Martin, in the past you suggested I just use NAT Mapping: NAT Mappings vs. Inbound / Outbound Policy for Additional Public IP Address
Maybe I should try that - although NAT Mapping is complicated, it might actually be simpler than my current setup which requires a combination of Port Forwarding, Outbound Policy, and Internal Firewall.