+----------+ +------------+ lan a.b.c.0/24 -- | VPN GW A |=== ipsec tunnel 1 === | VPN GW Z |-- lan 192.168.0.0/24 + a.b.c.199/32 |IP a.b.c.d|=== ipsec tunnel 2 === | IP w.x.y.z | 192.168.1.0/24 +----------+ +------------+ + a.b.c.199/32 GW A is proxy arping a.b.c.199 so it can tunnel all traffic for it over to GW Z, so that a.b.c.199 IP appears on Z's local LAN.