Support resolved the issue for me. When diagnosing the issue with the CS firmware we added a second access policy for testing. Turns out there is a bug with the IOS XE firmware where if you have 2 access polices only one of them work. We removed the second policy and it works. This still doesn't answer why I had issues with the CS firmware but with the IOS XE firmware I'm fixed. ... View more