Consider a worldwide distribution of thousands of embedded servers, and clusters of servers behind firewalls that sysadmin wants to access remotely.
With a focus on a remote access for login and diagnostic operations, reverse-proxy or vpns could work but may not scale for 20K+ devices.
I'm unfamiliar on how server monitoring solutions "know" to connect to remote server agents. I'm thinking that some form of periodic "I'm here" message to the sysadmin opscenter could provide access routing through a remote firewall. Perhaps periodic reverse ssh tunnels could provide a semi-persistent session so that sysadmin at opcenter (gateway) may connect to the device at any time. In this case, wouldn't the gateway server need to handle thousands of concurrent "port" connections.
One analogy for this feature is the Teamviewer service where you see a list of known remote devices. Any advise on similar solutions for SSH is much appreciated.