IPsec dialup VPN - user groups in firewall rules

For a while now I have been successfully using the IPsec VPN with Forticlient (and native client on mac). However as soon as I assign user groups to firewall rules (the user groups contain the users which successfully connected to the IPsec VPN) the traffic is blocked.

According to documentation I understood that I need to have XAuth activated for the VPNs which I have - still no luck.

I currently have 2 types of IPsec VPNs, a PSK+XAuth based and a Cert+XAuth based one.

Below you will find the config snippets of the respective VPN configurations:

edit "RemoteAccess"
        set type dynamic
        set interface "wan1"
        set authmethod signature
        set mode aggressive
        set peertype peergrp
        set mode-cfg enable
        set comments "VPN: with cert and xauth"
        set xauthtype pap
        set authusrgrp "IPsec-users"
        set certificate "forti_Intra"
        set peergrp "intra_peers"
        set ipv4-start-ip 192.168.134.100
        set ipv4-end-ip 192.168.134.110
        set dns-mode auto
        set ipv4-split-include "RemoteAccess_split"
        set unity-support disable
    next

and:

edit "mVPN"
        set type dynamic
        set interface "wan1"
        set mode aggressive
        set peertype any
        set mode-cfg enable
        set comments "VPN: psk and xauth"
        set xauthtype pap
        set authusrgrp "mVPN-users"
        set ipv4-start-ip 192.168.134.150
        set ipv4-end-ip 192.168.134.160
        set dns-mode auto
        set save-password enable
        set client-auto-negotiate enable
        set client-keep-alive enable
        set psksecret ENC <hidden>
    next