Technical Tip: Enabling or disabling HA heartbeat encryption and authentication

It is possible to enable or disable HA heartbeat encryption and authentication to encrypt and authenticate HA heartbeat packets.

HA heartbeat packets should be encrypted and authenticated if the cluster interfaces that send HA heartbeat packets are also connected to the networks.

If HA heartbeat packets are not encrypted, the cluster password will be exposed.

If HA heartbeat packets are not authenticated, an attacker may be able to sniff HA pages to get cluster information.

Enabling HA encryption and authentication could reduce cluster performance.

Command syntax.

config system ha
    set authentication {disable | enable}
    set encryption {disable | enable}
end

'authentication {disable | enable}'.

Enable/disable HA heartbeat message authentication. Enabling HA heartbeat message authentication prevents an attacker from creating false HA heartbeat messages.

False HA heartbeat messages could affect the stability of the cluster.

Authentication is disabled by default.

If authentication is failing, the following errors appear in the HA talk debugs. 

FGT# diagnose debug reset

FGT# diagnose debug application hatalk -1

FGT# diagnose debug console timestamp enable

FGT# diagnose debug enable

2025-09-16 20:49:34 <hasync:WARN> Error sync=6, len = 16
2025-09-16 20:49:34 <hasync:WARN> conn=0x6c50460 abort: rt=-1, dst=192.168.1.2, sync_type=-1(unknown)
b2025-09-16 20:49:34 <hatalk:ERRO> [__aes128_gcm_sha256_disclose:456] auth 'FPXxxxxxxxx' packet failed

'encryption {disable | enable}'.

Enable/disable HA heartbeat message encryption. Enabling HA heartbeat message encryption prevents an attacker from sniffing HA packets to get HA cluster information.

Encryption is disabled by default.

Related articles:

Technical Tip: HA heartbeat encryption and authentication example 

Technical Tip: Encryption & Authentication of HA traffic via IKE daemon