How is the Security Gateway VPN Domain created?

The following diagram illustrates how a VPN-1 SecureClient user tries to establish a VPN with hosts in the external_net and internal_net from the Internet.  How is the Security Gateway VPN Domain created?

A.
Internal Gateway VPN Domain = internal_net;
External VPN Domain = external net + external gateway object + internal_net.

B.
Internal Gateway VPN Domain = internal_net.
External Gateway VPN Domain = external_net + internal gateway object

C.
Internal Gateway VPN Domain = internal_net;
External Gateway VPN Domain = internal_net + external_net

D.
Internal Gateway VPN Domain = internal_net.
External Gateway VPN Domain = internal VPN Domain + internal gateway object + external_net