in our company main side, we have a Sophos UTM Appliance that is acting as gateway. (No NAT)
Here at home, i'm doomed to stick to my ISPs default Router, so pfSense is behind that router.

Until 3 days ago, I used the Home-Version of Sophos XG Firewall, to connect through an IPSec tunnel to the Sophos UTM. Everything was working, multiple subnets have been used.

Then I had the bad Idea to give it a shot with that new firmware upgrade. New Version is broken, backup can't be used cause after restoring its losing its activation - and in THAT version, there was a bug, that all interfaces go offline, once not activated - so that backup is bricked as well.

So, searching for an alternative I found pfSense and it looks pretty solid. I installed it, everything wen't quite smooth and started to setup the IPSec tunnel with the Sophos. But now, i'm facing some issues I don't really understand, and hope somebody here has an idea which button to press.

So, Situation Summary:

Network at Home:

• 10.10.20.0/22 (Network for all Clients on the green side of pfSense)
• 10.10.19.0/24 (Network on the red side, basically only my ISPs Router and the red side of pfSense)

Network at Work:

• 192.168.136.0/22, Sophos acting as gateway, owning an external static IP.

Status:
I configured the pfSense to have the both IPs 10.10.19.2 (red) and 10.10.20.1 (green). IPSec is configured to use PSK, AES 256, connection is established successully. Both Firewalls show the communication-logs, do key renewals etc.

For now, I tried to get it working with only 1 SAD (192.168.136.0/22 <=> 10.10.20.0/22)
That SAD establishes it's connection and pfSense is reporting Outgoing traffic. I can verify from the firewall logs, that connection attemps of various services are "leaving" through the red gate of pfSence (53 / UDP (DNS-Queries, caused by DNS Forwarders), TCP 5070 (VOIP-Phone trying to connect) and many more.)

But then, the trace of that packages gets lost. The Sophos firewall - which I configured to log every dropped or successfull package - does not show any trace of incoming traffic.

Trying to reach my subnet from the Sophos-side also reports all packages as "green" and allowed - none of them is reaching pfSence.

So, I am highly out of ideas, because the "technical" route was working with 2 sophos appliances. (hence the router of the ISP does not block that / forwards and receives correctly i'd say)

The only assumption I have is that it has to do something with the identifiers of the IPSec tunnel, so the firewalls in some way are thinking "hmm, that package is not for me" - but I think I tried every possible combination, and I'm not sure if it would manage Phase1 at all, if the identifiers are wrong?

Here are some of the configuration screenshots, If you need any additional Logs or something, just let me know.

pfSense:

Note the "Packets-In": 0

Some "confirmed" Outgoing packets:

Sophos-Side:

Shows no trace of "incoming" packages from pfSense beside all the Phase1 Communication itself (UDP 500 / 4500)

So, I have the feeling that packages are send out by pfSence, but somehow missrouted down the road.

As said, the Sophos side was perfectly fine with the Sophos XG on my side, so I assume everything there (Routing, Firewall rules) are still fine and working.
(No one but me is changing something there)

Any Ideas where I could continue searching for issues?