We have a Sonicwal Pro 4060 Firewall. Sounds like a great idea to create the ACLs at the Firewall. I need to verify the lease time though with my DHCP server. It would be a mess if machines recieved different IPs at renew time. This would work nice if my network was static. I have a hard time keeping up with Proxy Lists in Websense. There are new Proxies everyday.