[lammbo]

Additionally, since the licensed IP is the private IP, then nothing breaks when you change the Public interface IPs.

What I do for my lab after that is change the Public IPs to a Private range and attach the whole lab to the DMZ port of an edge box. On the edge box, I explicitly block all outbound FW-1 traffic so the 'lab' management server does not constantly send stuff to my live firewalls. This allows me to test 'external' traffic in the lab inbound and outbound. Ideal for testing not just CP changes, but all the lab servers can get to the outside world and patch via Windows Update, Righfax works, Call Manager and Unity work, etc.

Also, my edge box has wireless and I set that up so I can get to it from my desk and be 'in the lab'. Also a great way to test SecureRemote/SecureClient on those lab servers.

I'd say it's win-win as far as test networks go.