routing traffic over an alternate gateway (fixed VPN with other plant) without TRAFFIC_INVALID

Since our old WatchGuard firewall died, I've set up a Sophos XG firewall as a matter of test.

Next to our gateway x.x.x.1 we've got a juniper SRX210 x.x.x.19 that functions as a VPN provider towards our motherfirm.

I've defined the routing towards the VLAN's as well as the zones of the VLAN's in the mother firm and created a rule that allows the LAN to the zones in the mother firm.

Pinging, tracert, etc all work fine.. I'm able to reach the servers at the other end.

But when I'm trying to connect to the iSeries with a Client Access client for instance, I'm not getting a connection.

All I see is that the traffic is denied and with the packet capture thingy, I receive a "Traffic_invalid" error.

If I add a manual route on a client, using the x.x.x.19 as default Gateway, the connection works, but printing from the iSeries to a local printer doesn't...

Can anybody advise please.

Thanks in advance for the effort

David.