We used to use the NetExtender Client.
Changed from SonicWall to Sofos and have had some difficulty getting their SSL to work for this purpose (probably my routes as the client works well for other things).
Meantime, I upgraded to IPO 9.1 and have been praying for NAT to work on the softphone that is now called Communicator. Interesting that I consider this HUGE and Avaya has not even mentioned it in the Product Update or anything- yet it seems to work! (preliminary test this morning). I went through a huge pain a year ago and upgraded from 500v1 to 500v2 in order to get 96xx phones to work w Nat Passthrough vs VPN (they never told us a 500v1 won't work for Nat phones, but that was the culprit!).....figured eventually they would kill the V1 anyway and they did in 9.1 so I didn't complain about a few hundred for a chassis swap). Anyway, if you are going to 9.1 you may find some love there with NAT for the Communicator version of softphone (and pain in other places). We are about to also test the re-released MAC softphone where I REALLY need NAT to work, but somehow doubt they pulled that off (time will tell). (BTW, is this crazy or what.....they kill softphone w windows and move people to communicator, but re-introduce softphone to MAC instead of also giving them communicator, but give iPAD communicator?????? -any actual thought about consistent user experience going into this (like what 1X was supposed to do years ago and still hasn't delivered?) ?