FAILOVER WITH 2 INTERNET LINKS ON A SINGLE FIREWALL

So, you're NOT talking about "FortiGate HA", which requires at least two of the same FGT model. But talking about "fail-over" from 1) wan1 to wan2(web traffic), and 2) wan2 to wan1(site2site VPN). 

If you're not interested in learning FGT SD-WAN configuration/operation, for 1), you can set up another static default route with lower priority (high priority value) on wan2 if you haven't done it yet for the site2site VPN. Then run a link-monitor against wan1 to detect the failure then remove the current static default route (has to be static though).

For 2), it depends on the capability of the remote end but a basic way is to have two tunnels from both wan1 and wan2 to the remote end then set up static routes to the other end toward both tunnels but wan1 side has higher distance (lower priority). You have to do that on both ends of the tunnels. Then primary IPsec goes down (when the wan2 link goes down) the primary static routes should disappear and higher distance routes would take over. 
You can of course use routing protocol like BGP or OSPF for site2site route advertisement. But it requires the other side's support of the protocol you choose.

Toshi

Hello Toshi,

I dont see any option of my firewall for update routing table, please if you have some documentation for do this in sdwa i really appreccitte

tahnks