...

• Simpler and more bomb-proof network protection than a firewall.
• Computers still get:
  
  1. network access to group file shares.
  2. patching.
  3. Network-based anti-virus reporting.
• Printing from RedRover/ eduroam, which is not normally allowed in, is enabled by opening port 9100.
  • No VPN required.

On occasion the device may need a public IP temporarily. Such a change requires modifying the DNSDB record.

...

Affords twice the number of IPs on a network than if 10-space numbers were converted to public IP addresses (and presumably similarly blocked at the network layer via firewall or ACL).

Caution: Ensure CU's proxy server configured with necessary off-campus access

• Cornell's private network (10-space)

Source info in Chemistry IT

...