Does the remote gateway need to include your production gateway’s external IP in its encryption domain?