Can't ping RED device but devices behind RED

The RED Lan Interface(s) are simply the extension of your firewall. That means, you actually ping the firewall, not the RED. You cannot ping the WAN Interface of the RED, if you try to do that. 

ah, for some reason, I was under the impression that the red has an IP address. Since it's a layer 2 tunnel, this indead doesn't make sense.

I can ping my red tunnel addresses, but not the WAN port IP address. 

do you mean devices behind the red device by tunnel addresses?

I use server/client type RED, I assign an IP address to each side of the tunnel, I can ping those addresses but not the external interface WAN addresses.

Try   Administration>Device access> then check the box for PING on the VPN row under the local service acl section, hit apply and check if pings work after.