Weirdly enough I just answered a similar question here: https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1
I will answer similarly: what you're doing is VPN concentration. There are various vendor-specific ways to do this, some very straightforward, some extremely esoteric, but my recommendation is to avoid ALL that and configure your network from a layer 3 level, with IPsec doing lower level connection glue.
Specifically in your case, you'd create IPsec links between the branch office and the main office but instead of specifying each office's subnets directly in the IPsec config, you'd create /30 point-to-point links between them, then use GRE on top of that to either statically point subnets to each link, or (far better) use OSPF to redistribute your routes.
Point to point links with routing logic is far more scalable versus a bunch of static routes with directly connected subnets. In the latter (which you're currently using) you have to constantly reconfigure IPsec to be aware of what can route where, even when you're adding one subnet. As you add more than one subnet, the complexity grows exponentially and quickly becomes untenable. Add in firewall / security policies and security planes at various points and you've quickly got a huge glut of configuration on your hands.
Point to point links will completely remove the complexity, because routing now lies in the typical routing spots: static tables, or dynamic routing protocols like OSPF and BGP. If you leverage OSPF and BGP you will never have to add routes throughout your network; you simply add a subnet and the route will propagate automatically throughout all the offices. Also your security will be straightforward, as you can now place security planes in logical places, rather than working out where they sort of fit in IPsec-land.
This will most likely require a weekend overhaul of your remote office configurations to the main office. However once this is in place, future changes and adjustments will be extremely straightforward; in your current config, any change will require a number of manual ripple changes throughout the network, and the complexity will introduce errors.