Remote Access IPSec (Android <-???-> UTM <-> private LAN)

Hi,

I am quite new to Sophos and would need some help on Remote Access (IPSec). I'll try to explain my setup:

Before I setup VPN I checked ping between all the machines works fine.

[   Android(IPAddrA) <-> (IPAddrFext)Fritz(AddrFint) <--> (IPAddrRext)Router(IPAddrRint) <-> (IPAddrSext)Sophos(IPAddrSint) <-> internal network]

fritz is configured to do port forwarding for port 500, 4500

Now I have setup Remote Access VPN (IPsec, nat traversal, preshared keys, XAUTH, defined User) between Sophos and Android and the VPN is 

established.

...please let me know whether my following understanding is correct/wrong:

1) I see an SA established between IPAddrFext  and IpAddrSext.

    --> IPAddrFext is the remote tunnel endpoint and used instead of IPAddrA(10.242.4.1) because of nat traversal I assume, correct!?

2) ping from Android to private network (IPAddrSint) does not succeed over established VPN

    --> On the Router I use wireshark to decrypt the packets. I see the ping packets from Android over the tunnel with inner srcIp 10.242.4.1 and inner dstIp IPAddrSint as
          expected.

   --> On sophos I use tcpdump

              tcpdump -i any -n src host 213.196.249.130 ---> I see those encrypted packets

              tcpdump -i any -n src host 10.242.4.1 ---> I do not see any decrypted packets!?

  ..what else could I check or what am I missing?  

Thanks,
Michael