Cisco Router – Accessing own external IP internaly

Have you considered using Radius or TACACS+ for AuthN/AuthZ? Those will accomplish the same thing as your proposed script, and unlike your script, are well-supported methods by Cisco.

I think you're probably worrying about the problem too much. 100 users are unlikely to be that demaning, even if they are heavy data users. Realistically you could probably get any sort of router to connect your company to the internet, and stick a couple of stacked 48-port gig switches behind it to connect up all your desktop machines in the office. Any basic cisco router (or any current router from another vendor, or even a linux box) will probably work fine.

I agree that vendors will try to upsell you a lot and try to add on things like voip, remote vpn access, etc. In my experience you can add a few specialized boxes to your network to do those sorts of things as the need arises. Don't get sucked in to the idea that you have to buy some sort of modular 'solution' from a vendor.

Here's a real-life example: I ran the network at a scientific computing company that supported about fifty users. We had a SonicWall internet appliance for the external router and firewall. That device got flaky so I put an extra network interface in a desktop machine running CentOS and used it to replace the SonicWall. That configuration ran fine for several years - no routing or firewall issues to speak of.