Multi-active condition with AH authentication

Hi guys!

I'm using keepalived 1.2.13 on debian 7.8 (3.16.7 kernel from backports 
is used) as a VRRP solution. So the cluster consists of two nodes, one 
VRRP instance. Here are the configs from active:

vrrp_instance LAN {
state MASTER
interface eth0
virtual_router_id 7
priotity 200
advert_int 2
garp_master_delay 1
#nopreempt
preempt
preempt_delay 2
notify_fault "/etc/keepalived/gw_vrrp_master_down"
notify_backup "/etc/keepalived/gw_vrrp_master_down"
notify_master "/etc/keepalived/gw_vrrp_master_up"
authentication {
         auth_type AH
         auth_pass 12345678
}
virtual_ipaddress {
         10.1.64.155
}
}


And here are from the standby:

vrrp_instance LAN {
state BACKUP
interface eth0
virtual_router_id 7
priority 100
advert_int 1
garp_master_delay 1
nopreempt
#preempt
#preempt_delay 2
notify_fault "/etc/keepalived/gw_vrrp_master_down"
notify_backup "/etc/keepalived/gw_vrrp_master_down"
notify_master "/etc/keepalived/gw_vrrp_master_up"
authentication {
         auth_type AH
         auth_pass 12345678
}
virtual_ipaddress {
         10.1.64.155
}
}

The problem is the following - after the failure of one of the nodes 
(reboot/fail of switch between the nodes/etc) when it comes up again we 
run into a condition when both nodes consider themselves as the MASTER. 
And following logs are written on the one that is considered to be 
MASTER:

Sep 11 08:51:26 office-02 Keepalived_vrrp[15800]: bogus VRRP packet 
received on eth0 !!!
Sep 11 08:51:26 office-02 Keepalived_vrrp[15800]: VRRP_Instance(LAN) 
Dropping received VRRP packet...
Sep 11 08:51:27 office-02 Keepalived_vrrp[15800]: VRRP_Instance(LAN) 
IPSEC-AH : sequence number 944232 already proceeded. Packet dropped. 
Local(945699)

And there are a lot of similar messages generated. I know that it is not 
recommended at all to use AH authentication, but it would be an issue 
for me if the password will be actually broadcasted in cleartext over my 
LAN. So actually I need some kind of secure VRRP solution.

Any ideas? Probably, I've misconfigured something, or there is some kind 
of workaround, etc.

Any help will be appreciated. Thanks in advance!


-- 
With kind regards,
Aleksey

------------------------------------------------------------------------------