet. In the meantime we're waiting for our old device to get back from an RMA request, new one not going in yet and probably won't as i'm unsure of any config differences. I know for instance the new one has 2x SFP+ instead of 1x SFP+ and 1x SFP so that could cause an issue. But do still want to run the latest MikroTik firmware on this pair if possible. 6.44 does have some improvements that are useful to us

I'll wait until its confirmed working. Once again thanks for going out of your way to actually bug test this

Hello, I am trying to use the scripts with two routers (1100Hx2 and 1100Dx4) with RouterOS version 6.44.2 but I am unable to make it working.
Are these models ok?
My problem is that after the initial $HAPushStandby any connection to the slave does not work anymore, if I try to do $HAPushStandby again to copy the configuration I get a connection failed error.

Hello, I am trying to use the scripts with two routers (1100Hx2 and 1100Dx4) with RouterOS version 6.44.2 but I am unable to make it working.
Are these models ok?
My problem is that after the initial $HAPushStandby any connection to the slave does not work anymore, if I try to do $HAPushStandby again to copy the configuration I get a connection failed error.

Do not do this. Never try to use this without exactly the same hardware, you are going to run into some serious problems.

Just a question ,should it work if i use two RB1100AHx4?

Nathan1

It's a long time when I had played with this.
So I don't know if have this already.

It's possible to have a public management ip active on the standby router?
If this already have ignore this post.



Sent from my XT1580 using Tapatalk

Hi nathan1, I'm trying to put vrrp interface HA_VRRP on a bride, but i'm not be able to do this. Is it possible or not? Thanks,

It's a bit complicated to explain and my english is not so good.
I've made some changes to avoid that need, and all it's working fine.
Very great job Nathan1, congratulations

Nathan1

It's a long time when I had played with this.
So I don't know if have this already.

It's possible to have a public management ip active on the standby router?
If this already have ignore this post.



Sent from my XT1580 using Tapatalk

Hey Raffav,

I do this with NAT from the master to the standby, there is nothing built in to do it. May I ask why you are looking to do this? Monitoring? I did not build anything in for this because the only use case I see is monitoring, you do not want to make any configuration changes on the standby. I really don't want to have any interface up except for the $haInterface on the standby, it makes for cleaner cutovers, which makes exposing a public IP via a different interface somewhat cumbersome.

Monitoring is a valid use case though, I figure folks can configure NAT for that though, if they want it. For example, I also have masquerading setup so the standby can deliver logs to my central syslog server.

Happy to help you figure something out that works for you, if you have a specific use case in mind.

Nathan1

It's a long time when I had played with this.
So I don't know if have this already.

It's possible to have a public management ip active on the standby router?
If this already have ignore this post.



Sent from my XT1580 using Tapatalk

Hey Raffav,

I do this with NAT from the master to the standby, there is nothing built in to do it. May I ask why you are looking to do this? Monitoring? I did not build anything in for this because the only use case I see is monitoring, you do not want to make any configuration changes on the standby. I really don't want to have any interface up except for the $haInterface on the standby, it makes for cleaner cutovers, which makes exposing a public IP via a different interface somewhat cumbersome.

Monitoring is a valid use case though, I figure folks can configure NAT for that though, if they want it. For example, I also have masquerading setup so the standby can deliver logs to my central syslog server.

Happy to help you figure something out that works for you, if you have a specific use case in mind.

Monitoring, and like access inspection, for helth check,
Nat is not a good because you use the mastar as a entry point.

Think something like that,
Something went wrong on master, that trigger the swap but for some reasons both became master.(vrrp stop to receive vvrp protocol and trigger the swap)
How do you access the standby if you use Nat

Sent from my XT1580 using Tapatalk

Do you run this on any routers other than 1009's?
I also want to ask if its normal behavior for the standby to regularly reboot? I don't know the exact interval but maybe once every 2 hours?

We were running the older version on 6.42.3 and aside from the standby rebooting it did seem to work fine for months. However we've had another issue come up, details are here viewtopic.php?f=3&t=149273
I don't think your script has anything to do with it. Infact I don't think you can make an interface stop transmitting any packets at all even if you try to. But it's either some sort of configuration, script issue perhaps due to the repeated reboots which could have corrupted something, firmware bug or hardware issue

Long story short is i've now upgraded the script, updated both routers to 6.44.3, then removed one of the routers and replaced with dual PSU version (same model number), so far stable but interval between issues is unknown, can be a couple hours or a full day
If we have this issue occur again will be replacing both routers with CCR1016's, have you run the script on those before?

When there is a change detected in config, what is the procedure the standby router does to update its config?
Does it find the exact change and then input that command. Or does it do a backup/restore from the config on the active router?

I noticed the copying of files to be a problem. Is it possible for you to change that in your script to exclude anything beginning with 'log.' ?
Reason is I was logging to disk any errors to try and help troubleshoot the issues we were having when we couldn't catch it in time, but when the router rebooted, the new active would override the log files that were stored.
The issue we were/are having doesn't seem to log anything but the scripts I run to detect interface issues does and then the files get overwritten

• Apply the following changes to the ha_startup script
• Run ha_pushback on master to transfer config to slave
• Upgrade slave to 6.45.3
• Upgrade firmware and restart slave
• Upgrade master to 6.45.3 (initiates failover)
• Upgrade firmware and restart slave (previous master)
• Restart master, to switch slave back to master

@@ -38,10 +38,10 @@
 /system scheduler add comment=HA_AUTO name=ha_startup on-event=":do {:global haInterface; /system script run [find name=ha_startup]; } on-error={ :delay 5; /interface ethernet disable [find default-name!=\"\$haInterface\"]; /log error \"ha_startup: FAILED - DISABLED ALL INTERFACES\" }" policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-date=Jan/01/1970 start-time=startup

