Super!
I've also noticed that you have a CA and PS RSOE.
Since SP2 of Afaria 7.0 the Afaria server is handling CA traffic as a proxy and you don't need to expose the CA directly anymore.
Also the PS RSOE can share the same RSOE as the ENROLL (since they point to the same backend port and server)
BR
Peter