Make sure you use the latest iApp for Citrix from downloads.f5.com. You also must ensure that you set the iApp to proxy the traffic and replace the role of Citrix secure gateway. APM will properly patch the ICA file delivered to the client AND proxy the traffic without needing app tunnels or any other client side application other than Citrix Receiver. I believe the iApp shipped with TMOS is designed to work with secure gateways or other products.
We run several hundred clients this way for several different farms, and it has worked out great.