 /interface ethernet reset-mac-address [find default-name="$haInterface"]
-/ip address remove [find interface="$haInterface"]
 /ip address remove [find comment="HA_AUTO"]
+/interface bridge port remove [find comment="HA_AUTO"]
+/interface bridge remove [find comment="HA_AUTO"]
 /interface vrrp remove [find name="HA_VRRP"]
-/ip address remove [find interface="HA_VRRP"]
 /ip firewall filter remove [find comment="HA_AUTO"]
 /ip service set [find name="ftp"] disabled=yes

@@ -50,11 +50,14 @@
 /interface ethernet get [find default-name="$haInterface"] orig-mac-address
 /log warning "ha_startup: 2.2"
 :local mac [[/interface ethernet get [find default-name="$haInterface"] orig-mac-address]]
+/log warning "ha_startup: 2.3"
+/interface bridge add name="bridge-$haInterface" comment="HA_AUTO"
+/interface bridge port add bridge="bridge-$haInterface" interface="$haInterface" comment="HA_AUTO"
 /log warning "ha_startup: 3"
 :if ("$mac" = "$haMacA") do {
    :global haIdentity "A"
    /log warning "I AM A"
-   /ip address add interface=$haInterface address=$haAddressA netmask=$haNetmask comment="HA_AUTO"
+   /ip address add interface="bridge-$haInterface" address=$haAddressA netmask=$haNetmask comment="HA_AUTO"
    :global haAddressMe $haAddressA
    :global haAddressOther $haAddressB
    :global haMacMe $haMacA
@@ -63,7 +66,7 @@
    :if ("$mac" = "$haMacB") do {
       :global haIdentity "B"
       /log warning "I AM B"
-      /ip address add interface=$haInterface address=$haAddressB netmask=$haNetmask comment="HA_AUTO"
+      /ip address add interface="bridge-$haInterface" address=$haAddressB netmask=$haNetmask comment="HA_AUTO"
       :global haAddressMe $haAddressB
       :global haAddressOther $haAddressA
       :global haMacMe $haMacB
@@ -90,17 +93,17 @@
 #If firewall is empty, place-before=0 won't work. Add first rule.
 :if ([:len [/ip firewall filter find]] = 0) do {
    /log warning "ha_startup: 4.1"
-   /ip firewall filter add chain=output action=accept out-interface=$haInterface comment="HA_AUTO"
-   /ip firewall filter add chain=input action=accept in-interface=$haInterface comment="HA_AUTO"
+   /ip firewall filter add chain=output action=accept out-interface="bridge-$haInterface" comment="HA_AUTO"
+   /ip firewall filter add chain=input action=accept in-interface="bridge-$haInterface" comment="HA_AUTO"
 } else {
    /log warning "ha_startup: 4.2"
-   /ip firewall filter add chain=output action=accept out-interface=$haInterface comment="HA_AUTO" place-before=0
-   /ip firewall filter add chain=input action=accept in-interface=$haInterface comment="HA_AUTO" place-before=0
+   /ip firewall filter add chain=output action=accept out-interface="bridge-$haInterface" comment="HA_AUTO" place-before=0
+   /ip firewall filter add chain=input action=accept in-interface="bridge-$haInterface" comment="HA_AUTO" place-before=0
 }
 /log warning "ha_startup: 4.3"

 /log warning "ha_startup: 5"
-/interface vrrp add interface=$haInterface version=3 interval=1 name=HA_VRRP on-backup="ha_onbackup" on-master="ha_onmaster"
+/interface vrrp add interface="bridge-$haInterface" version=3 interval=1 name=HA_VRRP on-backup="ha_onbackup" on-master="ha_onmaster"
 /ip address add address=$haAddressVRRP netmask=255.255.255.255 interface=HA_VRRP comment="HA_AUTO"

 /log warning "ha_startup: 6"

RouterOS 6.45+ sets the VRRP interface to standby when the associated parent interface is not running. Whilst this makes perfect sense for classic VRRP implementations it causes a problem with the use of VRRP in the context of this high availability implementation. The problem is that since the sync interface, which VRRP is bound to, is directly connected to the partner router; VRRP will stay down when the second router is restarted or failed. The master router will essentially immediately shut all its ports the moment the standby router is restarted and the act of firing scripts when the partner router flaps its ports during initialisation can result in routers having an inconsistent state (we had one pair where both had their ports enabled).
....

Hi,
I'm testing with a pair of CCR1036 with 6.44.5 software, and it's not working well. At first, i bootstrapped correctly router A, i can see it active but, once router B is synced, after reboot, B becomes active and automatically A becomes in standby mode. Then, if i try to switchrole, i get this error:

/ip smb shares remove [find comment=HA_AUTO]
end_mkDirCode
status: failed
failure: connection failed

or if i reboot router B, router A appears like active, but when B is back online again, it takes active rol and A takes standby rol. Always B is active and A inactive.
Have someone tried with this hardware? Maybe that model isn't compatible, or am i making something wrong? Thanks,

/tool fetch src-path=HA_boot_log.txt dst-path=testing.txt address=$haAddressOther user=ha password=$haPassword mode=ftp

....
[admin@MikroTik_HA_B_ACTIVE] > /tool fetch src-path=HA_boot_log.txt dst-path=testing.txt address=$haAddressOther user=ha password=$haPassword mode=ftp
status: failed
failure: connection failed
[admin@MikroTik_HA_B_ACTIVE] >[/Codebox]

