In that sort of scenario, the appliance needs to be in a DMZ and treated like an external system. Personally, this is why I hate systems that need this sort of

In that sort of scenario, the appliance needs to be in a DMZ and treated like an external system. Personally, this is why I hate systems that need this sort of connectivity beyond a SAN service processor or similar. I’d rather have the third party just run in on their premise with appropriate contracts than pretend it’s just another server in the datacenter.