I think the solution to all of these problems is really to use public addressing but filter access to it at your edge (yes, even ICMP TOOBIG can be filtered safely if you have designed things in a sane way)
Dave. -- David Freedman Group Network Engineering Claranet Group
