HiCurrently we are using cisco Ironport 170 as our production proxy and we let all our internal user traffic through Ironports. for the user laptops when they are not connected to VPN ,Scan safe is kicks in and that kind of handles users web traffic ...