Have a deployment option of CE clusters where there is a separate management interface that can communicate with XC portal/management/configuration/reporting but CE building IPSEC/SSL tunnels to RE should be optional. This will enable CE's to be run on-premises/private (public) clouds/internal applications without any dependencies to tunnel to RE's but management/configuration with XC console using non-traffic interface.