We have about 10 "workgroup" sites, each with no more than 10 users wanting to run citrix clients and also up to 100 remote users wanting to run the same from dial-up / ADSL internet connections. We are proposing to use VPN for both these scenarios. It has been suggested that we use the PIX 506e at the workgroup sites end and the software client at the remote users end. What device would be best to terminate all these connections to, a 515 / 525 or something else ? Is there a device that would provide VPN capability (via ADSL) and ISDN backup in place of the 506e ?