HI David,
Finally (after 2 years) got around to testing this out properly)
Seems that by forcing the fortigate to tag all traffic in and out on the IPSEC and out on the WAN interface as DSCP 00 makes the phone work without having to use the TG797.
i expect i'll have to get creative with a DMZ and modfiy the ruleset to get both phones working, but at least this will do for now. Maybe another 2 years and i'll get around to fixing that.
Cheers