[northlandboy]

I would expect to see sourcemac=localmac, and sourceIP=VRRP IP, for all outbound connections from the secondary member. Some outbound connections won't be natted though - there is a file somewhere that defines which ones.

If you're running VRRP, I think you're better off turning off the "hide behind cluster IP" option - in fact, turn off all three options in 3rd party config, for slightly better performance.