When you upgrade or install Citrix Netscaler VPN client with Symantec Endpoint Protection (SEP) installed some internal sites are blocked once connected to the VPN.
An old Application Control rule called "Protect SEP client files and registry keys" is blocking changes in the registry. This rule was removed in SEP 12.1 RU1 and should no longer be used.
Remove the Application Control rule "Protect SEP client files and registry keys".