When connected to Wi-fi, the Umbrella roaming client works like a charm, and shows protected and encrypted status. As a result, web-filtering policy does take affect via the cloud to apply to laptop users when outside the network. However, when my users are connected via Wi-fi, and etablish a VPN connection, the roaming client will switch back and forth between protected and encrypted to unprotected and unencrypted mode. As a result, web filtering policy from the cloud does not take affect. If anyone is familiar with OpenDNS Umbrella, let me know if you experience similar symptoms. I have a ticket open with support, but they cannot resolve this issue.