GUP's 101.
I spent some time trying to answer this question during Pilot and this is what I did to get some visability. Here is my 2 cents worth
GUPS will only work for clients on the same subnet. If your clients and servers are located on different subnets use SEPM/LiveUpdate
Confirm that the GUP is a GUP. Properties of the server will show Group Update Provider Status. This should be true.
Confirm using the Client Management Logs that the message "Start serving as the Group Update Provider (proxy server)" is seen.
Confirm the folder %Program Files%\Symantec\Symantec Endpoint Protection\SharedUpdates exists and that it contains content (GUP.DAT)
Use the netstat 5 -a | find "2967" in COMMAND PROMPT. This will poll every 5 seconds and show connections to this server/port.
Confirm that that a policy enables a GUP and a policy tells the client to use that server as a GUP. For example, If SERVERA is to be a GUP then add SERVERA to a LiveUpdate policy (Server Settings| Group Update Provider| Use a Group Update Provider | Multiple Group Update Providers) and apply to the group containing SERVERA. This will cause SERVERA to GO GUP.
Then for the client(s), Example CLIENTA, Apply the same Policy or create another policy, but the policy must contain the server name of the GUP. I use Multiple GUP's (even if there is only one). It is important for the GUP to be included in a policy that makes it a GUP. The policy for the clients will contain the same information but does not make the server a GUP (Unless using the policy) it just tells the clients to use those machines as GUP's.
If all is working well you will see the workstations ip address/name on the server (GUP) that is running the NETSTAT command as they connect to update content.