Great question CaWen, I'm experiencing similar behaviours with 6.5. I had to manually open TCP 52267 and 61760 to get the heartbeat client installed on my Win7 workstation to connect to the VIP, public ip1 and public ip2. But the cluster wasn't replicating...so rather then spending the loads of time it takes hunting each and every port (with wireshark, like you mentioned) down between the 2 ha servers without being sure it was a networking issue, I just disabled both firewalls. Seconds later the cluster came alive.
So the hunt begins, I'll post my results...