A utility is inserting a FortiGate into an existing back-office network between the core switch and the billing servers, but the network team has been told they cannot renumber any device or change the default gateway on the billing servers during the migration window. Which operating mode lets the FortiGate be added inline for inspection without changing any existing IP addressing?

In transparent mode the FortiGate operates as a Layer 2 bridge: it forwards frames between its interfaces without acting as a routed hop, and the entire unit uses a single management IP address rather than a per-interface routed address. Because no device on either side of the bridge needs to change its IP address or default gateway, transparent mode is exactly what allows the unit to be inserted inline for inspection during a migration window with a no-renumbering constraint. NAT mode requires each interface to hold its own IP address on its respective subnet and function as a routed hop, which is itself a configuration change even before touching the servers, so it does not satisfy an unchanged-addressing requirement on its own. Explicitly repointing the billing servers' default gateway to the FortiGate is precisely the change the migration window forbids, making that option self-contradictory. The claim that transparent mode still needs a routable IP on every interface misstates the mode — transparent mode deliberately uses one shared management address, not per-interface routed IPs, which is what makes it addressing-neutral in the first place. To confirm success, verify from a billing server that its default gateway MAC address and IP are unchanged while traffic still passes through the newly inserted FortiGate.