A VRRP pair shares the gateway IP while one downstream ACL still permits only the previous virtual MAC during a failover rehearsal

Redundancy is healthy and the dependent security policy remains bound to yesterday's identity. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.