KACE Product Support

Firstly, we've got v 3.4 as a VM.
Second, our setup - cisco asa550, allot netenforcer, hp gigabit switches, gigabit everywhere else.
Third, we've got 7 vlans, but only need K2000 and RSA's on 2 of them.

Now, I'm fairly certain the only way I'm going to get this to work properly is via some inter subnet routing, but that'll cut our interface speed down to 100mbits on account of the traffic passing through the allot netenforcer, and in turn will hose the cpu utilization of the netenforcer. I know that the K2000 has a (seemingly unutilized?) second interface, but it appears to be for grabbing an IP on the same subnet as the primary only. It seems to me I've got a few options, outlined below:

Option 1: Define the routes and allow all the traffic to pass through the net enforcer and have the contents of the syncs added to the logs inside the net enforcer.
Problems: High processor utilization, MASSIVE additions to the logs (entire contents of the syncs), really slow synchronizations.

Option 2: Additional hardware within the network to pass only specific traffic between the addresses used by the k2000 and RSAs
Problems: Additional hardware cost and complexity; annoying for a modern device to lack vlan support, even when it has a second interface (that's incapable of joining another subnet).

Option 3: SSH in and manually define an additional interface (or alternative configuration for the existing secondary interface) to allow membership to a secondary network for the purposes of syncing only.
Problems: Kinda complicated, modifying the k2000 to a state outside it's initial operating parameters, it'll probably break whenever there's an update, and I don't know if there's a system integrity check performed, but I'll assume it would fail.

Any input on this would be appreciated; I was actually *really* surprised that this device doesn't have multiple interfaces and/or vlan support, as it seems all other enterprise class devices do this day. If I can assign more interfaces in vmware, I should be able to use them in the k2000. Even the hardware has a second ethernet; is it the same way, as in, unable to assign the second interface to anything other than another IP on the primary subnet? Anywho, any assistance would be greatly appreciated. Thanks!