Cluster virtual IP vs the individual server IPs
Symantec DLP uses OS level operations and functions to mount and scan a share or file system. It has no way or determining that a share or file system is on a clustered server.
Should I use the cluster virtual IP or the individual server IPs?
What IP to use depends on how the resource is supported. If the share or file system is on the virtual IP, use that IP. If it is only available via one of the server IPs, use that one.