Site-to-site VPN is up but traffic only flows one way

The branch router R2 was replaced last night. The engineer loaded the standard branch internet template (PAT on Gi0/0/0) and then pasted the old crypto configuration. This morning both routers show the VPN to HQ as up. HQ monitoring cannot ping the branch printers, and branch users cannot open the HQ intranet on SRV1 (10.1.0.10). Internet browsing at the branch works. It is an IKEv1 crypto map VPN between 10.1.0.0/24 and 10.2.0.0/24.