One thought on that CAG product - it's a solid box, but if you're going to go the SSL VPN route, you ought to consider a true SSL VPN, which CAG is not.

CAG is great for Citrix but that's it - if you've got web apps, like PACS or oven OWA, you'll need another solution just for them. The CAG doesn't even have an HTML rewriter, a basic security requirement for an SSL VPN. SSL VPNs do as good a job front ending Citrix as CAG but can also front-end native terminal services, Web apps, some even do tunneling. Check out things like the AEP Netilla box which does all of this, it's pretty cool.

Just my two cents!