NAT device from site 2 to site 1's external IP over IPSEC VPN

I'm having trouble getting this working. I have a cloud firewall (PFSENSE) and a second site (Sophos XG) that's behind CGNAT that has a site to site VPN to the cloud firewall.

How do I get a host behind site 2 to be accessible via the external IP of the cloud firewall?