Citrix VPN/Cisco AnyConnect and WSS does not restore the proxy settings properly when locations are switched for SEP. For example, non-VPN to VPN locations where a proxy is configured for one and not the other.
This issue is caused by the Cisco VPN Compliance ACL which restricts access to the networks until the agent scans for compliance.
Change the Cicso VPN Compliance ACL to allow access from the SEP Client as needed. If you are unsure how to do this, please contact Cisco for assistance.