Traffic is hitting virtual IP's but for one subnet it is managed by one firewall and for other the second firewal. Firewalls don't share information about sessions and traffic is blocked. There would be no problem in a stateless environment where the VRRP router doesn't store sessions and just forwards traffic based on a routing information.
↧