Connections initiated from the Standby member (e.g., SSH, FTP) in ClusterXL High Availability might time out when the value of kernel parameter "fwha_sync_broadcast_ack" is set to "1" per sk20576 (at least on the Active member).
SSH connection fails (times out) in the following topology:
Host --> (int)[Active](ext) --> [switch] --> (ext)[Standby]
Traffic capture and cluster debug ('fw ctl debug -m cluster + forward') show that the SSH packet reaches the Active member and forwarded to the Standby over the Sync network (as designed).
However, Standby does not respond to this SSH connection.
Cause
By the current design, setting CCP mode to Broadcast is not applied to Sync interfaces.