Hello Steve,
Thanks for providing the clarity on the traffic flow 
.
Ideally SSG FW should allow both the protocols (TCP and UDP) irrespective even though the traffic is for the same port and also seperate sessions should be created as we have allowed both TCP and UDP in the service.
Hello WG91,
Just collect the external captures along with the logs mentioned in my previous update that will help us triage the issue.
Regards,
Rishi