How can I manage APs behind customer's Firewall with vSZ-H?

Question

Hi,
How can I implement a Managed solution for the APs are installed behind customer's Firewall?  I dont want to use port forwarding.  can this be done using vSZ-H? 
Reason behind this is, customer requires their servers to be reachable so APs will be behind their firewall.
Please advise if anyone has done this.

michael_brado · Answer

If not port forwarding, can the CU define ACLs to permit your source IP (range) to access the AP subnet (or AP IPs), for those ports/protocols your management requires?