You cannot. We're stuck with the same problem. Our workaround was to configure a firewall to spoof every services required with an IP addresse local to the CSS's ethernet management port. Basically, the CSS thinks all of its management services (i.e.: tacacs, ntp, syslog, tftp, etc) are on the same local device (the firewall translates the spoofed IP to the corresponding server's real IP, based on the destination port).
PS: I believe Cisco will resolve this issue in future releases of WebNS.
