Now, with more details, can the expert tell me what is missing? Two GWYs running the same SW version but only remote FW2 fails policy installation.
Here's the local GWY (HQ-FW1 - 172.16.0.111 is internal mgmt interface)
HQ-FW1 has 10.0.0.111 at its external interface
HQ-Mgr is 172.16.0.25 which has static NAT to 10.0.0.113 installed on HQ-FW1 (HQ-Mgr is internal of HQ-FW1)
Br-FW2 has 10.0.0.112 at its external interface
I'm using HQ-Mgr to manage both HQ-FW1 and Br-FW2
below is the remote GWY that fails policy installation. (10.0.0.112 is external mgmt interface for Br-FW2)
Two GWYs running the same SW version but only FW2 fails policy installation with reason "TCP connectivity failure ( port = 18191 )( IP = X.X.X.X )[ error no. 10 ]
.... and ...
Br-FW2> fw ctl zdebug drop
;[cpu_0];[fw4_1];fw_log_drop_ex: Packet proto=6 10.0.0.113:44749 -> 10.0.0.112:18191 dropped by fw_send_log_drop Reason: Ru lebase drop - on layer "FW2-Rule1 Network" rule 4;
HQ-FW1 is 10.0.0.111
HQ-Mgr is 172.16.0.25 which has static NAT to 10.0.0.113 installed on HQ-FW1
Br-FW2 is 10.0.0.112