The most important point is that identification and authentication must be checked in the real endpoint system, not in the gateway. because there are too many ways to access endpoint system like "server to server access" after gateway access control system.