Monitoring cannot reach a server's new management address

SRV1 runs RHEL 9, built from the company's CIS-hardened image. It has always used ens192 (10.0.10.21/24, default gateway 10.0.10.1 on CORE1). Yesterday a second NIC, ens224, was added in the management VLAN 99 as 10.0.99.21/24 so that monitoring and backups stop sharing the data NIC. No other routes were added.

The monitoring server MON1 (10.0.50.10, VLAN 50) was switched to poll 10.0.99.21. Its pings and SNMP polls time out. From JUMP1 (10.0.99.5, in VLAN 99 itself) ping to 10.0.99.21 works. Polling the old address 10.0.10.21 from MON1 still works. CORE1 routes between all three VLANs.