Firewall with Private IP...

[GFrazier]

This is similar to a previous post where I have a client that is actually setup with this ISP where they ISP is actually a middle man and not a full-blown ISP:  Basically, this is a situation with a switch between the ISP router and client firewall.

The ISP has a router on their end with a switch passing traffic to another switch at the client location where the client has a firewall connected to that switch.  The ISP is connected to a major ISP (Comcast or Cogent), so the small ISP has the public IP configured on their router with a Private IP for the Client router... 

This is rendering VPN connectivity unsuccessful, however, I think Port Forwarding may help as one solution.

My question is if the small ISP guys obtain a block of multiple public static IPs, can they simply configure the client firewall with one of those IPs - will this work without needing to configure port forwarding?

[ww]

You have problems with 3rdparty/client vpn? Most times Autovpn works fine also behind nat

If they route a public ip/subnet to the isp lan side/mx wan side, then you dont need port forwarding.

[GFrazier]

Thanks for both of your feedback... given you both gave me the answer I needed, I did an eanie, meanie, miney moe to choose an accepted solution... THANK YOU BOTH!

[OVERKILL · Accepted solution]

Site-to-site VPN or Client? As @ww noted, AutoVPN tends to work fine behind NAT/PAT for the most part. Obviously, if it is Client VPN, you'll need port forwards configured as the traffic will never hit the WAN interface of the MX otherwise. 

On your query about the smaller ISP, yes, if they obtain a block of routable public IP's and the firewall is able to use one of those, no port forwarding would be necessary.