#1 Yes, see the following FAQ
#2 While option 3 exist, for what you are trying to do - do not do that.
#3 I am not sure if option 1 or 2 will work. My bets are, options 1 or 2 will not work:
a) because of double NAT.
b) (AND OR) you still will have to deal the size of the NAT Table of the router.
If you are the original poster (OP) and your issue is solved, please remember to click the "Solution?" button so that others can more easily find it. If anyone has been helpful to you, please show your appreciation by clicking the "Kudos" button.
A double-NAT shouldn't screw up the IPSEC tunnel creation. If you want OnDemand and Guide, you need to keep the ActionTec as the internet facing router.
The configuration which should work for you is:
- Connect WAN port of the Cisco to a LAN port on the ActionTec
- Assign WAN port of Cisco to a static IP (say 192.168.1.200) and use 192.168.1.1 as default route and DNS.
- Configure Cisco to use 192.168.2.x as local LAN network
- Configure ActionTec (192.168.1.1) to place the 192.168.1.200 as the DMZ host (so all incoming traffic to the ActionTec will be directed toward the Cisco -- from which you can then do port forwarding, etc.)
As long as you don't need UPnP (I'd turn it off on both devices), you should be fine.