Route all traffic through FortiClient VPN tunnel to Fortigate at HQ

I would like to route all traffic through FortiClient VPN tunnel to FortiGate at HQ so that it gets filtered as if it was coming from inside HQ.  However, when creating firewall policy, I cannot select "SSL-VPN tunnel interface (ssl.root)" as Incoming Interface and "virtual-wan-link" for Outgoing Interface at the same time.  Any idea how to achieve this?  I am running FortiGate 601E with v.6.4.1 firmware.