IKEv2 pass though not working

Hey,

I need some help getting my always on VPN working through our Fortigate.  It's just not working.  I have a Virtual IP mapping a public ip address to the internal address of a Windows RRAS server running the VPN.  I also have a firewall policy allowing IKE, which is UDP/500 and UDP/4500 - the ports that the VPN client uses for IKEv2 certificate authentication.

The VPN works when clients behind the firewall connect but when passing though it's failing.

I've logged a ticket with Fortigate support but I havent spoken with them yet.

Is there some documentation on allowing IKEv2 through the Fortigate to a VPN server behind it?  I've looked but cannot find anything

Thanks :)