If end users in your org are on a public network that likely has restrictive policy rules (e.g., an aiport) and they are losing connectivity.
The Enable Service Tunnel over TCP setting uses port 443, and performance while using the tunnel will be reduced to 30% (e.g., 329-345 MBits/sec using the tunnel; without using the tunnel, 1.15Gbits/sec). When enabled, this setting stays enabled for 12 hours; after 12 hours, it resets to its default state (i.e., toggled off).
This feature requires at minimum Netagent version 2.9.