GRE keepalives remain up, but an underlay ACL blocks the recursive route to the tunnel destination during WAN failover

Tunnel health appears good until the underlay path changes, exposing a missing control route allowance.