Which configuration must be completed to use both packet-based and session-based forwarding on a branch SRX Series Services Gateway?