After CSM is deployed, run the following API to use an IP/subnet pool for CSM visible to PCG.

Whenever you run this API, CSM updates gw-mgmt-sg associated with the PCG in your public cloud, to append these IP addresses to allow inbound communication on PCG from CSM over these IP addresses or IP address ranges. See Auto-created Public Cloud Configurations for a list of constructs created in the public cloud after PCG is deployed. 
PUT https://<csm-ip>/api/v1/csm/configs/system-config
Example Request Body where 10.1.1.1/24 is the IP address of CSM as seen by PCG. 
{
  "mgmt_ip_config": [
    "10.1.1.1/24",
    "192.168.0.0/24"
  ]
}