policy vpn with vpn concentrator not passing traffic between spokes 7.0.5

I can get a dial up vpn going and the ipsec policy works fine but spoke to spoke traffic does not work when a concentrator is added.

Debug flow shows packets ingressing from spoke1 and egressing to spoke2. The problem is that return traffic from spoke 2 is never processed by the fortigate. The flows show absolutely nothing.

The reverse path is also the same. traffic from spoke 2 to spoke 1 are received at spoke 1 but the fortigate does not process the return traffic from spoke 1.

I tried this out on 6.2.10 and the flow showed the traffaic being dropped by policy 0.  After moving to a different firewall running 7.0 I now get good policy matches but no return traffic is processed.

Capturing packets on the underlay definetely shows return traffic making it to the fortigate.