A greenfield branch is being built with two new segments, one for staff workstations and one for a small server rack, and addresses are being assigned from scratch. The architect requires the appliance to act as the gateway for both segments, each segment to arrive on its own physical port, and device management to use a dedicated port. Which deployment mode and interface layout satisfies this design?

Routed mode makes the appliance a layer 3 hop, so each interface can hold the gateway address for its own subnet and the device inspects and forwards traffic between them, which is exactly what a fresh build with no legacy addressing needs. Terminating each segment on a separate physical port keeps the zones cleanly separated and lets link state reflect each segment, while the dedicated management interface keeps administration out of the traffic path. A transparent deployment fails the gateway requirement, because a bridged device joins segments at layer 2 and leaves routing to some other device; transparent mode can be useful when existing addresses must remain unchanged. Carrying both segments as subinterfaces on one port fails the requirement that each segment arrive on its own physical interface, even though the routing itself would work fine. Placing the management address on a staff segment interface fails the dedicated management requirement by exposing administration to that segment and to any outage there. Caveat: in routed mode the hosts need their default gateway set to the appliance interface address, so plan the addressing before cutover. Practical check: after deployment, confirm in the Management Center interface panel that each data interface has its gateway address and the management interface is separate, then test reachability between hosts in the two segments if policy permits.