Consider CP allowed IPs for both directions. It will help ticket #2780