You may have this one in the Wireless Protection logs:
Corrupt payload. Device may have wrong key. Delete device to re-register it.
And if you're asking yourself now: Where should i delete it...
In UTM9 you can expand the list of Active, Inactive and Pending Access Points which are collapsed by default (which is very bad, Astaro)
Took a long time to find out in the logs that i have to delete them, and then some time more to find out that i have to expand the Inactive Access Points first to delete it...
I think the problem is that, because it's a fresh installation, the UTM generates a new key which doesn't match the key from the v8 ASG where the AP was initially installed with.