[alar44]

VPN is easier to set up, manage, and troubleshoot. Connect to LDAP, set up groups, flip the switch, done. You'll have to use it for vendor or 3rd party access anyway, so may as well use it for the rest of the org.