Configuring high availability secure heartbeats

Last published : Sep 24, 2026
The secure HA heartbeats feature provides replay-attack protection, authentication, and data integrity for High Availability (HA) heartbeat communication between NetScaler HA nodes. The feature secures heartbeat exchange using a pre-shared key (PSK) and sequence numbering to prevent unauthorized HA failovers.
The secure high availability heartbeats secure HA communication by ensuring the following:
  • Replay-attack prevention using sequence numbering with forward and backward protection
  • Authentication of peer HA nodes before accepting heartbeat packets
  • Integrity validation of heartbeat data after decryption
Some of the key benefits include:
  • Improved HA security
  • Reduced risk of denial-of-service conditions
  • Prevention of unauthorized HA failovers without changing standard HA behavior
Related information

Prerequisites

  • NetScaler appliances must already be configured as an HA pair.
  • Secure HA heartbeats must be configured separately on each HA node.
  • A pre-shared key (PSK) of length 8–15 characters is required.
  • The same PSK must be configured on both the Primary and Secondary nodes.

Limitations

  • Secure HA heartbeats depend on correct PSK configuration on both high availability nodes.
  • Heartbeat packets failing replay-window checks, authentication, or integrity validation are dropped.
  • Incorrect enable or disable sequencing might temporarily affect HA communication.

Configuring high availability secure heartbeats by using CLI

Secure HA heartbeats introduce an explicit configuration step to enable secured heartbeat exchange between HA nodes. Each appliance in an HA pair must be configured individually with the same pre-shared key (PSK). Secure HA heartbeats must be enabled by using the CLI before secure validation is enforced:
set HA secureheartbeats -state ENABLED -haPSK <pre-shared-key>
Heartbeat packets are validated only after the feature is enabled on both HA nodes.
You must follow the following sequence for enable and disable of the feature on primary and secondary nodes:
  • Enable Secure HA heartbeats on the Primary node first, followed by the Secondary node.
  • Disable Secure HA heartbeats on the Secondary node first, followed by the Primary node.
Run the following command to verify that the secure HA heartbeats feature is enabled:
> show ha secureheartbeats

        State:  ENABLED          HaPSK:  213a988866bc16833026d3fa30288b9ef6651c1720285bf1b43742a540ce3312afc48542

Done
To disable secure HA heartbeats, run the following command:
set HA secureheartbeats -state DISABLED

Monitoring and troubleshooting

Issue: HA nodes do not establish secure heartbeat communication or HA state transitions do not occur as expected.
Cause: Secure heartbeat validation might fail due to mismatched PSK configuration or replay-window rejection.
Solution:
  • Verify that Secure HA heartbeats are enabled on both HA nodes.
  • Ensure that the same PSK is configured on both nodes. If both nodes do not have the same PSK, then it might lead to a 'dual primary' scenario.
  • Confirm that the recommended enable or disable sequence is followed. If the sequence is not followed, it might lead to HA failover.