Best way to access failover HA node from another subnet?

[planedrop]

There are a number of ways to solve this, but trying to figure out the best/easiest solution for this.

Obviously, the firewall WebGUI shouldn't be allowed on anything but the management VLAN, however, when doing this by default you won't be able to access the secondary HA nodes WebGUI interface from a client on another subnet/vlan (with a firewall rule that allows a specific client to connect to the management VLAN IP of the failover node)

Is there a standardized way to solve this?