Code: Select all

[admin@MikroTik_HA_B_ACTIVE] > /tool fetch src-path=HA_boot_log.txt dst-path=testing.txt address=$haAddressOther user=ha password=$haPassword mode=ftp
status: failed
failure: connection failed
[admin@MikroTik_HA_B_ACTIVE] >

On router A, ftp server is always disabled. If I enable it manually

Code: Select all

[admin@MikroTik_HA_B_ACTIVE] > /tool fetch src-path=HA_boot_log.txt dst-path=testing.txt address=$haAddressOther user=ha password=$haPassword mode=ftp
status: failed

failure: poll err
[admin@MikroTik_HA_B_ACTIVE] >

/log print

Code: Select all

[admin@MikroTik_HA_A_ACTIVE] > /log print
00:25:28 system,info router rebooted
...
00:26:14 script,warning ha_startup: START
00:26:14 script,warning ha_startup: 0.1
00:26:14 script,warning ha_startup: 0.2
00:26:14 script,warning ha_startup: 0.3
...
00:26:14 script,warning ha_startup: version 0.6 - 8b14022883a2b1e541d1579e70e11b6bd023d601
00:26:14 script,warning ha_startup: 1 ether8
00:26:14 system,info new script scheduled by admin
00:26:14 system,info new script scheduled by admin
00:26:14 script,warning ha_startup: 2
00:26:14 system,info device changed by admin
00:26:14 system,info ip service changed by admin
00:26:14 system,info device changed by admin
00:26:14 script,warning ha_startup: 2.1 1
00:26:14 script,warning ha_startup: 2.2 1
00:26:14 script,warning ha_startup: 3 74:4D:28:C7:80:BB 1
00:26:14 script,warning ha_startup: 3.1 74:4D:28:C7:80:BB 1
00:26:14 script,warning I AM A
00:26:14 system,info address added by admin
00:26:14 system,info route added by admin
00:26:14 script,warning ha_startup: 4
00:26:14 script,warning ha_startup: 4.1
00:26:14 system,info filter rule added by admin
00:26:15 system,info filter rule added by admin
00:26:15 script,warning ha_startup: 4.3
00:26:15 script,warning ha_startup: 5
00:26:15 system,info device added by admin
00:26:15 system,info address added by admin
00:26:15 script,warning ha_startup: 6
00:26:15 system,info new script scheduled by admin
00:26:15 system,info new script scheduled by admin
00:26:15 system,info new script scheduled by admin
00:26:15 script,warning ha_startup: 7
00:26:15 system,info user ha added by admin
00:26:15 script,warning ha_startup: 8
00:26:15 system,info tile rb settings changed by admin
00:26:15 system,info ip service changed by admin
00:26:15 vrrp,info HA_VRRP now BACKUP
00:26:19 interface,info ether8 link up (speed 100M, full duplex)
00:26:24 vrrp,info HA_VRRP now MASTER, master down timer
00:26:26 interface,info ether1 link up (speed 100M, full duplex)
00:27:14 system,info,account user admin logged in from 20:CF:30:C1:88:C7 via winbox
00:27:14 system,info,account user admin logged in via local

/file print

Code: Select all

[admin@MikroTik_HA_A_ACTIVE] > /file print
# NAME TYPE SIZE CREATION-TIME
0 HA_init.rsc script 28.2KiB jan/02/1970 00:25:20
1 HA_backup_beforeHA.backup backup 37.4KiB jan/02/1970 00:26:11
2 HA_backup_beforeHA.rsc script 30.0KiB jan/02/1970 00:26:13
3 pub directory jan/02/1970 00:26:13
4 HA_boot_interface_print.txt .txt file 1909 jan/02/1970 00:26:14

Thanks again Nathan1.
The init script from github is the same, i haven't added or removed any line.
Yes you're right, this is router A active. This is the same with router A when it becomes standby itself after bootstrap of router B
I've doing some tests, and if i enable ftp server on router A and i set vrrp priority of router A to 101, then A becomes active and all is working well. Also, i have to update the 60 seconds delay on Switchrole script because the router takes more time to reboot.

#So you dont get annoyed with constant beeping - try catch because this may fail on some platforms (x86).
:do {/system routerboard settings set silent-boot=yes} on-error={};

:foreach service in=[:toarray "ftp"] do={
   :local serviceAddresses ""
   :foreach k in=[/ip service get [find name=$service] address] do={
      :if ($k != "$haAddressA/32" and $k != "$haAddressB/32" and $k != "$haAddressVRRP/32") do={
         :set serviceAddresses "$serviceAddresses,$k"
      }
   }
   :set serviceAddresses "$serviceAddresses,$haAddressA,$haAddressB,$haAddressVRRP"
   /ip service set [find name=$service] address=[:toarray $serviceAddresses]
}

$HAPushBackup seems to do nothing.
If i run on active (router B), i can see at log file how user ha has logged in and out, but if i run $HAPushBackup on standby (router A), i can't see any log on active (router B)

