Can't reach Sophos Connect Client via VPN tunnel from LAN "lan_to_vpn"

Question

Also german language is welcome ;-) 
 
 Envorionment: 
 Sophos XG210 / SFOS 17.5.10 MR-10 
 
 Setup: 
 LAN = LAG with two ports and multiple VLANs 
 VLAN70 = 10.10.70.0/24 
 
 Sophos Connect Client: 
 IP-Range 10.10.150.150 - 10.10.150.250 
 
 Firewall: 
 Source: VLAN_70/IP:10.10.70.20 | Dest: VPN/Any/Any 
 (there are of cource many more rules ...) 
 
 Situation: 
 The Sophos connect client can establish a VPN connection. It can reach all internal services permitted by firewall rules. 
 From VLAN_70/IP:10.10.70.20 i can't reach the a VPN-Client (for example 10.10.150.150) when it's connected. (Thinks like Client-FW and so on were disabled for the test) 
 From Sophos diagnostic i can ping the VPN-Client successful. 
 The "Policy test" said, the firewall rule described above, will match and accepted the traffic. 
 
 Question: 
 It should be possible to reach a Sophos connect client via VPN from internal VLANs as described above or? 
 What's the pitfall here? I need a hint. 
 
 If you need more information, let me know it. 
 
 Thx

Tom Baier · Accepted Answer

Finally, the case was escalated and I received the solution. 
 By default, the Sophos Connect VPN Clients are intended to be isolated, so no internal IPSec_route to the VPN Client Network is being created when saving changes to the Sophos Connect VPN settings. Currently, there is no option in the GUI to change that behaviour. So after setting up the Sophos Connect Configuration, the used ip range or network needs to be added to an IPSec_route manually using the shell. 
 If you set up the Client using the GUI, you specified an IP range (typically a whole subnet) and a Name in the Client Information section. Using these values, run the following command in the shell: 
 console> system ipsec_route add net [network]/[mask] tunnelname [Sophos Connect Client Name] 
 Use the following command to verify the successful creation: 
 console> system ipsec_route show 
 Important: make sure the routing precedence is Policy, VPN, Static. However, this may lead to problems in environments where MPLS is active. But it does not affect the Sophos XG's HA capabilities. 
 console> system route_precedence show 1. Policy routes 2. VPN routes 3. Static routes