IPsec VPN "site to site" USG20<-> USG40

IMVHO you should ask to your iSeries sysadmin.

As an example, you can try this with a windows computer or a network device with management.
If 192.168.8.249 is not used, configure it as address for a test PC or network device, but without any gateway. You will be able to ping it from the subnet, but from the VPN it will be completely missing. It will receive packages, but without a gateway and/or the correct routing table, it won't be able to address answers of ICMP packages.

Unless something peculiar has been done with VPN connection, policy routes, firewall rules (for instance, 192.168.8.2 forbade to connect to anything into security policies)... the answer for the mistery is inside your iSeries device.