Policy Statement on Address Space Allocations

If you have a class B and use a firewall, then a /27 should be more
than is needed on the global Internet and they should use an address
from RFC1597 internally and return the /16.


  Depending on the firewall design, hosts located behind firewalls
can conceivably access the Internet directly for certain services and in
this case unique addresses are required. Your assumption would be valid
when all traffic for that site is handled by proxy servers.