Why does Penn State use real IP Addresses?

I was listening to Security Now Episode 154 on the way home from work today when I heard on this Q&A show the second Penn State related IP addressing letter. This time, John Baskwill from Penn State Harrisburg was replying to a student submitted question from many moons ago regarding the assignment of public IPv4 addresses to student computers. Penn State, like much of the world, is really beginning to feel the squeeze on its pool of public IPv4 addresses. These 32 bit addresses are slated to run out in a couple of years. See Derek Morr's Living with IPv6 for a real-time counter.

As a systems engineer for ITS, I am always interested in how we provision our IT resources. Ever since arriving at the University 3 years ago, I have been puzzled by our consistent use of public, aka "real", addresses on every network device. Every computer, every server, every printer. I don't have the answers, but I would ask why this policy remains the same. I never argue with a decision like this one was made (probably 20 years ago, when all I had was a Commodore 64), but tools and needs change over time. With technologies such as VPNs, stateful NAT, proxy servers, et. al., we could provide more secure network architectures while preserving these scarce IPv4 resources. Sure these technologies may be more complicated than our existing strategy, but organizations larger than Penn State use them in business every day. How can our organization continue to justify using well over a hundred thousand of these addresses?

In my past life, we had over 1,000 devices on our networks at three domestic locations, but were only using about 10 of our public addresses provided by our ISP. Using RFC 1918 private addressing, we worked quite happily without exposing every system to the Internet. Would you agree that it is time to revisit this aspect of our design philosophy? Take the Stubbs Challenge and leave a comment.