I'm trying to get a FortiGate setup in AWS and I have an outside subnet and an inside subnet setup on it. 

Example"

Public Subnet 10.20.14.0/24 Route to IGW for 0.0.0.0/0

FTG Port 1 Public Interface 10.20.14.100/24 

VDOM root

Private Subnet 10.20.16.0/24 Route to ENI of Private Interface (port 2 in FTG)

FTG Port 2 Private Interface 10.20.16.100/24

VDOM Aws-inside

VDOM LINK Root-AWSInside

VDOM LINK Interface 10.200.1.0/31 Port 1

VDOM LINK Interface 10.200.1.1/31 Port 2

Test Linux instance Private Subnet 10.20.16.200/24

There are all fw rules and routings in place to move traffic from Onprem to the VDOM LINK Interface of Port2

I was able to setup IPSEC between my on-prem to AWS but when i test ping the traffic from On-prem the packet got to Port 1 (10.20.14.100) and then dropped, never got across to the VDOM LINK IP 10.200.1.1

Do I need to add 10.200.x.x subnet in AWS VPC for this to work?  I'm lost.