vSZ essential - site to site vpn - remote ap issue

[alex]

I have site to site vpn between 2 locations.(all traffic allowed)

i can ping/ssh from each location to device.

when i setup the vsz ip on ap it connects to vsz - i approve it - move it to correct group and then :

- AP connected

-AP heartbeat lost

-AP disconnected

-AP connected

-AP heartbeat lost

but ping / ssh working. Ap shows online but not receiving AP Firmware 

Configuration Status - New configuration