Hi:
A few weeks ago we had to deal with that and was not so complicated. Basicaly as previous link said, you have to force all traffic go through the Ironport, probably denying all traffic from LAN to WAN in the firewall for instance. After that if you configure something like wwcp (Transparent redirect), and need to create 2 rules. One that applies to the users that have Skype access and the other that denied access to Skype. This is very simple because in the new Async OS 7.5 has a category Internet Telephony just simply allow or deny to the end users that match those rules.
Also if you look at the log of the Ironport (Accesslog) you'll find messages denying *.skype.com and those users, clearly can't talk whith an Skype client.
Regards,
Francisco Rodriguez P.
