VMware Fault Tolerance (FT) captures inputs and events that occur on a primary virtual machine and sends them to the secondary virtual machine, which is running on another host.
This logging traffic between the primary and secondary virtual machines is unencrypted and contains guest network and storage I/O data, as well as the memory contents of the guest operating system. This traffic might include sensitive data such as passwords in plain text. To avoid such data being divulged, ensure that this network is secured, especially to avoid man-in-the-middle attacks. For example, use a private network for FT logging traffic. You can also encrypt the FT logging traffic.
Activate Fault Tolerance Encryption
You can encrypt Fault Tolerance log traffic.
vSphere Fault Tolerance performs frequent checks between a primary VM and secondary VM so that the secondary VM can quickly resume from the last successful checkpoint. The checkpoint contains the VM state that has been modified since the previous checkpoint. You can encrypt Fault Tolerance log traffic.
When you turn on Fault Tolerance, FT encryption is set to Opportunistic by default, which means it activates encryption only if both the primary and secondary host are capable of encryption. Follow this procedure if you need to change the FT encryption mode manually.