The result of $HAPushStandby, router A (standby) reboots

Code: Select all

[admin@MikroTik_HA_B_ACTIVE] > $HAPushStandby
mkdirCode: :foreach k in=[/file find type!="directory"] do={ :local xferfile [/file get $k name]; if ([:pick "$xferfile" 0 3] != "HA_") do={ :put "removing $
xferfile"; /file remove $k; } };
/delay 2;
:do { /ip smb shares add comment=HA_AUTO name=mkdir disabled=yes directory=/skins } on-error={}
/ip smb shares set [find comment=HA_AUTO] directory="pub"
/ip smb shares set [find comment=HA_AUTO] directory="skins"
/ip smb shares remove [find comment=HA_AUTO]
end_mkDirCode
status: finished
downloaded: 0KiB
total: 0KiB
duration: 3s

status: finished
downloaded: 0KiBC-z pause]
total: 0KiB
duration: 1s

status: finished
downloaded: 1KiBC-z pause]
total: 1KiB
duration: 1s

status: finished
downloaded: 0KiBC-z pause]
total: 0KiB
duration: 1s

Saving system configuration
Configuration backup saved
status: finished
downloaded: 32KiB-z pause]
total: 32KiB
duration: 1s

status: finished
downloaded: 44KiB-z pause]
total: 44KiB
duration: 1s

status: failed

OK - status failed is OK from last fetch, standby is rebooting.
[admin@MikroTik_HA_B_ACTIVE] >

Ftp was enabled when i put that code

Code: Select all

[admin@MikroTik_HA_A_STANDBY] > :if ([:len [/file find where name="HA_run-after-hastartup.rsc"]] > 0) do={
{... /import HA_run-after-hastartup.rsc
{... }
[admin@MikroTik_HA_A_STANDBY] > /delay 5
[admin@MikroTik_HA_A_STANDBY] > #We need FTP to do our HA work
[admin@MikroTik_HA_A_STANDBY] > /ip service set [find name="ftp"] disabled = no

And after that, ftp is always enabled

Hi nathan1

This solution can work on the Chr version?

Hi nathan1

This solution can work on the Chr version?

$HASwitchRole now is working. Router A becomes active after run that command, but when router B reboots, router A change its role to standby and always router B becomes active router

Code: Select all

[admin@MikroTik_HA_A_STANDBY] > log print
00:25:28 system,info router rebooted
00:25:28 health,warning PSU2 entered state FAIL
00:25:29 script,warning ha_startup: START
00:25:29 script,warning ha_startup: 0.1
00:25:29 script,warning ha_startup: 0.2
00:25:31 vrrp,info HA_VRRP now BACKUP
00:25:31 script,warning ha_startup: 0.3
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 script,warning ha_startup: version 0.6 - 8b14022883a2b1e541d1579e70e11b6bd023d601
00:25:31 script,warning ha_startup: 1 ether8
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info system identity changed by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info new script scheduled by admin
00:25:31 system,info new script scheduled by admin
00:25:31 script,warning ha_startup: 2
00:25:31 system,info device changed by admin
00:25:31 system,info address removed by admin
00:25:31 system,info address removed by admin
00:25:31 system,info device removed by admin
00:25:31 system,info filter rule removed by admin
00:25:31 system,info filter rule removed by admin
00:25:31 system,info ip service changed by admin
00:25:31 system,info device changed by admin
00:25:31 script,warning ha_startup: 2.1 1
00:25:31 script,warning ha_startup: 2.2 1
00:25:31 script,warning ha_startup: 3 74:4D:28:C7:80:BB 1
00:25:31 script,warning ha_startup: 3.1 74:4D:28:C7:80:BB 1
00:25:31 script,warning I AM A
00:25:31 system,info address added by admin
00:25:31 system,info route removed by admin
00:25:31 system,info route added by admin
00:25:32 script,warning ha_startup: 4
00:25:32 script,warning ha_startup: 4.1
00:25:32 system,info filter rule added by admin
00:25:32 system,info filter rule added by admin
00:25:32 script,warning ha_startup: 4.3
00:25:32 script,warning ha_startup: 5
00:25:32 system,info device added by admin
00:25:32 system,info address added by admin
00:25:32 script,warning ha_startup: 6
00:25:32 system,info new script scheduled by admin
00:25:32 system,info new script scheduled by admin
00:25:32 system,info new script scheduled by admin
00:25:32 script,warning ha_startup: 7
00:25:32 vrrp,info HA_VRRP now BACKUP
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info system identity changed by admin
00:25:32 system,info user ha removed by admin
00:25:32 system,info user ha added by admin
00:25:32 script,warning ha_startup: 8
00:25:32 system,info tile rb settings changed by admin
00:25:32 system,info ip service changed by admin
00:25:33 interface,info ether8 link up (speed 100M, full duplex)
00:25:37 system,info ip service changed by admin
00:25:37 script,warning ha_startup: DONE
00:25:40 vrrp,info HA_VRRP now MASTER, master down timer
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:41 system,info device changed by admin
00:25:42 system,info device changed by admin
00:25:42 system,info system identity changed by admin
00:25:42 interface,info ether1 link up (speed 100M, full duplex)
00:26:03 vrrp,info HA_VRRP now BACKUP, got higher priority 100 from 169.254.23.2
00:26:03 interface,info ether1 link down
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:04 system,info device changed by admin
00:26:04 system,info system identity changed by admin
00:26:07 vrrp,info HA_VRRP now MASTER, master down timer
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:08 system,info device changed by admin
00:26:09 system,info device changed by admin
00:26:09 system,info system identity changed by admin
00:26:12 interface,info ether1 link up (speed 100M, full duplex)
00:26:33 system,info,account user admin logged in from 20:CF:30:C1:88:C7 via winbox
00:26:34 script,info ha_startup: ha_report_startup debug version=6.44.5 (long-term) firmware=6.44.3 badC=0 goodC=1 delay1C=0 delay2C=0 uptime=00:01:28 isMaster=
true haInitTries=1 haStartupHasRun=00:00:23 haStartupHAVersion=0.6 - 8b14022883a2b1e541d1579e70e11b6bd023d601
00:26:34 system,info,account user admin logged in via local
00:27:15 vrrp,info HA_VRRP now BACKUP, got higher priority 100 from 169.254.23.2
00:27:15 interface,info ether1 link down
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info system identity changed by admin
00:27:16 system,info,account user admin logged out from 20:CF:30:C1:88:C7 via winbox
00:27:16 system,info,account user admin logged out via local
00:28:28 system,info,account user admin logged in from 20:CF:30:C1:88:C7 via winbox
00:28:28 system,info,account user admin logged in via local

