Your writing is precise.
For agent to server tunnel industry-standard TLS connection is established.
Also you can install netxms proxy in a remote office. That proxy will be the only node that communicates to the server directly. Proxy would communicate to all other machines at that location.
