@Andy_Sch Hi

10.10.40.0/24 is your opensense Firewall network? And "Omada" is the tplink router connected to the opensense Firewall?

If so, tplink router's VPN won't let you access 10.10.40.0/24. Tplink router can only create VPN tunnel between two tplink router's LAN networks. From what I understanding, 10.10.40.0/24 is on tplink router's WAN side

  @Somnus 

Hi thank you for your answer. 

No ! 10.10.40.0/24 and the other private Networks are on den LAN Side! 

The Router is parallel connected to the WAN IF of the Firewall in a /29 Public IP Network.

The LAN Port of the RTR  is connected via an internal Transfer Network to the firewall to connect to the Internal Networks. 

After a long time of testing and experimenting, I have come to the conclusion that I will do without the central ER7206, as the limited functionality is too great. 

I have now chosen my setup so that the ER605s in the offices terminate on the central opensense firewall via IPSec ikev2. This way I can also map the pseudo star topology for the VPN. Currently I am still stuck on the point that with IP Sec on a TP Link router in a VPN policy a maximum of 5 remote subnets are possible. But through clever subnetting, I will also be able to circumvent this issue.

I also got an answer from support about my issue after 5 days: 

"If we understand correctly, you have multiple ER605s each creating a VPN with ER7206 and want the ER605s to be able to communicate with each other, in a pseudo star topology.

This is not possible with the Omada routers, in order to create a connection between each ER605 you need to create a VPN tunnel between each of them.

Thank you for your support and confidence in our product. "

I found the answer a little poor. When I asked about it, I have not yet received an answer.

I am also surprised that dynamic routing is missing on the routers. 

I was actually on the verge of throwing TP-Link out again. However, I am convinced of the controller and the simplicity for my colleagues. 
The only way now is to take the complexity out of the network again and build everything according to the motto Keep it Simple and hope that it doesn't become insecure.

I hope that I will get further with this path.

BR 

Andy