If you do a TCPdump on the XG, for the Public IP of the computer trying to connect to, do you see traffic arriving to the XG from this Public IP?
#tcpdump -eni PortX host X.X.X.X and port 500 (where the X in Port is the Port number where the Sophos Connect is listening to usually Port2, and x.x.x.x would be the Public IP of the computer trying to do the connection).
