The remote address and mask define the remote trusted subnet
(or single host if mask is all 1's) for the tunnel. The
remote trusted subnet or host identifies 'destination' addresses
for the tunnel. The remote trusted address(es) together with
the local trusted address(es) identify the traffic flow
into the tunnel. This attribute and the mask default to
0 which specifies any destination address for the tunnel.
For 'dialinGroup' tunnels with ipsecTunnelClientAddressAssign
set to 'internalPool', the remote subnet is used as a pool
of addresses which the gateway allocates to dialin clients.
In this case, the remote subnet must be specified.
For 'dialinClient(2)' tunnels this object gives the
enterprise address of the client aka the 'inner' client
address within the tunnel as opposed to the 'outer' Internet
address which is given by ipsecTunnelRemoteGateway.