FG60D - secondary Port Forwarding same port, different target

Hello,

we use FG60D, and have 2 public IP address,  second was added a few days ago...

I have everything running OK, but need a AD sync through port 443 from MS Cloud (Office 365) to my DC server.

As I have Active Sync enabled on port 443 to my Exchange server, I can't add new Virtual IP with same source (wan1) and same port (443/tcp)..

so our Internet provider gave us second pubic IP address, connected to wan2 (has different IP network interface), and I created secondary Virtual IP with port forwarding 443 from wan2 to my DC server.

added new policy, allowing all traffic, all the time from wan2 to VirtualIP...

but I cant reach my server from outside (Internet provider tech can ping wan2 interface), it should gave me default IIS 8.0 site

when i enter second.public.address:443

what can be done?