Your FT setup is what we recommend.
Dedicated link for FT.
We mentioned a management ip per context because usually each context represent a different group or company.
These persons may require access to the context only to manager their own config.
The Admin context controls the entire box, so you may want to have stronger restrictions there.
One-armed is usually the easiest to implement but not really the best.
It requires specific control of the traffic to avoid asymetric routing.
Gilles.
