FYI all,
The default SEP 12.1 firewall rules do not allow RDP over MS VPN. It is a simple fix:
Add a rule to allow VPN connections and port 3389 through the firewall for the affected subnets. Do add the matching block all rule following every allow.
What you Do Not Do is contact Symantec Support; especially if your company is a contracted service provider. You will run up a bill for your client for no support. We did call for help, and we emailed Symantec support our firewall .dat file for their review before the call.
Symantec spent 2 hours of our tech time and did not resolve the cause.
We maintain records and metrics and regularily review our suppliers capability. I see that Bitdefender Gravity and Kaspersky have received top honors lately.
Just sayin'.
Regards,
Mac