FG60E IPSECVPN StoS and Policy

You could just create a new policy with RDP configured it before the NOT_ALLOWED policy, the RDP might sending HTTP requests before the RDP connection.

Or create a policy with the source /destination subnets from FG1 Site and FGT2 site and allow all before the NOT_ALLOWED policy. This means all trafiic in your private networks is allowed between sites and other traffic to the internet.with be blocked by the URL filter in NOT_ALLOWED policy.

For further troubleshooting of Fortigate firewall policy connections problems here is a useful KB http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31702

It is a best practice to have your VPN policies towards the top. I also avoid using the "all" group. I recommend at a minimum, creating a group for your used address space. For public space, I use the group object RFC1918 and negate the source / destination field it resides in.

HTH

d