Site-to-Site VPNs and VLANS

Are you using route based VPN or policy based VPN? What do you mean by "down"? 

They are IPSEC site-to-site VPNs.  The connection goes down and says it can't connect.  I've made sure that it's re-activated on both ends, but the remote office won't connect.

You only adding networks to the local subnet (on both sites)? 

Can you share a screenshot of your changes? 

Because if you have a mismatch between only subnets, your tunnel should be yellow. 

I changed the remote office the same way, except the other direction.  At that point the Site to Site for that location goes down and won't come back up.

Please confirm weather you have ipsec vpn between sophos to sophos firewall or other party firewall ?

Make sure you have access to both the firewalls

Make sure you add local and remote id at both the end this can be verified with logs.

Check logs as per the below link might help 

https://support.sophos.com/support/s/article/KB-000038566?language=en_US

Regards

No 3rd Party firewalls are involved.  Only Sophos firewalls.

I'm editing both firewalls, so why would I not have access to them?

I'm editing both firewalls, so why would I not have access to them?

If you have both the access you have to add local id remote id and vlan subnet on ipsec tunnel as well as you have to add on firewall rules to have communication 

In your case first you add local and remote id and new vlan on local and remote subnet on both the firewall to make it work 

exmaple 

At HO

local subnet                                     Remote subnet

Headoffice LAN                                 Branch office LAN

new VLAN subnet

At BO

local subnet                                 Remote subnet

Branch office LAN                      Head office LAN 

                                                      New VLAN subnet

Regards

That's exactly what I'm doing, and the tunnel goes down and will not re-connect.

Check the vpn-log on both firewalls. It's likely that some useful information is logged in one or even both firewalls logs.

I tried it again, and now the VPN comes up fine with the new subnet added.

Not sure why it would not work before.

As per the first screenshot new vlan was not added maybe without re establishing ipsec vpn tunnel back.

Nope, I did it exactly as before (just like your example) and it worked this time.