VXLAN over IPSEC with virtual wire pair port problem!!

[maskboy]

Hi Everybody, 

I want to try extend our DC network to L2 with vxlan to spoke site. I am trying to solution below guide. 

https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/821119/vxlan-over-ipsec-tunn...

But we are extend more vlan to spoke site. So, all vlan gateway terminated HUB Firewall L3 LAN Port. L2 extend work fine. But when I try to ping one vlan to another vlan from spoke site (vlan 10) to hub site (vlan 20) first ping was success but after that all ping get timout. Packet forward spoke to hub that way, Vlan 10 PC->Spoke switch->SpokeFirewall L2 port-> vxlan over ıpsec->Hub Firewall L2 Port-> Hub Switch -> Hub Firewall L3 port -> Hub Switch-> Vlan 20 PC.  Reverse traffic work fine. (From Hub vlan 20 PC to Spoke vlan 10 PC)

I have attached the simple topology for this issue. I wrote virtual wire firewall policy to pass traffic. What is possible issue for this problem? 

Regards,

[maskboy]

any idea?