What is the correct way to configure the R3000 and the network switch to support Invisible mode?

You will need a managed switch to be able to configure a port mirror. The R3000 Listen interface, by default LAN 1, may be plugged into a switch and should be configured to be the destination port for your port monitoring session. This configuration does not transmit any packets, therefore it does not need to have a real IP, for example it could be 1.2.3.4/32. The interface is in promiscuous mode and it's simply receiving a copy of whatever the source of that monitoring session is set to (in our case the R3000 would like to see outgoing traffic destined to a firewall/proxy/internet gateway).

To make sure the R3000 is seeing traffic properly you may view the Realtime Traffic Log, under System>Diagnostics>View Log File>Realtime traffic Log. View this log a few times and if you see your LAN making outbound http requests, then you'll know everything is set up correctly.