How to route to management CLIP from outside the fabric?

[trusterholz_wf]

I am experimenting with a greenfield fabric and I think the best solution for device management interfaces will be to configure them on a CLIP.  However I am getting stuck figuring out how I can route to those interfaces from outside the fabric.  In our environment we use firewalls as our L3 routers.  In the traditional network that this fabric will replace, the device management interfaces are configured on VLANs in the switching environment.  I am unsure how I need to configure the fabric edge interfaces that connect to the firewalls such that I will be able to access the management CLIPs in the fabric.  Am I missing something obvious?

[trusterholz_wf]

With some help from our Extreme SE, we solved this.  The fabric edge devices need to share a VLAN & subnet with the exo-fabric L3 router.  We called this a "transit" subnet. The L3 router needs a static route that sends traffic destined for the switch management IPs to an address on an edge switch in the transit subnet.  And the edge switches need a static default route pointing to the L3 router IP, and to redistribute that static route into the grt.  Lastly, it was recommended to enable ip rsmlt on the fabric edge switches -- in case the static route on the L3 router is directing to the IP address on switch A, and switch A goes down, switch B can respond to traffic meant for the IP on switch A.