Yes it is recommended.
There is no drawback to it since you are allowing access on the outside interface to the public ip address.
The traffic is still going through a stateful firewall and any malicious activity on the packet should be detected.
Also if you do not allow the access on the outside inteface for the public ip address the firewall will drop the initial sYN packet itself.
read this
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804708b4.shtml#t7
Most organizations need to allow untrusted hosts access to resources in their trusted network. A common example is an internal web server. By default, the PIX denies connections from outside hosts to inside hosts. In order to allow this connection in NAT control mode, use the static command, with access-list and access-group commands. If NAT control is disabled, only the access-list and access-group commands are required, if no translation is performed.
Apply ACLs to interfaces with an access-group command. This command associates the ACL with the interface to examine traffic that flows in a particular direction.
In contrast to the nat and global commands which allow inside hosts out, the static command creates a two-way translation that allows inside hosts out and outside hosts in if you add the proper ACLs/groups.
In the PAT configuration examples shown in this document, if an outside host tries to connect to the global address, it can be used by thousands of inside hosts. The static command creates a one-to-one mapping. The access-list command defines what type of connection is allowed to an inside host and is always required when a lower security host connects to a higher security host. The access-list command is based on both port and protocol and can be very permissive or very restrictive, based on what the system administrator wants to achieve.
The network diagram in this document illustrates the use of these commands in order to configure the PIX to allow any untrusted hosts to connect to the inside web server, and allow untrusted host 192.168.1.1 access to an FTP service on the same machine.
Use ACLs on PIX Versions 7.0 and Later
Complete these steps for PIX software versions 7.0 and later with the use of ACLs.
If NAT control is enabled, define a static address translation for the inside web server to an outside/global address.
static (inside, outside) 172.16.1.16 10.16.1.16
Define which hosts can connect on which ports to your web/FTP server.
access-list 101 permit tcp any host 172.16.1.16 eq www
access-list 101 permit tcp host 192.168.1.1 host 172.16.1.16 eq ftp
Apply the ACL to the outside interface.
access-group 101 in interface outside
Regards,
Sachin
