Please help - ASG to ASG using RED

Hi

Apologies if I miss something but I'm v. tired. In a remote branch office trying to hit a deadline.

Got a new ASG 110 here at branch office that I'm trying to configure as a RED. Got a software ASG at head office. Got a real RED that I carry with me.

Branch office is on the web fine. Internal range 10.10.9.0/24
Head office is on web fine. Internal range 10.10.8.0/16
RED works perfectly.
VPN to HO works perfectly.

New ASG connected to HO as RED. Shows green at both ends.
New ASG has one firewall rule - INTERNAL -> ANY (ALLOW)
HO ASG has several, incl BRANCH OFF (10.10.9.0/24) -> ANY (ALLOW)

Still when I go on Branch ASG and run ping tool to known good address in HO, I get 100% loss.

Please help. I'm shattered and can't see it at all. Any information (bar passwords) on request.