Is there any developers out there listening to these user bb's? We are taking part in your beta sending you our info. I can see how some people will look at this after a few minutes and quit. I didn't, it's somewhat useful when you get it right. I posted last week my environment.
https://ubb.sophos.com/beta-versions/project-copernicus-public-beta/59463-firewall-behind-firewall.html
Running a dedicated TAP interface works if you set it up right, but it thinks its being attacked. I forget where ips is and how to turn it off from the GUI or create exceptions, moving back and forth between UTM's and then copernicus, but if someone can help me out, the SAR for yesterday and IPS from monday-today are attached.