OK, I'm no expert at this.  I used to run a PIX firewall years ago and never had any trouble with NAT.I have a fresh SR520 that I only did two things to it using CCA 3.2(1):1.  Assign the address of FA4 to be 1.23.456.90 with a mask of 255.255.255.25...

I have an existing internet connection at work:CDG24 cable modem in 'gateway' (their word) mode showing these configuration screen values:WAN IP 1.2.3.88  (not a typo)MASK 255.255.255.252GW 1.2.3.89Public IP  1.2.3.89/30DNS 209.18.47.61, 209.18.47.62...