I use BOA for my sites, but by default BOA simply disables front end-caching on the fly for form submissions. Beyond my actual experience I came a cross a one year old artificial on how the New Zealand Post deals with Drupal & Varnish and the form token issue. Holy John Wayne, its a must read for Drupal caching -really. Focusing only on the the form issue:
The final piece to our puzzle is the Cookie Cache Bypass Advanced
module, which automatically sets a special NO_CACHE cookie whenever
the user submits a POST form on the site, including things like the
login form. Our Varnish is configured to bypass the page cache (but
not the ESI cache) when it sees this cookie.
You can also disable form tokens when XSRF production is not reaquired with in form_alter (unset($form[‘#token’]);) or ($form[‘#token’] = FALSE;)
An Acquia Drupal performance article puts forth a Drupal Module Authcache, but reading the doc on Authcache, it works out the caching with a place holder for the form (not caching the form):
Authcache attempts to intercept any customized content and set up a
placeholder within the HTML. Then after the page is loaded, an Ajax
callback is used to retrieve custom data and fill in the placeholders,
dynamically updating the page HTML.
Current Authcache placeholders: Form tokens (logged-in users only; required by > Drupal to prevent cross-site request forgery attacks)
The strategy is, cache everything but the form. So addressing everything else:
Maybe Varnish is not used at all, Memcache & Redis? My strategy would be to use what BOA offers because I use BOA and the wizards behind it (omega8.cc) know a ton more than I. I dont think there is an external cache that solves the problem. They all seem to bypass for the form.
Do partial caching with the aforementioned authcache and with finely tweaked Views and Panels as mentioned in the NZ Post article and described by the brain trust at Wunderkraut - its old, but addresses the issue.
Use Drupal ESI Module and Varnish is partially ESI compliant):
ESI - or Edge Side Includes - is a high performance caching solution
for Authenticated users but can be helpful for Anonymous users as
well.
Typically, pages which are personalised for authenticated users (even
minor personalisations, such as a block which says "Logged in as
manarth") will prevent reverse-proxies (which can easily perform 100
times faster than Drupal) from caching the page, because messages
intended for one user could then be seen by another.
Hope thats more helpful.