Site A-B (tunnel interace route based IPSec) Site B-C (policy based IPSec) configure A to C

Hi apijnappels Thank you for reaching out to the Sophos community team. Here on Site B policy-based IPSec tunnel is there with SiteC and if this tunnel is not containing the local LAN network of siteA inside the tunnel network setting then the traffic of siteA LAN for siteC destination will not go over VPN.

In that case, you may update SiteB tunnel to contain SiteA LAN in the local network and vice versa siteC location to add SiteA LAN in their remote LAN in the respective vendor firewall.

Another way, you may try is adding a manual IPsec route on SiteB for SiteC network destination, so SiteB XG will forward that destination traffic over VPN only (Whether it comes from Site A or Site B itself).

Console command to add IPsec Route manually:

Run the command below to add an IPsec route to the host destination.

console> system ipsec_route add host <IP Address of host> tunnelname <tunnel>

Currently, I am suspecting as your SiteA traffic on SiteB is not going over VPN for the SiteC network destination, and due to that your configured NAT rule is not coming into the picture. 

Thank you Vishal_R adding the ipsec_route (to the network of site C so system ipsec_route add net (instead of add host) did the trick.

For others seeking the same solution this is what I did:

1) Create a static route in site A for the subnet of site C to go to the tunnelinterface to site B
2) In Site B create a NAT rule for Traffic from Net A going to Net C change source to IP-address inside Net B
3) Add firewall rule in site B to allow the traffic from site A to site C
4) Add the ipsec_route through the console at site B (system ipsec_route add net a.b.c.d/e.f.g.h tunnelname <tunnelname>) as shown above by Vishal_R.

Thank you Vishal_R adding the ipsec_route (to the network of site C so system ipsec_route add net (instead of add host) did the trick.

For others seeking the same solution this is what I did:

1) Create a static route in site A for the subnet of site C to go to the tunnelinterface to site B
2) In Site B create a NAT rule for Traffic from Net A going to Net C change source to IP-address inside Net B
3) Add firewall rule in site B to allow the traffic from site A to site C
4) Add the ipsec_route through the console at site B (system ipsec_route add net a.b.c.d/e.f.g.h tunnelname <tunnelname>) as shown above by Vishal_R.