NEWBIE Question: AM behind firewall

Hello All

I'll try to explain what I need to understand.

Our organization already has a firewall environment in place etc.

The purpose for Access Manager is to provide protected access to 5
websites via radius AND to provide 1 sslvpn to citrix and 1 sslvpn to
windows 2003 server (via rdp)

I've setup all the AM services on seperate servers. The admin console
on one, the Identity server on antoher and the Access Gateway (with
SSLVPN) on a 3rd

My question is;

1) If all the AM services are on the private side of the firewall, what
"holes" am i requesting the firewall guys to be opened?

Only the public IPs for the proxies? do I need a public address for the
AG and IS servers themselves?

Thanks