This may be pertinent:
http://docs.openstack.org/trunk/openstack-compute/admin/content/associating-public-ip.html
"Note that you cannot SSH to an instance with a public IP from within the same server as the routing configuration won't allow it."
This would explain the reason why 'a1' can't see its own public address; is it possible that a1/a2 are on the same server?
This may be pertinent:
http:// docs.openstack. org/trunk/ openstack- compute/ admin/content/ associating- public- ip.html
"Note that you cannot SSH to an instance with a public IP from within the same server as the routing configuration won't allow it."
This would explain the reason why 'a1' can't see its own public address; is it possible that a1/a2 are on the same server?