Endpoint Protection

We are having a similar problem with our SEP environment - There is a Key mismatch between MSL policies, clients and the management server - however, we are lucky that it does not seem to be a problem On VPN / local to the network. Our persistent problem has been clients not communicating back to the server OFF VPN unless they are running client version 14.0 RU1. We have a case open for this, but Broadcom's proposed short term fix is to downgrade the clients to version 14.0 RU1 while its still supported. 14.2 RU2 seems to negate the mismatch and communicate ONLY while ON VPN or local to the network. I tested a pre-release version of 14.3 and saw the same behavior (14.3 MP1).