The problem with table.def modifications is they get wiped out by every upgrade, and upgrades are infrequent enough that everyone has forgotten about the modifications by the time one rolls around. We then have to deal with whatever it was being broken for a week while we rediscover the modification.
I just went through that for something minor after upgrading to R82. I don't want to do it again for R82.10 for something bigger like my cluster members' ability to get to the Internet to fetch updates, or to get to my RADIUS servers so I can log in to half of them. We don't yet have automated testing of authentication, so it would take time for people to even notice how widespread the problem is.
I opened a ticket with diamond for problems connecting out from my standby members for AV/AB/IPS updates, and the solution was originally fwha_cluster_hide_active_only. We went through the process of deploying that everywhere, then a few months ago, we started having the same problem again. Opened another ticket, and our diamond reps said we needed to get rid of the kernel parameter and use a no-NAT rule instead.
