Client Access/400 communications through a proxy-based firewall

I'm looking for any and all input in regards to allowing secure access
(via the Internet) to AS/400 resources behind a firewall (Eagle Raptor
NT 4.0).  Specifically:

- What ports (besides Telnet on port 23) should be opened up to allow
full CA/400 (Win95 enhanced client) access?  In addition to display
session, ODBC, file transfer, and shared folders access may be required.

- Confirm which connectivity methods and client software provide
end-to-end encryption of AS/400 userid/password and session information.

- We also have the capability to provide SecurID authentication through
our firewall.  Does anyone know if IBM (or 3rd parties) are developing
SecurID "client hooks" into the AS/400 login process?

- Appreciate any other, related issues or experiences that pertain to
secure AS/400 access via the Internet.

Thanks!
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* This is the Midrange System Mailing List!  To submit a new message,   *
* send your mail to "MIDRANGE-L@midrange.com".  To unsubscribe from     *
* this list send email to MAJORDOMO@midrange.com and specify            *
* 'unsubscribe MIDRANGE-L' in the body of your message.  Questions      *
* should be directed to the list owner / operator: david@midrange.com   *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *