This message was deleted.

I think that is the case when I implemented this for a customer earlier this year, but I don't have access to their firewall to check the rules to say for sure - and from memory I think the monitoring still comes from the NSIP so that still has to be open too.