Security Hearbeat over SSL VPN doesn't work

Hello Gianluca Maistri ,

Thank you for reaching out to the community, yes the following NC-93720 was reported as Bug in v19.0 GA but has been fixed in the following versions - v19.5.0 GA, v19.0.1 MR-1.
Can you share output of the following commands from the console: 
1.) system synchronized-security delay-missing-heartbeat-detection show 
2.) system synchronized-security suppress-missing-heartbeat-to-central show 

*Note - Ensure to share the output from both the nodes in HA

And is your HA mode deployed in A-A or A-P ?

Hello Gianluca Maistri ,

Thank you for reaching out to the community, yes the following NC-93720 was reported as Bug in v19.0 GA but has been fixed in the following versions - v19.5.0 GA, v19.0.1 MR-1.
Can you share output of the following commands from the console: 
1.) system synchronized-security delay-missing-heartbeat-detection show 
2.) system synchronized-security suppress-missing-heartbeat-to-central show 

*Note - Ensure to share the output from both the nodes in HA

And is your HA mode deployed in A-A or A-P ?

Thanks Vivek for your reply,

we have HA in active/stanby mode.

Here the answer we got:

system synchronized-security delay-missing-heartbeat-detection show

60

system synchronized-security suppress-missing-heartbeat-to-central show

0

I forgot to tell you that from zone LAN,  option "Block client without heartbeat"  works as expected.

Okay, can you also share the output from the aux appliance ?
And since when are you facing this issue , was there a failover occurred, or any power outage which lead to reboot ? 

No failover occured. We installed xgs a month ago.

From auxiliari we got:

60 for the first command 

% Error: Unknown parameter  'suppress-missing-heartbeat-to-central' for the second command

Try setting the delay-missing-heartbeat-detection to 270 seconds with the following command:

#system synchronized-security delay-missing-heartbeat-detection set seconds 270

And then check !

We succesfully set heartbeat timeout to 270 but problem still remains.

Thanks.

.

Hey Gianluca Maistri we would request you to log a support service request and share the service request id with us, so that we can expedite the process to narrow down the situation further.  

I have an "upgrade" about my question.

I found that the option "Block client without heartbeat" worked only if I had an endpoint installed and It didn't send heartbeat. It seems that with or without hearbeat but an endpoint must be installed to make this option active for the rule.