I have a pix 515e running pixos 6.3 w/ 64MB RAM, 3 ethernet interfaces, only 2 in use. I am using it as an internet gateway for ~100 devices, daily peak of about 6 Mbps (megabits per second) inbound, about 10%-20% of that value outbound. It works great for this, no problems. We do not use any VPN features. Although the PIX does not know/care about this most clients are wireless.
We are having compliance/policy problems so we want to force users to authenticate before using the internet and supplement with detailed logs. I recommended replacing the PIX with another product; my suggestion (windows + unnamed portal software) has failed miserably so we are back to using the PIX which has always worked perfectly. So I've burned up some of my budget on this but I need to come up with a solution, ideally using what I have.
My understanding is that the PIX can in fact authenticate users and audit access. I really don't need detailed URL logs, really what I need is accurate date+time, username, mac address, local IP address, local port (translated + untranslated), remote IP, remote port, and octet count
I believe I have a handle on the logging, so my questions are
1) can this PIX require authentication before allowing internet access? I mean ALL internet access (games, telnet, ...), not just HTTP. Any guidance on making this work? Note: I do not have control over my users devices, I can deny them access (with cause), but I cannot install software on their computers.
2) Right now any internet enabled device (PC, Mac, iphone, android) can access the internet. I want to make sure that they continue to work, so are the changes generic enough to work with these existing devices?
3) will this pix be overburdened (CPU/memory) if I proceed? I have seen 800+ packets per second at peak times.
4) if this is a bad idea, please offer suggestions
Note I don't really want to discuss the policy. If the users want to go outside the policy they agreed to, I really don't care, but they need to use/buy their own 3G service for such activity and stay off the (W)LAN.