How would you design active-active and active-passive firewall clusters, and what split-brain scenarios would you consider?