IPSec talks one way

[nn]

I have an IPSec setup on two Fortigates both are 80C. Both are code level version 4 build 0689

192.168.0.1 <-----> 192.168.121.1

192.168.121.1 can ping 192.168.0.1

192.168.0.1 cannot ping 192.168.121.1

192.168.0.1 has a spillover setup on it. It is the one having the issue talking. When I do a debug I see the traffic trying to go out of the spillover public IP from that ISP.

2016-03-31 16:27:28 id=36871 trace_id=1 func=resolve_ip_tuple_fast line=3799 msg="vd-root received a packet(proto=1, 76.79.12.62:512->192.168.121.1:8) from local." 2016-03-31 16:27:28 id=36871 trace_id=1 func=resolve_ip_tuple line=3939 msg="allocate a new session-00002334" 2016-03-31 16:27:28 id=36871 trace_id=1 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-IPSec_to_TR" 2016-03-31 16:27:28 id=36871 trace_id=1 func=esp_output4 line=519 msg="encrypted, and send to 8.34.101.106 with source 8.34.98.16" 2016-03-31 16:27:28 id=36871 trace_id=1 func=ipsec_output_finish line=210 msg="send to 8.34.98.1 via intf-ppp1" 2016-03-31 16:27:29 id=36871 trace_id=2 func=resolve_ip_tuple_fast line=3799 msg="vd-root received a packet(proto=1, 76.79.12.62:512->192.168.121.1:8) from local." 2016-03-31 16:27:29 id=36871 trace_id=2 func=resolve_ip_tuple_fast line=3839 msg="Find an existing session, id-00002334, original direction" 2016-03-31 16:27:29 id=36871 trace_id=2 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-IPSec_to_TR" 2016-03-31 16:27:29 id=36871 trace_id=2 func=esp_output4 line=519 msg="encrypted, and send to 8.34.101.106 with source 8.34.98.16" 2016-03-31 16:27:29 id=36871 trace_id=2 func=ipsec_output_finish line=210 msg="send to 8.34.98.1 via intf-ppp1" 2016-03-31 16:27:30 id=36871 trace_id=3 func=resolve_ip_tuple_fast line=3799 msg="vd-root received a packet(proto=1, 76.79.12.62:512->192.168.121.1:8) from local." 2016-03-31 16:27:30 id=36871 trace_id=3 func=resolve_ip_tuple_fast line=3839 msg="Find an existing session, id-00002334, original direction" 2016-03-31 16:27:30 id=36871 trace_id=3 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-IPSec_to_TR" 2016-03-31 16:27:30 id=36871 trace_id=3 func=esp_output4 line=519 msg="encrypted, and send to 8.34.101.106 with source 8.34.98.16" 2016-03-31 16:27:30 id=36871 trace_id=3 func=ipsec_output_finish line=210 msg="send to 8.34.98.1 via intf-ppp1"

Any Ideas on why it would be from ISP IP to Internal IP? The other direction works fine.

2016-03-31 16:41:15 id=36871 trace_id=1 func=resolve_ip_tuple_fast line=3799 msg="vd-root received a packet(proto=1, 192.168.121.1:1792->192.168.0.1:8) from local." 2016-03-31 16:41:15 id=36871 trace_id=1 func=resolve_ip_tuple line=3939 msg="allocate a new session-00001739" 2016-03-31 16:41:15 id=36871 trace_id=1 func=ipsecdev_hard_start_xmit line=121 msg="enter IPsec interface-IPSec_to_48" 2016-03-31 16:41:15 id=36871 trace_id=1 func=esp_output4 line=519 msg="encrypted, and send to 8.34.98.16 with source 8.34.101.106" 2016-03-31 16:41:15 id=36871 trace_id=1 func=ipsec_output_finish line=210 msg="send to 8.34.101.1 via intf-ppp1"