$HASwitchRole now is working. Router A becomes active after run that command, but when router B reboots, router A change its role to standby and always router B becomes active router

Code: Select all

[admin@MikroTik_HA_A_STANDBY] > log print
00:25:28 system,info router rebooted
00:25:28 health,warning PSU2 entered state FAIL
00:25:29 script,warning ha_startup: START
00:25:29 script,warning ha_startup: 0.1
00:25:29 script,warning ha_startup: 0.2
00:25:31 vrrp,info HA_VRRP now BACKUP
00:25:31 script,warning ha_startup: 0.3
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 system,info device changed by admin
00:25:31 script,warning ha_startup: version 0.6 - 8b14022883a2b1e541d1579e70e11b6bd023d601
00:25:31 script,warning ha_startup: 1 ether8
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info system identity changed by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info script removed from scheduler by admin
00:25:31 system,info new script scheduled by admin
00:25:31 system,info new script scheduled by admin
00:25:31 script,warning ha_startup: 2
00:25:31 system,info device changed by admin
00:25:31 system,info address removed by admin
00:25:31 system,info address removed by admin
00:25:31 system,info device removed by admin
00:25:31 system,info filter rule removed by admin
00:25:31 system,info filter rule removed by admin
00:25:31 system,info ip service changed by admin
00:25:31 system,info device changed by admin
00:25:31 script,warning ha_startup: 2.1 1
00:25:31 script,warning ha_startup: 2.2 1
00:25:31 script,warning ha_startup: 3 74:4D:28:C7:80:BB 1
00:25:31 script,warning ha_startup: 3.1 74:4D:28:C7:80:BB 1
00:25:31 script,warning I AM A
00:25:31 system,info address added by admin
00:25:31 system,info route removed by admin
00:25:31 system,info route added by admin
00:25:32 script,warning ha_startup: 4
00:25:32 script,warning ha_startup: 4.1
00:25:32 system,info filter rule added by admin
00:25:32 system,info filter rule added by admin
00:25:32 script,warning ha_startup: 4.3
00:25:32 script,warning ha_startup: 5
00:25:32 system,info device added by admin
00:25:32 system,info address added by admin
00:25:32 script,warning ha_startup: 6
00:25:32 system,info new script scheduled by admin
00:25:32 system,info new script scheduled by admin
00:25:32 system,info new script scheduled by admin
00:25:32 script,warning ha_startup: 7
00:25:32 vrrp,info HA_VRRP now BACKUP
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info device changed by admin
00:25:32 system,info system identity changed by admin
00:25:32 system,info user ha removed by admin
00:25:32 system,info user ha added by admin
00:25:32 script,warning ha_startup: 8
00:25:32 system,info tile rb settings changed by admin
00:25:32 system,info ip service changed by admin
00:25:33 interface,info ether8 link up (speed 100M, full duplex)
00:25:37 system,info ip service changed by admin
00:25:37 script,warning ha_startup: DONE
00:25:40 vrrp,info HA_VRRP now MASTER, master down timer
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:40 system,info device changed by admin
00:25:41 system,info device changed by admin
00:25:42 system,info device changed by admin
00:25:42 system,info system identity changed by admin
00:25:42 interface,info ether1 link up (speed 100M, full duplex)
00:26:03 vrrp,info HA_VRRP now BACKUP, got higher priority 100 from 169.254.23.2
00:26:03 interface,info ether1 link down
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:03 system,info device changed by admin
00:26:04 system,info device changed by admin
00:26:04 system,info system identity changed by admin
00:26:07 vrrp,info HA_VRRP now MASTER, master down timer
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:07 system,info device changed by admin
00:26:08 system,info device changed by admin
00:26:09 system,info device changed by admin
00:26:09 system,info system identity changed by admin
00:26:12 interface,info ether1 link up (speed 100M, full duplex)
00:26:33 system,info,account user admin logged in from 20:CF:30:C1:88:C7 via winbox
00:26:34 script,info ha_startup: ha_report_startup debug version=6.44.5 (long-term) firmware=6.44.3 badC=0 goodC=1 delay1C=0 delay2C=0 uptime=00:01:28 isMaster=
true haInitTries=1 haStartupHasRun=00:00:23 haStartupHAVersion=0.6 - 8b14022883a2b1e541d1579e70e11b6bd023d601
00:26:34 system,info,account user admin logged in via local
00:27:15 vrrp,info HA_VRRP now BACKUP, got higher priority 100 from 169.254.23.2
00:27:15 interface,info ether1 link down
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info device changed by admin
00:27:15 system,info system identity changed by admin
00:27:16 system,info,account user admin logged out from 20:CF:30:C1:88:C7 via winbox
00:27:16 system,info,account user admin logged out via local
00:28:28 system,info,account user admin logged in from 20:CF:30:C1:88:C7 via winbox
00:28:28 system,info,account user admin logged in via local

Do you have these in an isolated lab setup? Would it be possible for you to screen share to me so I can take a look in realtime? We can take it to private message for debugging if that works.

