MVPN connect static NAT

Hi,
we have a https policy:
any-external. any-trusted to static nat (extIP->intIP)

and mvpn-ipsec-policies for 2 groups:
1) any to any , allowed ressources = any external, 0.0.0.0/0
2) tunnel-https, allowed ressources = intIP + extIP as above

both groups can´t reach the https service, neither extIP nor intIP.
did I oversee something?

I tried to add the mvpn-users to the normal https-policy, but without success.

with MVPN active, https-sessions to external are functioning, but to this internal server not. Any ideas or help would be nice..