FTPS, without NAT (DMZ-LAN) no TLS connection established on Port 21 possible.

Hi there,
I'm struggling with a problem that i don't really understand.
In the DMZ is SFTPGo App, which provides a FTPS server.
From external (NAT) through port 21, works TLS or unencrypted connection.
From internal, although test LAN DMZ to SV is set to Any, no TLS channel is established.

{"level":"debug","time":"2023-02-09T14:51:57.259","sender":"ftpserverlib","server_id":"FTP_0","clientId":"56","line":"AUTH TLS","message":"Received line"}
{"level":"debug","time":"2023-02-09T14:51:57.259","sender":"ftpserverlib","server_id":"FTP_0","clientId":"56","line":"234 AUTH command ok. Expecting TLS Negotiation
.","message":"Sending answer"}

Now comes the exciting part, i change the FTPS server to another port from 21 e.g. 2121, TLS also works.
It must have something to do with the XG, because a cloned VM into the LAN network works without any problem.

We think that this problem occurred only since this change, because before port 21 had no problem with TLS.

set advanced-firewall ftpbounce-prevention data

DPI is also disabled.
Is there any other FTP ALG that could play a role here?

thanks for any Help here.
Stefan