The roadwarriors carol and dave set up a connection each to gateway moon and request a virtual IP via the IKEv2 configuration payload by using the vips = 0.0.0.0 parameter. The virtual addresses assigned to the clients by gateway moon belong to the subnet 10.1.0.0/16 hidden behind the gateway so that carol and dave become full members of this network. And this thanks to the farp plugin through which moon acts as a proxy for ARP requests e.g. from alice who wants to ping carol and dave.