HA Configuration

It's not any tagging and must be a priority on each static default route. There should be two default routes to both WAN1 and WAN2 in your routing table to go out to the internet and get back to random remote sources. When WAN1 side has a higher priority (lower number, likely using the default 0) and WAN2 side has a lower one, like 10, both default routes would be on the table like below:

xxx-fg2 (xxxxxx1) # get router info routing-t all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        * - candidate default S*      0.0.0.0/0 [10/0] via 1.1.1.1, INTERFACE1                   [10/0] via 2.2.2.1, INTERFACE2, [10/0] As you can see above, the second default route has an additional [10/0] at the end. The '10' is the priority set on this static route like below:

config router static

    edit 2         set gateway 2.2.2.1         set priority 10         set device "INTERFACE2"     next end

FortiGate remembers the incoming access through WAN2 in the session table then routes returning and matching packets to the same interface as long as a route exists in the routing table toward the interface. But since the priority is low on the second interface, all new traffic/sessions initiated from inside would use the first interface.