We're rolling out CGN with PCP[1,2] to help mitigate some of the risks involved, however applications may have to adapt to make proper use of it, as it doesn't work too well currently.
Things like uTorrent pick a port and then keep requesting it with UPnP even if it keeps failing, instead of trying a new one.
Our particular vendor's PCP implementation dedicates a block of ports to be used for PCP MAPs, and the client cannot use a port outside of that block, not even a port that's been reserved for that subscriber's SNAT block.
Thankfully the range we've allocated will include the XBox Live port (3074), but that is then only good for the first subscriber that sends a PCP MAP, subsequent attempts from subs behind the same IP will fail.
There is a UPnP function, AddAnyPortMapping() as specified in IGD:2, that when translated into a PCP MAP will prefer a port, but if unavailable will accept any offered by the PCP server. However all of our Broadcom chipset based CPEs don't support it, and I have no idea how many applications would use it either.
We'll only be deploying CGN in conjunction with dual stacked IPv6 in an attempt to offload traffic off CGN and also mitigate the risks.
That then introduces new issues like do we leave the IPv6 firewall on by default? And do any applications support the the the WANIPv6FirewallControl [3] UPnP features to open up pinholes dynamically? Oh wait, that's part of IGD:2 which our CPEs don't support. :(
FWIW: We're looking at leaving the IPv6 firewall on by default, but allowing IPSec[4] to all internal hosts, following the XBox One P2P approach[5].
Things aren't necessarily easier even when you have in-house CPE developers.
Apologies for the rant!
-Richard
Appropriate links: