We have setup replication between parent ERAS and downstream ERAS. By default the downstream servers inherit default client policy. This is great because I don't have to setup all the unique settings for the clients on all the downstream servers; however, in policy you specify the update mirror server. My parent policy has the parent/local server mirror server listed so the downstream servers would inherit this setting and in return downstream clients would download signature updates from parent server across the VPN. So what's the proper way to do this?