Remote Access IPSec VPN to sub-VDOM

I'm playing with another VDOM setup.  This time the Root vdom will hold the primary traffic while a sub vdom will only have an inbound IPSec VPN connection for remote clients to connect too via forticlient.  I've got the root vdom setup and it's passing traffic correctly. The VPN terminates at VDOM-A.

Here is a network map

I've got a VIP at the root vdom that's passing traffic through to the 10.2.2.2 IP.  I've got the firewall rule at root that's allowing traffic inbound to the VIP.  In VDOM-A, I've got VPN configured with the 10.2.2.2 interface (the intervdom link) so it should be all setup correctly.  The "external" (this is all in a lab, no actual real IPs involved) IP for the IPSec VPN is 40.40.40.35.  When I try to connect from a VPN client, the connection just times out and won't connect.

If I run a "diagnose sniffer packet any 'host 40.40.40.35'" and run a ping 40.40.40.35 from the VPN client, I see traffic.  However, when I actually try to connect with FortiClient I don't see ANY traffic.  On the client side I can see the traffic going out, but on the Root or VDOM-A side, I see no traffic at all and I'm lost as to what I've got wrong.

So this is a fortinet on the client side

You can see the ping go out.  Then you can see the IPSec connection attempt.
However, on the vdom a side

You can see the ping traffic, but then nothing at all.  It makes no difference if I run the diag at the root or VDOM-A context.  I can see the ICMP traffic sent by the client to 40.40.40.35.  I can even see port 80 traffic if the client tries to browse to 40.40.40.35.  When the client tries the VPN connection though, I don't see any traffic.