ASP.NET protects forms authentication tickets and ViewState from tampering by signing them. Any modification made on the client or over the network is detected when the server processes the data.

That protection causes a specific problem in a web farm. ViewState generated on server A and posted back to server B will fail validation unless the <machineKey> is the same on every server in the farm or cluster, because the ViewState is signed with a key that is autogenerated per machine.

The exception looks like this:

Validation of viewstate MAC failed. If this application is hosted by a Web Farm or
cluster, ensure that <machineKey> configuration specifies the same validationKey and
validation algorithm. AutoGenerate cannot be used in a cluster.

The solution is to give every server in the farm the same key. Generate a hex encoded 64-bit or 128-bit <machineKey> and put the same one in each server's machine.config, or in the application's Web.config if you do not have machine-level access.

<system.web>
  <machineKey validationKey="..." decryptionKey="..."
              validation="SHA1" decryption="AES" />
</system.web>

You may find older advice, including an earlier version of this post, suggesting enableViewStateMac="false" as a workaround when you cannot change machine.config. Do not do that. Turning off MAC validation means ViewState can be tampered with, and that turned out to be exploitable for remote code execution. Microsoft addressed it in security update MS14-059, and as of .NET Framework 4.5.2 the setting is ignored entirely: ASP.NET always validates ViewState regardless of what the config says.

Matching the machine key across the farm was always the correct answer. Now it is the only one.