BM 3.8 SP2, NSBS6.5.2

C2S VPN is up. User logs in with "All traffic encrypted" rule, still traffic
wants to go unencrypted. Client dials in to the ISP. Ethernet is diasbled.

Why? How can it be resolved?