[RobertGraham]

After reflecting on this and speaking with a colleague about it, I've become convinced that it's best to use a separate but smaller network(/28 or /29) for the segment between the CPE router and the enforcement point.

I know that in the past it was necessary to be very frugal with IPs, but between NAT, CIDR, and IPv6 on the way it shouldn't be such an issue. Incidentally, there are quite a few networks that haven't yet been assigned and several more that could be VLSMed.

I guess it's because I feel like: after the firewall it's the Internet and private addresses shouldn't be used on the Internet. (I know ISPs use 1918 IPs for their backbones which are definitely part of the Internet, but I'm not talking about that.)