Some Remote Access VPN clients are not able to connect to ClusterXL in Load Sharing Unicast mode.
Kernel debug ('fw ctl debug -m cluster + select') on the non-Pivot cluster member shows that sometimes the Source MAC of VPN packets is inverted incorrectly (refer to lines "fwha_select_ip_packet: The inverted back source MAC address will be ...").
Disabling CoreXL on all cluster members resolves the issue.