bridge + ipsec

Hi,
I have 2 private network with the following network addresses :
192.168.9.0/24  gw 192.168.9.1
192.168.1.0/24  gw 192.168.1.1

This network are connected with 2 router over an insecure network, so i want
to add 2 bsd boxes ( obsd 3.6 stable) configured as a bridge with ipsec.
We read the brconfig manual.
The 2 bsd boxes are configured as the following where bce0 is connected to
the clients and the sis0 is connected to the router.

Machine A

ifconfig gif0 create
ifconfig gif0 tunnel 192.168.9.253 192.168.1.253
ifconfig bridge0 create
brconfig bridge0 add gif0 add bce0
ipsecadm new esp -spi 4247 -dst 192.168.1.253 -src 192.168.9.253 \
        -enc 3des -auth sha1 -keyfile /etc/enc_key1 -authkeyfile
/etc/auth_key1
ipsecadm new esp -spi 4248 -dst 192.168.9.253 -src 192.168.1.253 \
        -enc 3des -auth sha1 -keyfile /etc/enc_key2 -authkeyfile
/etc/auth_key2
ipsecadm flow -dst 192.168.1.253 -out -transport etherip -require -addr
192.168.9.253/32 192.168.1.253/32
ifconfig bce0 up
ifconfig gif0 up
brconfig bridge0 up


Machine B

ifconfig gif0 create
ifconfig gif0 tunnel 192.168.1.253 192.168.9.253
ifconfig bridge0 create
brconfig bridge0 add gif0 add bce0
ipsecadm new esp -spi 4247 -dst 192.168.1.253 -src 192.168.9.253 \
        -enc 3des -auth sha1 -keyfile /etc/enc_key1 -authkeyfile
/etc/auth_key1
ipsecadm new esp -spi 4248 -dst 192.168.9.253 -src 192.168.1.253 \
        -enc 3des -auth sha1 -keyfile /etc/enc_key2 -authkeyfile
/etc/auth_key2
ipsecadm flow -dst 192.168.9.253 -out -transport etherip -require -addr
192.168.1.253/32 192.168.9.253/32
ifconfig bce0 up
ifconfig gif0 up
brconfig bridge0 up

The network schema is the following :

clients <->  obsd  <-> router ------------  router <-> obsd <-> clients

The problem is that the clients don't see the other network.
With a tcpdump we saw that the clients when send packets to other network
tell the arp of the gw but they don't have a response and so don't send the
packets.
We have tried to use the proxy arp on both the bsd boxes but whitout
success.

arp -s 192.168.1.1 <MAC of BCE0> pub ( on Machine B)
arp -s 192.168.9.1 <MAC of BCE0> pub ( on Machine A)

Any idea ?

    Massimo Pignoloni