Isolating VRRP traffic

Hello,

Sorry if this is the wrong mailing list to ask (can't find any users- group).

Three VMs running Debian Jessie with keepalived 1.2.13-1 installed
from packages (VRRP states are MASTER/BACKUP/BACKUP). Each VM has two
NICs (eth0 and eth1) with eth0 used for data traffic, and eth1 used
for VRRP advertisements only. The VLAN where eth1 is connected to is
isolated and non-routable.

Do you think this is a good idea to split it in such way? I understood
that 'auth_type PASS' doesn't really contribute to the security, and
for 'auth_type AH' to work I need to have groups of two?

Thanks in advance. My config is below (just in case).

global_defs {
        lvs_id QSRV01
}

vrrp_sync_group SyncGroup01 {
        group {
                QTEST
        }
}

vrrp_script check_haproxy {
        script "/bin/pidof haproxy"
        interval 2
}

vrrp_instance QTEST {
        state MASTER
        interface eth1
        virtual_router_id 10
        priority 150
        advert_int 1
        mcast_src_ip 172.16.10.12
        authentication {
                auth_type PASS
                auth_pass xxx
        }
        virtual_ipaddress {
                10.9.12.12 dev eth0
        }
        track_script {
                check_haproxy
        }
}

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot