[c-nsp] Cisco SSG as a RADIUS gateway without SESM?

[A. K.]

We use Cisco 2811 as edge routers in a PWLAN environment. Currently we have
"hotspot in a box" type devices (think Nomadix, Colubris, Xyzel, etc.)
acting as gateways to AAA and RADIUS.

AAA & RADIUS <----> Internet <----> 2811 <----> Catalyst <----> "hotspot
box" & Aironet WAP <----> Client

Our requirements are basic. We need a user to get HTTP redirected to a
remote login page, authenticate against a remote RADIUS, surf the internet,
and log-off.

>From what I've read about the SSG it sounds like it could perform the
functions of a "hotspot box" and the software will run on our existing
routers. However, the configuration options for the SSG are a bit
bewildering and every document I have found mentions the SESM as a
requirement which we would prefer not to implement.

Is there a basic config for the SSG that would suit our needs or is what we
are trying to implement impossible without SESM? If possible we would prefer
to run with something like this.....

AAA & RADIUS <----> Internet <----> 2811 w/SSG <----> Catalyst <---->
Aironet WAP <----> Client

Any help, advice, right-direction-pointing, much appreciated!