Recently aquired an ONIE switch from Penguin Computing to investigate it's capabilities. The switch is an Arctica model 4804i with 2GB RAM, dual PowerPC e500v2 processors, and runs Cumulus Linux. The environment proved fairly easy to configure with some knowledge of Debian networking.
In our case a baseline configuration was established via puppet with little effort beyond installing the puppet client. It's pretty sweet to see 48 1Gb and 4 10Gb network interfaces list out:

  ip addr sh
  ...     
  4: swp2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 500
  link/ether 6c:64:1a:00:9d:d0 brd ff:ff:ff:ff:ff:ff
  5: swp3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 500
  link/ether 6c:64:1a:00:9d:d1 brd ff:ff:ff:ff:ff:ff
  6: swp4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 500
  link/ether 6c:64:1a:00:9d:d2 brd ff:ff:ff:ff:ff:ff
  7: swp5: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 500
  link/ether 6c:64:1a:00:9d:d3 brd ff:ff:ff:ff:ff:ff
  ...
  54: swp52: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 500
  link/ether 6c:64:1a:00:9e:02 brd ff:ff:ff:ff:ff:ff

Openvpn is not in the Cumulus Linux repository, so the following Debian Wheezy deb files were downloaded and installed:

  wget http://ftp.debian.org/debian/pool/main/o/openvpn/openvpn_2.3.2-7~bpo70+2_powerpc.deb
  wget http://http.us.debian.org/debian/pool/main/p/pkcs11-helper/libpkcs11-helper1_1.09-1_powerpc.deb 
  wget http://ftp.debian.org/debian/pool/main/e/easy-rsa/easy-rsa_2.2.2-1~bpo70+1_all.deb
  dpkg -i openvpn_2.3.2-7~bpo70+2_powerpc.deb
  dpkg -i libpkcs11-helper1_1.09-1_powerpc.deb
  dpkg -i easy-rsa_2.2.2-1~bpo70+1_all.deb

The Arch Linux wiki openvpn page has nice tutorials on setting up an easy-rsa and openvpn environment. Just remember, everything is already installed via the deb packages so no pacman needed.

A 4096 bit dh parameter file was was created on a local PC, and 4096 bit RSA key pairs don't take long on the switch itself.

  openssl dhparam -out dh4096.pem 4096

The use case needed the VPN to listen on an interface in a DMZ and exit on an interface in a management network.

  cloud --> DMZ --> VPN --> management

Clients manage devices in the DMZ from the management network. To avoid traffic short circuit to the DMZ interface from VPN clients a source or policy route was set up (use your own gateway for xxx)

  echo 200 custom >> /etc/iproute2/rt_tables
  ip rule add from 10.8.0.0/24 lookup custom
  ip route add default via xxx.xxx.xxx.xxx dev swp12 table custom

A running openvpn daemon appears to use around 3 MB RAM. At first glance a dirt cheap vpn concentrator could be easily created.