Site-to-Site VPNs and VLANS

Are you using route based VPN or policy based VPN? What do you mean by "down"? 

They are IPSEC site-to-site VPNs.  The connection goes down and says it can't connect.  I've made sure that it's re-activated on both ends, but the remote office won't connect.

You only adding networks to the local subnet (on both sites)? 

Can you share a screenshot of your changes? 

Because if you have a mismatch between only subnets, your tunnel should be yellow. 

I changed the remote office the same way, except the other direction.  At that point the Site to Site for that location goes down and won't come back up.

Please confirm weather you have ipsec vpn between sophos to sophos firewall or other party firewall ?

Make sure you have access to both the firewalls

Make sure you add local and remote id at both the end this can be verified with logs.

Check logs as per the below link might help 

https://support.sophos.com/support/s/article/KB-000038566?language=en_US

Regards

No 3rd Party firewalls are involved.  Only Sophos firewalls.

I'm editing both firewalls, so why would I not have access to them?

If you have both the access you have to add local id remote id and vlan subnet on ipsec tunnel as well as you have to add on firewall rules to have communication 

In your case first you add local and remote id and new vlan on local and remote subnet on both the firewall to make it work 

exmaple 

At HO

local subnet                                     Remote subnet

Headoffice LAN                                 Branch office LAN

new VLAN subnet

At BO

local subnet                                 Remote subnet

Branch office LAN                      Head office LAN 

                                                      New VLAN subnet

Regards

That's exactly what I'm doing, and the tunnel goes down and will not re-connect.

Can you add the local ID for the IPsec Tunnel as well? 
You can also use external WAN IP for identification. 
Why are you using Wildcard for the remote gateway and not the IP? 

Can you add the local ID for the IPsec Tunnel as well? 
You can also use external WAN IP for identification. 
Why are you using Wildcard for the remote gateway and not the IP? 

The instructions that I had found at the time showed setting it up that way, and it's been working that way for over a year.

Try to re configure IPSec VPN tunnel with latest firmware version both the side might fix the issue

Unfortunately, the firewalls have not prompted for the latest firmware version through Sophos central yet. 

We don't do firmware updates during business hours so I have to wait till I can schedule them through Sophos Central after hours.

Would be nice if they brought back an option to schedule firmware updates on the firewalls themselves again the way you could on the UTM devices.