When using a Microsoft NLB (Network Load Balancing Manager) Cluster behind a Palo Alto Networks device, it is often necessary to add a static ARP entry for the MAC address of the clusters.
An indication that a manual ARP entry needs to be added is when the Palo Alto Networks firewall can reach each cluster member individually but not cluster itself.