IPSec VPN - Branch1 to Branch2 connectivity via HQ

Hello All,

I have 2 branch offices and one HQ office.  I would like branch 1 to be able to communicate with branch 2 VIA the Sophos XGS appliance in the HQ.  Can any body give me any pointers for the best way to achieve this.

I know I could connect branch 1 and 2 together via their own IPSec tunnel, however the client wants all inter-branch all traffic to pass via the HQ.

HQ LAN 192.168.0.0/24
Branch 1 LAN 192.168.1.0/24
Branch 2 LAN 192.168.2.0/24

Thanks!