00:26:03 vrrp,info HA_VRRP now BACKUP, got higher priority 100 from 169.254.23.2

Hi My last time I had played with this was very time ago

I am trying to play it again but I can't find it to make it work

I got stuck after importing the file to load the scripts them I do not what to do it

I past this on the terminal but nothing happens
`$HAInstall interface="ether3" macA="00:0C:29:42:A6:67" macB="00:0C:29:D8:83:02" password="1q2w3e4r5t6y"`

yes I imported
no no error /no logs

last stable one

When I load the ha_init.rsc I got this msg
that was loaded
if I go to the sys scripts I see a bunch of scripts added

6.45.6
When I run I just got a blank space like is was no value


"
[admin@MikroTik1] > :put $HAInstall

[admin@MikroTik1] >

"

Actually, can you do "/interface vrrp print" on both? Did you keep that vrrp priority change that you temporarily added? They should both be 100 and it should be reset by ha_startup, ha-mikrotik does not support different VRRP priorities - it has no preference for A vs B and cannot currently support this.

Actually, can you do "/interface vrrp print" on both? Did you keep that vrrp priority change that you temporarily added? They should both be 100 and it should be reset by ha_startup, ha-mikrotik does not support different VRRP priorities - it has no preference for A vs B and cannot currently support this.

/interface vrrp print

Code: Select all

[admin@MikroTik_HA_B_ACTIVE] > interface vrrp print
Flags: X - disabled, I - invalid, R - running, M - master, B - backup
# NAME INTERFACE MAC-ADDRESS VRID PRIORITY INTERVAL VERSION V3-PROTOCOL
0 RM HA_VRRP ether8 00:00:5E:00:01:01 1 100 1s 3 ipv4

If I change priority of router A by hand, A becomes active router, but if I run $HASwitchRole, the change is reverted and it's 100 back again, that's correct.
I can share my screen no problem, let's talk by PM if you want, thanks a lot for your time Nathan1

The problem is after switchrole. When active reboots, always B becomes active router. The sequence is as follows:

Router B(active) - switchrole - router A (standby) reboots - router B reboots also after a 60s delay - router A is online again at first as active - router B is online a little bit time that router A - router B becomes active - router A becomes standby again

So, switchrole is performed, but automatically reverted after reboot. Router A is active only a few seconds.

Regards

Hello,
trying to install ha-mikrotik on two fresh long term ROS 6.44.5 CCR1036-8G-2S+ :
On the first node:
[admin@HA-1] > /import HA_init.rsc

Script file loaded and executed successfully
[admin@HA-1] > $HAInstall interface="ether8" macA="CC:2D:E0:BD:9F:A8" macB="CC:2D:E0:BD:9F:D4" password="passw0rd"
CC:2D:E0:BD:9F:A8
CC:2D:E0:BD:9F:D4
SEQ HOST SIZE TTL TIME STATUS
0 CC:2D:E0:BD:9F:D4 70 0ms
sent=1 received=1 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!! 01:02:33
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "CC:2D:E0:BD:9F:A8" and $mac = "CC:2D:E0:BD:9F:D4") do={
:error "Interface ether8 MAC $mac does not match (A=CC:2D:E0:BD:9F:A8 or B=CC:2D:E0:BD:9F:D4) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
/system backup save name=HA_backup_beforeHA dont-encrypt=yes
/export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"passw0rd\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###

On second node:
Used part of config above, node restarted and nothing happens. If I run manually HA_bootstrap.rsc on second node, I'll get an error:
[admin@MikroTik] > /import HA_bootstrap.rsc
failure: local address cannot be 0.0.0.0
[admin@MikroTik] >

also user ha has not been created on the second node.

I have seen above that people successfully used ha-mikrotik on ROS 6.44.5
Any suggestions ?

Thanks for this great script, i try to get it working on two CCR1009-7G-1C-1S+.
After Some troubles it seems to work.

Another question, is there any possibility to use the usr-led for showing which router is active and which one is passive?

Thanks in advance.

Hi,
but i need to add those scripts on the vrrp (on Master and on Backup) or?
Or is there any logic included, that all scripts with *_on_backup will be executed?
Thanks

Thanks!
It's working now

Just another question, if I execute SwitchRole i get the following output:

Code: Select all

/delay 2;
:do { /ip smb shares add comment=HA_AUTO name=mkdir disabled=yes directory=/skins } on-error={}
/ip smb shares set [find comment=HA_AUTO] directory="pub"
/ip smb shares set [find comment=HA_AUTO] directory="skins"
/ip smb shares remove [find comment=HA_AUTO]
 end_mkDirCode
      status: finished
  downloaded: 0KiB
       total: 0KiB
    duration: 3s

      status: finished
  downloaded: 0KiBC-z pause]
       total: 0KiB
    duration: 1s

      status: finished
  downloaded: 1KiBC-z pause]
       total: 1KiB
    duration: 1s

      status: finished
  downloaded: 0KiBC-z pause]
       total: 0KiB
    duration: 1s

Saving system configuration
Configuration backup saved
      status: finished
  downloaded: 32KiB-z pause]
       total: 32KiB
    duration: 1s

      status: finished
  downloaded: 45KiB-z pause]
       total: 45KiB
    duration: 1s

  status: failed

OK - status failed is OK from last fetch, standby is rebooting.
delaying 60

Just asking because the status : failed
Is that a critical issue? Or is there any configuration error.

OK,
One Last question, would it be possible to secure the Sync Ports especually through EOIP Tunnel or something?

I need to make a Setup where the routers are not placed in the same room.

And is it possible to build IPSec Tunnels with certificates? With PSK it works great in a failover, but will the certificates also get synced between activ and passive?

Thanks!

OK, yes the layer2 ist extented but i would use a complete different way for Sync. So If i Install a EOIP Tunnel before hainstall would this Work if i select the EOIP Interface?

May you Share your Script?

