Set the port that agent uses to contact the appliance to something other than 443, so that Web UI can stay on 443 and we can offload SSL through a WAF, but set a separate virtual service that passes through the "konea" traffic to a different port with no SSL offload, so that agents can communicate through externally without leaving the external footprint compromised.