I'm a little bit interested by your setup, teoretically. > However, if carp IS in use, I can see the upstream router do the arp > request, followed by the firewall arp reply (with the carp MAC),
Is it the 'carp MAC' the MAC of vr2? > however the upstream router seems to ignore the answer and does continuous arp > requests. Maybe that router is not receiving the arp response. Why would someone ignore an ARP message?