Looking at the documentation and network diagram at Duo Network Gateway | Duo Security It looks like only the DNG needs to communicate with the outside world and proxies requests to the SAML identity provider? Is this correct or can it be configured ...