Web and Cloud Access is designed to be toggled on and off from Symantec Endpoint Protection > Advanced > Web and Cloud Access Protection > Web and Cloud Access Protection toggle. If you visit the macOS System > Network Preference Panel> SEP Web and Cloud Access Tunnel and use the toggle for the VPN from here the UI may show connected even when it is not.
SEP 14.3 RU6
Web and Cloud Access
macOS
The feature is not designed to be operated from the Mac System settings. Toggling the feature off from the SEP UI and then on via the System > Network preference panel is unsupported and will cause the tunnel not to be re-connected.
Use Symantec Endpoint Protection > Web and Cloud Access Protection for enabling and disabling the VPN.
MDM users should not have access to this location.