An organizations security policy requires Host Integrity checks to run only when the client is connecting through a VPN concentrator whose internal interface is attached to a Gateway Enforcer. Which setting should be configured to only check Host Integrity on these external clients, but not check clients on the local network?