L2 handoff, put ACL in front of FortiGate?

[mhwloo]

We get a L2 hand-off from our ISP.  I'd like to be able to apply a L3 ACL on that L3-capable switch which would sit in front of the Fortigate.  I figure I would be able to set up NAT on that device (or maybe I wouldn't need to but some other way could make that switch a L3 hop?) and then the firewall could get, say, a 192.168 address which goes to the WAN port of the Fortigate, but what about the firewall also doing NAT?  I want the firewall to be able to give out, for example, 2.0.0.1 and 2.0.0.2, and down the line, but can I do that if the firewall is sitting BEHIND a NAT?  Any network superstars that have any ideas?