I ask because I actually help run a lot of the security for a University, as well, albeit much smaller. It looks like your current setup is based off snort. If that's the case, is there any reason you could not use the snort module for pfSense and use that to do detection and control?
The solution we're looking at will use MS-NAP and interact with Windows clients, which is about 90% of our students, to preemptively check their security. Though, if you have more info on your setup, I'd love to know how it all works. So feel free to PM me, as I don't want to derail this thread any more than I have already. But we're an 8 person operation serving about 5,000 students across 4 primary campuses, so any input is always welcome.