/system scheduler
add name=on_reboot_fix_certifcates on-event="/certificate remove [find]\
    \n/certificate import file-name=SOMEWHERE.com.crt passphrase=\"\"\
    \n/certificate import file-name=SOMEWHERE.com.key passphrase=PASSPHRASE" \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive start-time=startup

Thanks for sharing your script.

Yes, i was thinking about a man in the middle Attack on this Board. As far as i know the file Sync goes through smb or FTP? So with man in the middle you can gather information about PSK etc.

Or i am completley wrong?

I know it depends on my different Setup were the routers Not placed in the same room.

I agree with you more devices in the Sync Channel reduces the available.

Thanks for discussion!

Hello,
trying to install ha-mikrotik on two fresh long term ROS 6.44.5 CCR1036-8G-2S+ :
On the first node:
[admin@HA-1] > /import HA_init.rsc

Script file loaded and executed successfully
[admin@HA-1] > $HAInstall interface="ether8" macA="CC:2D:E0:BD:9F:A8" macB="CC:2D:E0:BD:9F:D4" password="passw0rd"
CC:2D:E0:BD:9F:A8
CC:2D:E0:BD:9F:D4
SEQ HOST SIZE TTL TIME STATUS
0 CC:2D:E0:BD:9F:D4 70 0ms
sent=1 received=1 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!! 01:02:33
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "CC:2D:E0:BD:9F:A8" and $mac = "CC:2D:E0:BD:9F:D4") do={
:error "Interface ether8 MAC $mac does not match (A=CC:2D:E0:BD:9F:A8 or B=CC:2D:E0:BD:9F:D4) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
/system backup save name=HA_backup_beforeHA dont-encrypt=yes
/export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"passw0rd\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###

On second node:
Used part of config above, node restarted and nothing happens. If I run manually HA_bootstrap.rsc on second node, I'll get an error:
[admin@MikroTik] > /import HA_bootstrap.rsc
failure: local address cannot be 0.0.0.0
[admin@MikroTik] >

also user ha has not been created on the second node.

I have seen above that people successfully used ha-mikrotik on ROS 6.44.5
Any suggestions ?

Hello,
trying to install ha-mikrotik on two fresh long term ROS 6.44.5 CCR1036-8G-2S+ :
On the first node:
[admin@HA-1] > /import HA_init.rsc

Script file loaded and executed successfully
[admin@HA-1] > $HAInstall interface="ether8" macA="CC:2D:E0:BD:9F:A8" macB="CC:2D:E0:BD:9F:D4" password="passw0rd"
CC:2D:E0:BD:9F:A8
CC:2D:E0:BD:9F:D4
SEQ HOST SIZE TTL TIME STATUS
0 CC:2D:E0:BD:9F:D4 70 0ms
sent=1 received=1 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!! 01:02:33
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "CC:2D:E0:BD:9F:A8" and $mac = "CC:2D:E0:BD:9F:D4") do={
:error "Interface ether8 MAC $mac does not match (A=CC:2D:E0:BD:9F:A8 or B=CC:2D:E0:BD:9F:D4) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
/system backup save name=HA_backup_beforeHA dont-encrypt=yes
/export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"passw0rd\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###

On second node:
Used part of config above, node restarted and nothing happens. If I run manually HA_bootstrap.rsc on second node, I'll get an error:
[admin@MikroTik] > /import HA_bootstrap.rsc
failure: local address cannot be 0.0.0.0
[admin@MikroTik] >

also user ha has not been created on the second node.

I have seen above that people successfully used ha-mikrotik on ROS 6.44.5
Any suggestions ?

Has there been any more progress on this? I'm stuck at the same position, and am about to completely disassemble the script and start from scratch if it fails on this error.

Hi Nathan,

Nice project, I'm impressed. I'm preparing to switch from my no longer supported SonicWall NSA 2400 to two CCR1009-7G-1C-1S+ (2nd revision). I was trying out your project. As far as I can tell at this moment it works on 6.44.5. The configuration is synchronised, and manually rebooting the Active makes the Backup Active.

To make it work, I needed to change your script, I think you have hard coded ether8 as the HA connection. I had to switch this to ether7 to make the script work.

Can you advise me what the proper method is to make the failover work from the command line? If I reboot the router manually it takes slightly long for the standby to become active.

Do I understand correctly that the VRRP only monitors the connection between the two devices? So for example if WAN1 goes down on the Active it doesn't switch to the Backup if the WAN1 is up on the Backup?

Hi Nathan,

Any progress why it not working in newer version? Maybe script level permissions?
And yes this solution need to be implemented by Mt team. I totally aprove it [emoji6]
Maybe in v7 who knows.
I was playing with this in 2 vm and is very cool [emoji41]
Thanks for this hard work and time.



Sent from my Moto Z3 Play using Tapatalk

I'm having an odd issue with running the script on 6.44.5. The setup on the first router goes fine, but the commands to run to bootstrap router B seem incomplete which seems to cause the bootstrap to fail. Below is my output. It seems as if $HAAddressOther isn't getting populated. Any ideas on what's causing this? I'm running it in a GNS3 environment.

