Sophos XG 19.5.2 MR2 MTA Mode SMTP Port 25 connection timed out - inbound to internal address

I have the oddest problem with my XG firewall. Everything works fine, with the exception of the MTA passing mail to the backend server.

MTA internal IP is 192.168.128.1 - Mail Internal IP is 192.168.128.12

The problem. Mail is stuck in the mail spool queue with status Failed (reason string = R=static_route_hostlist T=static_smtp defer (110): Connection timed out DT=15s)

when I delete the retry files - the smtpd-main.log file reports

9761 1 queue-runner process running
DBG May 25 07:56:39Z [ MPOLLER]: state failed 'No such file or directory'
9761 2 queue-runner processes running
2023-05-25 07:56:48.082Z [22028] 0llgyk-Y1wWLK-Os H=192.168.128.12 [192.168.128.12]:25 Connection timed out
DBG May 25 07:56:48Z [ MPOLLER]: Number of events: 1
DBG May 25 07:56:48Z [ MPOLLER]: poller_loop:calling handler, events = 1
DBG May 25 07:56:48Z [ MPOLLER]: handle_inotify_event: file received in msglog queue '0llgyk-Y1wWLK-Os'
DBG May 25 07:56:48Z [ MPOLLER]: Number of events: 1
DBG May 25 07:56:48Z [ MPOLLER]: poller_loop:calling handler, events = 1
2023-05-25 07:56:48.125Z [22026] 0llgyk-Y1wWLK-Os == mick@domain R=static_route_hostlist T=static_smtp defer (110): Connection timed out DT=15s
DBG May 25 07:56:48Z [ MPOLLER]: handle_inotify_event: file received in msglog queue '0llgyk-Y1wWLK-Os'
2023-05-25 07:56:48.241Z [22048] RC4Vvv-2Qu104-1p == mick@domain R=static_route_hostlist T=static_smtp defer (-54) DT=0.000s: retry time not reached for any host for 'domain'

I have removed the actual DOMAIN from the email address for obvious reasons, but everything else is unchanged.

now the weird thing - if I telnet from the terminal to the SMTP server - boom no issues

SFVH_SO01_SFOS 19.5.2 MR-2-Build624# telnet 192.168.128.12 25
Trying 192.168.128.12...
Connected to 192.168.128.12.
Escape character is '^]'.
220 DOMAIN ESMTP MailEnable Service, Version: 10.45-- ready at 05/25/23 08:59:34
mail from:me@domain
250 Requested mail action okay, completed

so with the above in mind, I am truly stuck on what is next. if I switch to legacy mode (proxy) all works fine and all mails gets passed via the firewall to the mailserver, switch back to MTA , default SMTP(S) rule is added and emails get stuck in the queue.

any help would be much appreciated.

Thanks,

Mario