the following is our network:

[site A] pc A -> firewall A-> internet (VPN) -> [site B] firewall B -> linux1, linux2

linux1: 1.1.1.1 (ip alias 1.1.1.3)
linux2: 1.1.1.2
1.1.1.3 will be switched between linux1 and linux2.

pc A accesses linux1, linux2 via VPN.

when 1.1.1.3 is switched to linux2. pc A could access it.
within site B, 1.1.1.3 could be accessed by linux2 and other PC.
I checked the arp table in firewall B. the MAC of 1.1.1.3 is either missing or wrong (pointed to linux1). that is the reason why pc A could not access 1.1.1.3

the ipalias is added by gnome->system->admin->network

Pls advise how to let firewall B to know the correct MAC addr when the ip alias is changed to another PC.

The MAC of an alias is the same as the MAC of the primary since it is going to the same card as the primary.