This is the line that is causing the issues;
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"Password123\";"

Code: Select all

[admin@MikroTik] > $haInstall interface="ether8" macA="0C:8B:8E:52:EC:07" macB="0C:8B:8E:57:6B:07" password="Password123"
0C:8B:8E:52:EC:07
0C:8B:8E:57:6B:07
  SEQ HOST                                     SIZE TTL TIME  STATUS
    0 0C:8B:8E:57:6B:07                          70     2ms
    sent=1 received=1 packet-loss=0% min-rtt=2ms avg-rtt=2ms max-rtt=2ms

Saving system configuration
Configuration backup saved
I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!!  00:04:08
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "0C:8B:8E:52:EC:07" and $mac = "0C:8B:8E:57:6B:07") do={
   :error "Interface ether8 MAC $mac does not match (A=0C:8B:8E:52:EC:07 or B=0C:8B:8E:57:6B:07) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
   /system backup save name=HA_backup_beforeHA dont-encrypt=yes
   /export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"Password123\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###
###

The code I copied was right after running $HAInstall on RouterA. I ran the code $haInstall exported on RouterB, but it didn't appear to work. RouterB restarted, but after the restart, it never ran HA_bootstrap.rsc. I tried importing the HA_bootstrap.rsc file on RouterB manually, but it just failed due to a blank IP address. I then tried running the commands manually, but it wouldn't allow me to run
IP address add address=\"/24\"
as the IP address was blank.

Correct. Absolutely. Let me know when/what works for you.

Hello,
trying to install ha-mikrotik on two fresh long term ROS 6.44.5 CCR1036-8G-2S+ :
On the first node:
[admin@HA-1] > /import HA_init.rsc

Script file loaded and executed successfully
[admin@HA-1] > $HAInstall interface="ether8" macA="CC:2D:E0:BD:9F:A8" macB="CC:2D:E0:BD:9F:D4" password="passw0rd"
CC:2D:E0:BD:9F:A8
CC:2D:E0:BD:9F:D4
SEQ HOST SIZE TTL TIME STATUS
0 CC:2D:E0:BD:9F:D4 70 0ms
sent=1 received=1 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!! 01:02:33
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "CC:2D:E0:BD:9F:A8" and $mac = "CC:2D:E0:BD:9F:D4") do={
:error "Interface ether8 MAC $mac does not match (A=CC:2D:E0:BD:9F:A8 or B=CC:2D:E0:BD:9F:D4) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
/system backup save name=HA_backup_beforeHA dont-encrypt=yes
/export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"passw0rd\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###

On second node:
Used part of config above, node restarted and nothing happens. If I run manually HA_bootstrap.rsc on second node, I'll get an error:
[admin@MikroTik] > /import HA_bootstrap.rsc
failure: local address cannot be 0.0.0.0
[admin@MikroTik] >

also user ha has not been created on the second node.

I have seen above that people successfully used ha-mikrotik on ROS 6.44.5
Any suggestions ?

Has there been any more progress on this? I'm stuck at the same position, and am about to completely disassemble the script and start from scratch if it fails on this error.

The user emailed me and I attempted to help them but they never responded. Can you provide me access to your kit? I still haven't seen this in the wild and I am unable to reproduce it.

Hello,
trying to install ha-mikrotik on two fresh long term ROS 6.44.5 CCR1036-8G-2S+ :
On the first node:
[admin@HA-1] > /import HA_init.rsc

Script file loaded and executed successfully
[admin@HA-1] > $HAInstall interface="ether8" macA="CC:2D:E0:BD:9F:A8" macB="CC:2D:E0:BD:9F:D4" password="passw0rd"
CC:2D:E0:BD:9F:A8
CC:2D:E0:BD:9F:D4
SEQ HOST SIZE TTL TIME STATUS
0 CC:2D:E0:BD:9F:D4 70 0ms
sent=1 received=1 packet-loss=0% min-rtt=0ms avg-rtt=0ms max-rtt=0ms

I am not master - running ha_startup first
ha_startup: ERROR ATTEMPTED TO RUN AGAIN!!! 01:02:33
###
#Maybe try: /tool mac-telnet
###PASTE THIS ON THE OTHER DEVICE - YOUR CONFIG WILL BE RESET AND LOST!!!###
:global mac [[/interface ethernet get [find default-name="ether8"] orig-mac-address]]
:if ($mac = "CC:2D:E0:BD:9F:A8" and $mac = "CC:2D:E0:BD:9F:D4") do={
:error "Interface ether8 MAC $mac does not match (A=CC:2D:E0:BD:9F:A8 or B=CC:2D:E0:BD:9F:D4) - please check config\r\nUse orig-mac address!"
}
:if ([:len [/file find name=HA_backup_beforeHA.backup]] = 0) do={
/system backup save name=HA_backup_beforeHA dont-encrypt=yes
/export file=HA_backup_beforeHA.rsc
}
/export file=HA_bootstrap.rsc
/delay 2
/file print file=HA_bootstrap.rsc
/file set [find name=HA_bootstrap.rsc] contents="/ip address add address=\"/24\" interface=ether8; /user add name=ha group=full password=\"passw0rd\";"
/system reset-configuration no-defaults=yes keep-users=no skip-backup=yes run-after-reset=HA_bootstrap.rsc
###END OF PASTE FOR OTHER DEVICE###

On second node:
Used part of config above, node restarted and nothing happens. If I run manually HA_bootstrap.rsc on second node, I'll get an error:
[admin@MikroTik] > /import HA_bootstrap.rsc
failure: local address cannot be 0.0.0.0
[admin@MikroTik] >

also user ha has not been created on the second node.

I have seen above that people successfully used ha-mikrotik on ROS 6.44.5
Any suggestions ?

Has there been any more progress on this? I'm stuck at the same position, and am about to completely disassemble the script and start from scratch if it fails on this error.

The user emailed me and I attempted to help them but they never responded. Can you provide me access to your kit? I still haven't seen this in the wild and I am unable to reproduce it.

Issue is in line 401 in the bridge definition. Fixed by removing fast forward:

\n /interface bridge add name=\"bridge-\$haInterface\" protocol-mode=none comment=\"HA_AUTO\"\

What was the error/issue you were having? It looks like you edited your original post.