Just hypothetically, since SecureNAT requires the "default gateway" to operate, what would be the ramifications of leaving the default gateway blank on DHCP? That would kill off any program that wasn't capable of using a proxy server. I tried one workstation here with a blank setting, and it appears that only ICMP was affected (and only for external sites). Otherwise, everything seemed to be working fine. I know there would be an issue with multiple subnets, but I would think that could be handled with a ROUTE ADD command in the login script, or other similar technique.