We wish to restrict specific users LAN outbound Internet access while at the same time allow the same users inbound access to our mail server via a web browser. Our thinking was to use the same ACS account configured with separate inbound and outbound passwords and not give the user the outbound password. I've since discovered this currently can't be accomplish in ACS. However, Cisco suggested configuring the Cisco IOS Authentication Proxy feature that provides dynamic per-user authentication and authorization. I think we'll go that route. Thanks for your input.
