Yeah, there is. First, doing it with SSH+keys requires either multi-step (which is annoying, esp. for copying files), or exposing each servers SSH to the net (which might be unfeasible if you don't have public IPs for everything).
Second, getting a dump of a table from your MySQL DB with SSH+keys:
ssh prod-db
mysqldump what-i-need > file.sql
exit
scp prod-db:file.sql .
With VPN (assuming the connection is running):
mysqldump -h prod-db whatever > file.sql
(I'm not saying it's neccesarily a good idea to du dumps of your production db, but that was the example that came to mind.)
There's also stuff like instrumenting a running Tomcat with JVisualVM on a server in your remote environment (which, no, you can't easily do over SSH-forwarded ports.. also, portforwarding is annoying).
Finally, VPN allows you to run internal services. A jabber-server was mentioned in the article, and perhaps a webserver with some reports/dashboard thing, cacti/nagios stuff etc. without worrying about setting up authentication and SSL for each. Each VPN user gets his own IP, so you can just do crude IP allow/deny if you need, or you can put the customer people on one subnet and allow them to access the reports server, and the devs/ops on another that can reach everything.
Second, getting a dump of a table from your MySQL DB with SSH+keys:
With VPN (assuming the connection is running): (I'm not saying it's neccesarily a good idea to du dumps of your production db, but that was the example that came to mind.)There's also stuff like instrumenting a running Tomcat with JVisualVM on a server in your remote environment (which, no, you can't easily do over SSH-forwarded ports.. also, portforwarding is annoying).
Finally, VPN allows you to run internal services. A jabber-server was mentioned in the article, and perhaps a webserver with some reports/dashboard thing, cacti/nagios stuff etc. without worrying about setting up authentication and SSL for each. Each VPN user gets his own IP, so you can just do crude IP allow/deny if you need, or you can put the customer people on one subnet and allow them to access the reports server, and the devs/ops on another that can reach everything.