What's my issue? SonicWALL dropping VPN traffic - failed spoof check

What's my issue? We have a hosted application from a vendor. They insist on shipping a Cisco ASA to establish a VPN tunnel back to their datacenter instead of bringing up the tunnel on customer equipment. I have a pair of SonicWALLs in active/passive HA - so I already had the ISP's handoff coming into my switch to break it out into 2 handoffs (one for each SonicWALL). I added another switchport to the ISP VLAN to create a third handoff for the ASA. The SonicWALL +HA and ASA each are assigned an IP from the block issued by the ISP/

Print jobs sent from the hosting company's print servers are not going through to a couple of printers on my 192.168.1.0/24 subnet - the SonicWALL (default gateway for the subnet) is dropping the packets with drop code 499 (IP Spoof check failed recorded in module network). I'm having trouble determining where the problem lies. There are several other printers on the same subnet that work fine.

Maybe this diagram will help? https://imgur.com/a/fEyBKxF