Deploying Barracuda SSL VPN Appliance in DMZ with DUO 2 Factor Authentication

Deploying Barracuda SSL VPN Appliance 680 in DMZ
AD user databases
DUO for 2 factor Auth
2 Vlans - internal and DMZ
Primary Interface configured for DMZ
Secondary Interface configured for internal lan
DUO using Radius proxy

All above works

However I have to open the remote support tunnel to make connections to the appliance via the web login .- the internal interface wont respond to ping or https connection otherwise
I then created static routes to the internal subnets whih solves the issue with connecting to the internal interface - no longer requires the remote tunnel open.

However the static routes break AD and Radius Authentication - so I have a stable connection to the appliance but AD and Radius authentication stop working.

Any help, advice, questions would be much appreciated