one-armed is the easiest to install - less disruptive as you can keep your current network unchanged.
However, it requires special configuration to guarantee that the return traffic from the server goes back to the CSM.
This is done by doing client nat which will prevent the servers to see the client ip address and therefore to create statistic based on client ip.
There is a way to inser the client ip in the HTTP header, but it only works for HTTP.
Router-mode is easier to understand and troubleshoot.
The CSM is just like a router with vlans and routing between each of these.
It requires a minimum of configuration.
However, it is important to design correctly.
For example I would recommend not to have client accessing the CSM directly.
They should go through the MSFC first.
Then I would recommend to have only 1 vlan between CSM and MSFC- this is because the CSM only uses 1 default gateway even if you can configure many.
You never know which is active.
The CSM also expect the traffic to come back on the vlan it went out. If you have multiple vlan it is difficult to control on which vlan the response will come back.
Finally 'bridge mode' is good if you want to insert the CSM between the servers and their current default gateway without having to reconfigure the servers.
This is a good solution.
Disadvantage is that all traffic from servers will go through the CSM and it is more difficult to avoid in case you really need it.
A little more complex to troubleshoot as well.
Conclusion: bridge or routing mode is ok - avoid at all cost one-armed.
Regards,
Gilles
