Hi,
Thank you for posting in Symantec community.
That's correct status if user is not connected to the main site through VPN.
You would like to configure your mobile computers to automatically download virus definitions when they are disconnected from the network but still update from the Management Console when connected.
Check this article: How to configure mobile computers to automatically download virus definitions when disconnected from the Symantec Endpoint Protection Management console
http://www.symantec.com/docs/TECH104571
By default, Symantec Endpoint Protection Manager provides updates to Windows clients. To help mitigate network overloads for Windows client updates, you should also let clients get updates from a LiveUpdate server.
To set up an external LiveUpdate server for Windows, Mac, or Linux clients
-
In the console, open a LiveUpdate policy, and click
-
Under Windows Settings, Mac Settings, or Linux Settings, click .
-
Click or specify another LiveUpdate server. If needed, specify your proxy configuration.
-
Click .
Reference article: Setting up an external LiveUpdate server for Symantec Endpoint Protection clients
http://www.symantec.com/docs/HOWTO81007