1. Yes, depending on what you are using.
2. Yes, depending on what you are using.
3. Yes, depending on w.... er actually I don't know what a Citrix CAG is....
Check out SSL Explorer :
http://3sp.com/showSslExplorer.do
I've just started playing around with this and have gotten it to do web vpn stuff as well as app stuff (remote desktop, ssh) and also traditional network type VPN.