Trying to set boot-args with nvram gets "general error" on Sierra

I'm trying to temporarily disable KEX signing enforcement on my MBP since my company's VPN client (GlobalProtect) is failing the signature check now. This started yesterday when I did the OS upgrade to Sierra yesterday.

The solution should be running this command:

sudo nvram boot-args=kext-dev-mode=1

The problem is that I am getting the following response, and I can't figure out what it means or what to do about it (meaning I can't connect to my company network, too).

nvram: Error setting variable - 'boot-args': (iokit/common) general error

Does anybody have any ideas of things I could try or otherwise look at to track down the problem?

Thanks.

According to Apple KB : Prepare your institution for iOS 10 and macOS Sierra

...you must use the nvram command to properly set boot-args NVRAM variable. Starting with macOS Sierra, you must be booted to the recovery partition to run this command.

The kext signing restriction was integrated into System Integrity Protection starting in El Capitan, and as a result the old disable flag no longer works. But there's a new way to do it: boot in recovery mode, and run the command csrutil enable --without kext. I haven't tested it, but my understanding is that this will turn off the kext requirements, while leaving the rest of SIP enabled. If that doesn't do it, try csrutil disable to turn SIP off entirely.

I got the similar issue and resolved the with the help above solution.Thanks..

1. Get into Recovery Mode by restarting and holding down ⌘+R until Apple logo appears.
2. In the top menu click Utilities > Terminal.

3. In the Terminal window type:

   csrutil enable --without kext
   

   and press Enter.

4. Then restart the Mac.