I think this post explains what I wanted to know. So between the rancher-server and remote hosts, IPSec VPN tunnels are created automatically?