No worries, I didn't think you were. Just wished I had something more to offer. I had another thought, the iFrame module allows you to pass a number of DNN parameters, through the querystring, to the page you are trying to load. Maybe you could add an include file to your asp pages to check the querystring for those DNN parameters, or a static parameter that can be used for authentication? It wouldn't completely secure the pages, although it would require the person trying to access them from outside of DNN to know what parameters to pass.

Just for the sake of completeness I have found a sort of solution to this -

Using this article http://weblogs.asp.net/scottgu/archive/2007/03/04/tip-trick-integrating-asp-net-security-with-classic-asp-and-non-asp-net-urls.aspx - I can set the .NET runtime to run first - this will check the web.config and see if anon users are allowed - if not they are kicked to a page I designate as the login - now just to build it out and test it a lot

I figure there must be someway in the top level web.config to say anon users are not allowed in such and such a directory right?