> Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your pr

> Having a publicly routable address absolutely does “expose” your network, which at the very least has the potential to generate load on your firewall (your problem) that would otherwise be absorbed by the NAT device (your ISP’s problem). How is one your problem and the other your ISP's? In both cases the bits are coming down your connection and hitting the CPE. Whether the CPE does only SPI firewalling or SPIFW+NAT seems to be irrelevant to me, as the same thing happens: packet's header tuple is examined, a state table is looked at, and the packet is passed or dropped depending on the contents.