Description: The remote address and mask define the remote trusted subnet (or single host if mask is all 1's) for the tunnel. The remote trusted subnet or host identifies 'destination' addresses for the tunnel. The remote trusted address(es) together with the local trusted address(es) identify the traffic flow into the tunnel. This attribute and the mask default to 0 which specifies any destination address for the tunnel.

For 'dialinGroup' tunnels with ipsecTunnelClientAddressAssign set to 'internalPool', the remote subnet is used as a pool of addresses which the gateway allocates to dialin clients. In this case, the remote subnet must be specified.

For 'dialinClient(2)' tunnels this object gives the enterprise address of the client aka the 'inner' client address within the tunnel as opposed to the 'outer' Internet address which is given by ipsecTunnelRemoteGateway.