Cloud Ennoblement questions

Hi all, needing some help with some cloud enablment questions. (7.5 SP1 HF5)

1. Do we only have to open the ports between GW and SMP plus only Site servers serving Cloud?  or we have to open the ports to all the PS ?

2. Can we use a TMG server in front of the IGW (So CEM agents hig TMG server and get directed to IGW). 

3. How long Tunnel created by CEM agent to the SMP via IGW stays open after the use?

4. How long the Tunnel crealed between CEM Agent and Site server syats open after user?

5.  Any other security recommendations?