VPN's on Fortigate dropping and not coming back up when making configuration changes

Hi r/fortinet,

Hopefully someone can help... we have an issue where configuration changes on a pair of Fortigate 1500D's are dropping VPN tunnels across all VDOM's and some not coming back up. It appears the VPN's going down after config change is "normal" behaviour, as I have tested on other Fortigates and they do the same (see IKE debug output below), however on this firewall they do not come back up even with interesting traffic or auto-negotiate turned on.

2017-07-19 19:25:14 ike config update start
2017-07-19 19:25:15 ike config update done
2017-07-19 19:25:15 ike 13: cache rebuild done
2017-07-19 19:25:33 ike 13:VPN1:VPN1-1: HA del IPsec SA e152d1c3
2017-07-19 19:25:33 ike 13:VPN1: deleting IPsec SA with SPI e152d1c3
2017-07-19 19:25:33 ike 13:VPN1:VPN1-1: deleted IPsec SA with SPI e152d1c3, SA count: 0
2017-07-19 19:25:33 ike 13:VPN1: HA del IKE SA dee5a3cc62851579/c3e73658461d1f2f
2017-07-19 19:25:33 ike 13:VPN1: deleting
2017-07-19 19:25:33 ike 13:VPN1: flushing
2017-07-19 19:25:33 ike 13:VPN1: flushed
2017-07-19 19:25:33 ike 13:VPN1: deleted
2017-07-19 19:25:33 ike 13:VPN1: set oper down

We have a pair of Fortigate 1500D's in active/passive HA, running many VDOM's, with virtual clusters enabled - one vcluster active on each unit with VDOM's split between them. Running FortiOS v5.2.11, recently upgraded from v5.2.7 with an intermediate upgrade through v5.2.9 to follow the recommended path. Manually resetting the tunnels through the GUI gets them working again. We were also seeing issues with v5.2.7 where VPN tunnels would not come up at all unless we went in to the VPN monitor GUI, right click and manually bring up. It seems to be a very similar issue, but now only after a configuration change drops the tunnels. It also seems to be limited to vcluster2 which is active on the "passive" unit, when the Fortigate is IKE responder.

We see no response from the Fortigate on the remote device which is IKE initiator, and the Fortigate does not try to initiate the VPN either.

Has anyone seen an issue like this before? I have a case open with TAC but making slow progress unfortunately.

My next steps if I don't get anywhere soon are disable IPsec hardware offloading and move vcluster2 to the "active" Fortigate.

Thanks in advance