The default behavior for the Identity Server and the Access Gateway is to use the same IP address for incoming client requests, for proxied requests, and for management tasks. You can improve performance by separating this traffic into separate pools via IP addresses. You can also use the IP addresses to route the traffic so that it remains behind the firewall.
For more information, see Section 5.1.3, Configuring a Specific IP Address for Proxied Requests and Section 5.2.2, Configuring a Specific IP Address for Proxied Requests.