In a situation with Cisco ISE the Ironport, that is the proxy server, receive the user and ip address autenticated. It's eliminate the necessity to a second authentication on the proxy. For this communication cisco use the PXGrid protocol.
The customer has a RFP with this requisite. Ironport already instaled and Cisco ISE or ClearPass are the options for the RFP.