In reply to a post by Ignitionnet:

Allowing in-bound connections to devices is the new port mapping.

On corporate kit I'm used to having many addresses on public network and choosing what is NATted, so now its a case of not having to NAT just assign the real IP to devices but still block alll and permit only whats needed on the firewall. (I'm talking ASA, SSG, SRX etc).