Sophos XG in Azure IPSEC S2S Ping just one way (NAT problem?)

Hi folks,

I've a Sophos FW set up in azure with VPN S2S IPSEC to a on prem Sophos FW and ping is only working from on prem to Azure XG but not the other way around.

I can see packets incoming from the client (172.25.2.6) and then the XG in Azure is nating and rewrites the client address to the WAN interface IP (10.25.1.4) and the XG is forwarding the packets through the tunnel. Why's that? 

Thanks in advance!

Best regards!