Downloads from HQ stall over the VPN after a firewall change

Since Tuesday, branch users say the HQ file server and intranet on SRV1 are "half working". Logins and small pages load, but file downloads stall at 0 percent and some pages never finish. Uploads from the branch to HQ work. The VPN is a VTI between R1 and R2 with ip mtu 1400 on both Tunnel0 interfaces and no other tuning. It has not changed in months. On Tuesday the security team pushed a rule base cleanup to FW1, which sits between SRV1 and R1.