Emergency access to remote Sophos Firewall if tunnel is down

Hi there,

I am new to the Sophos Firewall product, and so my question might sound stupid for all the wizards here...

I like the security hints and warnings the firewall shows when configuring insecure settings, such as the access to the configuration frontend from the WAN zone.

In my usage scenario, there are several Sophos Firewall devices in the branch offices (BO) and another device in the head office (HO).

In the BOs, there are no IT personnel and the people there depend on a working connection to the HO. The connections to the offices are established using site-to-site IPSec VPN tunnels.

If - for whichever reason - the tunnel goes down, there is no way to connect to the remote firewall and see what is going on there or to try to re-establish the tunnels.

With our old Sophos UTM devices, the animated interface was enabled on WAN interface, but access was limited only to the HO's IP address.

This is now regarded insecure with Sophos Firewall (which is definitely true), but nevertheless we need another way of connection to the device and check the settings.

What's the recommended configuration for this scenario now?

Thanks,

Tom