IPSEC VPN to Amazon AWS VPC - Traffic not passing

[Oddnewfi]

Hi,

This is a bit of a pig of a setup - but any ideas appreciated…

Our Side

PFSense 2.1- release on physical hardware (Dell 1950) behind a Watchguard Firewall

Other side

Amazon VPC VPN End point

Security

Rules on Watchguard permit all incoming traffic to PFSense.
Amazon Security Groups and Network ACLs set to allow all (from our side subnet)

Behaviour

From Amazon side host - can connect and establish connection to machine behind pfsense. Tunnels come up and traffic flows.
Once the tunnel is brought up from the Amazon side - then host on our side can connect to Amazon hosts.

However. If tunnel is down and our side host wants to connect to Amazon. Tunnel comes up and can see outbound traffic on the SAD bytes counter - but nothing coming back (the return path shows no traffic on the SAD bytes counter)

Steps so far

NAT-T off / on - no difference
DPD off/on - no difference
Disabled firewall (routing only platform)
Allow IPV6
Enable MMS clamping (at 1400)

Running Racoon in debug mode - and the tunnel doesn't appear to be flapping (can see RU there requests and responses, for example).

Using exactly the same settings from another machine (without the Watchguard in front) works just fine. So seems like somehow the Watchguard interferes with the traffic on the way out, if the link comes up from our side. Whilst this is not therefore a pfsense problem as such - could anyone point me to any ideas as to why this might be happening

Many thanks