Some basics are in order here.
EXOS supports a Management Virtual Router (vr-mgmt)) to which ONLY the mgmt vlan and port belong. This can't be changed. It also supports a Default Virtual Router (vr-default) to which the the default vlan and all the front ports belong.
It is NOT POSSIBLE to pass traffic between vlans belonging to these two VR's. The whole point of having a separate dedicated mgmt port is security. In security-conscious environments (an ISP, for example) all management is done exclusively through a private vlan that can't be reached by public vlans and external customers. This separation is fundamental to avoid attacks to the switches. Another advantage is that if a denial-of-service attack is crippling the public vlans and ports, the manager still has a separate protected network to manage the switches and combat the DoS attack.
There are separate routing tables for each VR, each one containing a default route or static routes. If you are managing the switch through the management port, you must make sure there's a route from the management port IP address to the IP address of the FTP/TFTP server, or the workstations you are using to manage it, if they are in different subnets. You must also be careful because commands such as ping, tftp get/put, or upgrade allow to specify through which VR the command will communicate with the network.
