If you check out the group settings (may have to create a new group for him), you should see Default Time-of-Day Access Settings. There you could set the fours hours of access. His account should only be valid for the one day as well.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...