A service provider is replacing a customer's edge router with a Secure Firewall Threat Defense appliance running in routed mode, and its access policy already permits the required flows. Inside hosts with private addresses must reach the internet, the Network Operations Center must reach the appliance's inside interface, and an external partner must reach a private web server. Which routed-mode configuration satisfies all three requirements?

Routed mode makes the appliance a Layer 3 hop, and three elements have to work together for the design to function. Addressing both interfaces is what lets inside hosts use the appliance as their default gateway and lets the Network Operations Center manage it on the inside interface. A default route toward the provider is the only entry that reaches destinations beyond the provider's own network, so without it inside traffic stops at the first hop. Address translation appears twice for different reasons: source NAT lets private inside hosts travel, and a server NAT rule publishes the private web server for the partner to dial. Supplying only source NAT leaves that private server unreachable from outside, so the partner connection dies before it starts. A static route that stops at the provider's network reaches provider-connected hosts only, not the internet as a whole. Matching outbound traffic with an access policy rule decides whether a packet is allowed, but a permit entry never creates a path, so the traffic still has nowhere to go. Exam caveat: translation rules are defined on the Management Center and deployed with the policy, so include them in the same change window. Practical check: after deployment, confirm an inside host passes a simple web request and watch the NAT counters climb when the partner connects.