In a working state of vCenter Heartbeat, the packet filter is the mechanism that exposes the public IP address on the Active vCenter Server and hides it on the Passive vCenter server. Using the nfpktfltr.exe getstate command, you can tell the state of the packet filter:
I encountered a scenario wherein a split-brain was encountered in the environment. In a split-brain situation, both the primary and secondary vCenters think they are the “Active” server. vCenter Heartbeat was able to detect split-brain and it effectively shutdown the Heartbeat service on the secondary node.
I performed the same command to check the packet filter status before bringing up the secondary vCenter’s heartbeat services but saw the state on the Secondary as “Passthru”, meaning it will be exposed in the network (analogous to being Active).
Digging around the nfpktfltr.exe command switches, there is an option to set the packet filter state. The command is nfpktfltr.exe setstate.
For the Secondary server I used nfpktfltr.exe setstate filter command to manually change the state and that did the trick.