IPsec Site to Site VPN - Ping one way, but not other

Question

Hi, 
 I have two XG210s, both identical in terms of firmware. 
 Tunnel is up and running fine, both ends report link up. 
 Site A firewall and client PC can ping Site B firewall and client. To make the client respond to pings, there is a VPN to LAN policy. TraceRt completes fine. 
 Site B firewall and client cannot ping Site A firewall or client (same policy VPN to LAN policy as above) TraceRt only goes 1 hop to the Site B firewall. 
 I am sure it is something simple I am missing, but I just cant figure it out why with identical setups, I can only ping one way. 
 Thanks.

RichardPhillips · Accepted Answer

Problem solved. It was a ip addressing issue. Couldn't see the wood for the trees. :-( 
 
 THanks for the input.

lferrara · Answer

Richard, 
 did you create the Polciy rule on both sides? Also on branch office you should create this rule (method 2) from: 
 https://community.sophos.com/kb/en-US/123334 
 
 you can add network instead single ip (use TAB when you are inside the cli). 
 
 Luk