mapped networ drives via vpn site to site

Same answer, you have to create the site to site rules for what you allow specifically. 

I do not know what rules are automatically created but you can check the log to see what traffic is blocked from the remote IP. If blocked an allow all traffic for that specific zone / VPN ip range to see if it works with that could be a first step to see if the routing is allright. 

Ok, sorry for the long silence. Thanks for the hints, but they did not help.

I have setup the site-to-site vpns exactly as in 

https://support.sophos.com/support/s/article/KB-000035717?language=en_US

Three branchoffices, one headoffice.

Branchoffices can ping the headoffice and access all resources there.

But headoffice cannot access resources in the branches.

When I look at the IpSec connection details of both headoffice and branchoffice I see that there is no local gateway. 

Am at a loss.

WHen I check the firewall rules for the Ipsec, the inbound, and the outbound connections both on the branchoffice and the headoffice firewalls, I see only accepted packages

The log does not show blocked packages by default as logging needs to be enabled on a rule. The last block all default xg rule does not have logging enabled. Did you create your own last block all rule with logging enabled? Copy the default last block rule one before the last one and enable logging. You will see all block packages under this rule. 

yes, all the rules have logging enabled.

The headoffice records the packet as IN on the Lanport and as OUT on ipsec0 for source IP 192.168.1.x

THe log in the branchoffcei shows nothing for that source IP.

Can I force all VPN traffic to use only a specific WAN Link? 

Ok, very sorry, this was actually not a problem of the VPN.

I was always testing this from a server in the headoffice. However, that server has also a DNAT rule configured. So it only did not work form THAT server.

Of course, now I have another problem :-)

Thanks for all the help.