anchor.diff:  
   In my instance I added a DENY policy which did the trick nicely. (Confirmed this was ok with Fortinet TAC)
   
  -----
  +[source,numbered]
   config firewall policy
   edit <policyID>
   set name "Block_Shoretel_WAN"
  
positive.code: set logtraffic all
  next
  end
  ----
  
  ##### The Root of the Issue
  
  
negative.code: 
  To figure out if you are affected by the same issue, run the following commands on each end of your IPSEC tunnel.
  
  [source,numbered]
  >diag sys session filter dst <your phone or switch IP>
  >diag sys session list
  session info: proto=17 proto_state=00 duration=59663 expire=109 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
  origin-shaper=
  reply-shaper=
  