Because the VPN Gateway is part of a managed service, AT&T support and development organizations need the ability to remotely access the VPN Gateway to troubleshoot and diagnose problems. This means that the VPN Gateway cannot officially be supported in a NAT environment. The VPN Gateway must be directly accessible on the Internet. If the VPN Gateway is behind a firewall, the appropriate ports must be opened on the firewall to ensure the functionality of the VPN Gateway. These ports are described later in this chapter.