Option 1:You will need a layer 3 device(could be a switch) before the pix to achieve this. However this will introduce an additional hop.Option 2 (recommended): use private ips internally and for the host requiring public ips use static NAT on the pi...