I think I want to cry

Have you had a chance to look at all the documentation? See link below-
www.sophos.com/.../sophos-xg-firewall.aspx

NAT is in Firewall Policies
And at least for me that works without a problem.
What is the issue?

Yes, the only relevant document is the admin guide, but this document is below standard, it just describes the GUI without explaining what is actually happening under the hood. The UTM docs are much more detailed.

So there is a different NAT for every policy? How does this work? What are the NAT rules for SSL remote access? Where can I consult the actual NAT table?

All NAT is always setup in policy, so if you want SSL Remote Access, you need to make a policy for that as well. You'll need to either way, cause otherwise not much will happen

I do not know if there is a view of all enabled NAT rules though

You can login to console or under admin via web interface. Choose option 5 for device management and then option 3 device management. You will get a shell that will let you run the relevant iptables commands. The access level is readonly as far as I remember so you may not be able to change anything.

Option 4 in cli ( device console) gives you cyberoam console that you can run different commands. You can use ? for help and a list of commands there.

Thanks. I had not made yet the link with cyberoam. I was assuming that the XG was an UTM evolution rather than based on cyberoam.The cyberoam documentation is quite usefull.

Have you looked at Kerio Control? www.kerio.com/.../kerio-control A coworker has been using it for home use for awhile and love it. The learning curve coming from astaro/sophos doesn't look like it would be that hard.

I just took a look at that.. circa $300 per year plus you have to pay on top per user? Or am I missing something?