A PBR next-hop tracks the firewall IP, but the firewall can still answer ARP while the service process behind it is dead

The tracked object remains reachable even though the real dependency has failed.