Solved! In the Networks settings for VLAN 1 (the management VLAN, and the only VLAN at the site) under Access Control > Allowed Destinations , make sure the Local Network box is checked. I'm not sure why the default setting of Unrestricted Access ...