Auxiliary not reachable on peer Management IP due to missing route

Please open a Support Case for this behavior. 

Yes it is. It uses the physical MAC of the interface to be accessible. You should consider to create a Peer Admin IP in each and every Interface, you want to connect. Most likely a access "over" the primary is not possible (So you coming from Port1 and want to access the Port2 of the second appliance). Instead you should create a Peer Admin IP of Port2 and directly access it.

JCPenneyKiosk

Thank you for your comment!

I've noticed that as well, that it is not possible to route over the primary, since the auxiliary uses it's own routing table to response, but its only two IP interfaces are "peer admin" and "HA Link". 

Peer Admin IP is assigned to Lag0, which is directly connected to the transport network where the coreswitch is attached. that should work as traffic is comming from lag0 and is going back to lag0, and no primary is involved.

It actually works for traffic comming from 10.1.x.x but not for traffic from 10.2.x.x due to the missing route.

It would make much more sense if sophos would put the mgmt interfaces in separate VRFs, with their own routing table..  or at least have a working HA with full replication.     so many troubles with HA,. puuh

update:

fun fact, i I create two /17 instead of a /16, it does replicate the routes. 

I still believe this is a technical issue, not a expected behavior.