Site-to-Site VPNs and VLANS

Are you using route based VPN or policy based VPN? What do you mean by "down"? 

They are IPSEC site-to-site VPNs.  The connection goes down and says it can't connect.  I've made sure that it's re-activated on both ends, but the remote office won't connect.

I'm editing both firewalls, so why would I not have access to them?

If you have both the access you have to add local id remote id and vlan subnet on ipsec tunnel as well as you have to add on firewall rules to have communication 

In your case first you add local and remote id and new vlan on local and remote subnet on both the firewall to make it work 

exmaple 

At HO

local subnet                                     Remote subnet

Headoffice LAN                                 Branch office LAN

new VLAN subnet

At BO

local subnet                                 Remote subnet

Branch office LAN                      Head office LAN 

                                                      New VLAN subnet

Regards

That's exactly what I'm doing, and the tunnel goes down and will not re-connect.

Can you add the local ID for the IPsec Tunnel as well? 
You can also use external WAN IP for identification. 
Why are you using Wildcard for the remote gateway and not the IP? 

The instructions that I had found at the time showed setting it up that way, and it's been working that way for over a year.

Try to re configure IPSec VPN tunnel with latest firmware version both the side might fix the issue

Check the vpn-log on both firewalls. It's likely that some useful information is logged in one or even both firewalls logs.

Unfortunately, the firewalls have not prompted for the latest firmware version through Sophos central yet. 

We don't do firmware updates during business hours so I have to wait till I can schedule them through Sophos Central after hours.

Would be nice if they brought back an option to schedule firmware updates on the firewalls themselves again the way you could on the UTM devices.

I tried it again, and now the VPN comes up fine with the new subnet added.

Not sure why it would not work before.

As per the first screenshot new vlan was not added maybe without re establishing ipsec vpn tunnel back.

As per the first screenshot new vlan was not added maybe without re establishing ipsec vpn tunnel back.

Nope, I did it exactly as before (just like your example) and it worked this time.