Thanks again Afroman for your followup on this.
If I ping from the Forticlient PC in, I see what I assume are normal ping traffic entries (though note I actually see request timed out on the Forticlient PC and don't get a ping reply)
8.879626 ssl.root in 10.212.134.20 -> 10.1.1.1: icmp: echo request
8.880055 lan out 10.1.1.254 -> 10.1.1.1: icmp: echo request
8.880431 lan in 10.1.1.1 -> 10.1.1.254: icmp: echo reply
8.880528 ssl.root out 10.1.1.1 -> 10.212.134.20: icmp: echo reply
If I try to ping from the 10.1.1.1 device, I only see the following, with no other types of entries:
159.208613 lan in 10.1.1.1 -> 10.212.134.20: icmp: echo request
There is a static route which references the SSL VPN client IP range which points to the ssl.root interface. There is also the standard/automatically added policy for ssl.root to LAN. I tried adding an additional policy back from LAN to ssl.root but it doesn't seem to have made any difference.
It does appear to be all traffic, as I can't telnet to a few open ports on the 10.1.1.1 device either (ie, it's not just ICMP)
If I run the debug flow, then ping from 10.1.1.1 to the SSL VPN client IP, I get the following:
# id=20085 trace_id=3 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.1.1.1:1->10.212.134.20:8) from lan. code=8, type=0, id=1, seq=18921."
id=20085 trace_id=3 func=init_ip_session_common line=4629 msg="allocate a new session-000325fa"
id=20085 trace_id=3 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-10.212.134.20 via ssl.root"
id=20085 trace_id=3 func=fw_forward_handler line=675 msg="Allowed by Policy-4: SNAT"
id=20085 trace_id=3 func=__ip_session_run_tuple line=2606 msg="SNAT 10.1.1.1->23.24.145.45:62464"
Pinging from the VPN client PC to 10.1.1.1 yields:
id=20085 trace_id=4 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.212.134.20:1->10.1.1.1:8) from ssl.root. code=8, type=0, id=1, seq=34."
id=20085 trace_id=4 func=init_ip_session_common line=4629 msg="allocate a new session-0003262f"
id=20085 trace_id=4 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-10.1.1.1 via lan"
id=20085 trace_id=4 func=fw_forward_handler line=675 msg="Allowed by Policy-3:"
id=20085 trace_id=5 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.1.1.1:1->10.212.134.20:0) from lan. code=0, type=0, id=1, seq=34."
id=20085 trace_id=5 func=resolve_ip_tuple_fast line=4539 msg="Find an existing session, id-0003262f, reply direction"
id=20085 trace_id=5 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-10.212.134.20 via ssl.root"
