I think you would be better using this approach:
1. On each router create an inbound acl on the lan interface that denys traffic to networks that you do not want your users to reach regardless of protocol. Place those entries first on the list.
2. In the inbound acl, add permit statements for ports/protocols that you want your users to access. There is an explicit deny statement at the end of each acl, but you can add an explicit deny with the log option to view some traffic patterns. For example you would allow access from subnet-ba to subnet-b for dns/wins queries, but you do not want to allow your users to reach internet dns servers.
This will allow each edge router to do the acl checking to implement security policies, and that is a cisco best-practice for traffic control. This allows the traffic to be stopped at the edge rather than wasting backbone bandwidth. Cisco routers can log to syslog hosts just like a pix can.
It is important not to overlook a firewall implementation on the end-host as well, since most viruses do connections on port 80 and 25. Port 25 is easy to block since you only want your mail gw to process smtp; blocking the pop and imap ports is another good idea. However with web-based mail using port 80, you can see that trying to limit the damage done by virues by using router/pix acl's can only take you so far.
Another idea is to restirct what the users can do on their workstations. For example may %systemdrive%:%systemroot% read and execute only except for admin groups. Place similar restrictions on the win registry, particularly the HKLM hive.
Let me know if this is of any help.
