The network interface cards (NICs) on a Gateway Enforcer appliance are configured by default so that eth0 is used for the internal NIC. The internal NIC must connect to the Symantec Endpoint Protection Manager.
You can use the configure interface-role command if you need to change which NIC is external and which is internal.
If you use the Gateway Enforcer to download On-Demand Clients and you have enabled 801.Q trunking on the switch, check the NIC connection speed. To successfully download the On-Demand Client, both NICs must connect to the switch with the same connection speed.