The following article fixed the issue. - EXCELENT
Unfortunately a Sophos engineer helping us was unaware that DOS UDP flood protection will ruin a perfectly good VPN.
Do NOT click the Apply Flag box for UDP flood Source if you have VPN clients.
Right, that's what I said: could protect against a DOS attack, not so much a DDOS attack. And it is labeled DOS, not DDOS, so there's truth in advertising at least. Except now-a-days anyone who actually has knowledge and wants to disrupt things would use a DDOS attack which the simplistic "lots of traffic from one host" doesn't do much to stop. And, as you say, an attack that manages to fill your link's download capacity will mess things up even if you stop everything at the firewall.
Personally, I think there should be DOS capabilities on a firewall that are oriented towards protecting the firewall itself from overload -- filling buffers/tables, causing race conditions, etc -- so it's not looking at traffic per-se but rather the impact that traffic is having on the firewall's integrity. (I.e. I can imagine an attack that floods a firewall in such a way that Snort crashes and then there's a window for sending traffic through that IPS would otherwise stop.)
To stop DDOS, you need an infrastructure, not a single device.
