This is very funny because I've had the same ticket open for almost 6 months because I couldn't get the SEG working after having the Tunnel and Gateway working. Every support person said that each service has to be on its own UAG which seems wrong considering how the old SEG/CG's were setup. I had one support person have me delete the UAGs and deploy just as a SEG to only find it never would keep the settings. Random issues...I think their appliance has problems their documentation does not support and no one is willing to admit it.