You cannot connect directly to a passive HA Screen, nor can you connect from one HA Screen to another, except with remote administration to the HA interface. You can allow:
Services and service groups other than the standard HA services
Remote administration
Router discover
Heartbeat (the communication between or among HA Screens to assure that the dedicated HA network is working)
Adding additional services or service groups may be useful; for example, if you need to copy Solaris system files between the HA hosts or to be able to log into the active HA Screen remotely and then connect to the primary administration HA host with telnet. Adding a service to the HA service group circumvents the passive HA mode and allows the traffic that the added service permits through the SunScreen filters.
You can add any services to the HA service group by selecting Service in the Type list on the Edit Policy page, saving the change, and reactivating the configuration.
The services or service groups that you add to the HA service group are allowed only between the HA hosts.