But it still just doesn't make any sense to me. They can just firewall the entire campus network, and firewalling can very well be done without NAT...