This kind of access to an otherwise transparent device is sometimes done with a dedicated, physical port (which isn’t very practical with a two-port device) or with a management VLAN.