In a box-to-box failover scenario are the MAC addresses of both active and standby CSS11503s supposed to match up? The reason I ask relates to an issue where without clearing the ARP cache on the Default GW (a PIX with a default ARP timeout of 240 minutes) all services were unreachable via the VIPs.