SD-WAN | IPSec tunnels

should be no problem as long as you have static wan ips everywhere. Then on the router you need to have a portforward for 500/UDP (IPSec) and 4500/UDP (NAT-T if you use it) to the FGT  behind the router so IPSec can reach it. Or set HQ to passive mode so it doesn't negotiate the ipsec and have the branch do that. In this case you don't need the port forwards.

On Branch create an sdwan zone to have it switch the tunnels.

Works fine here with static wan ips and s2s ipsec.

There however is issue when you don't have static wan ip somewhere or/and you cannot use s2s.

I am still trying to convice TAC that this is due to bugs in FortiOSes IPSec stack...

bascially these issues are:

• SDWAN and also the routing daemon seem not to be able to correctly detect the online status of a dialup ipsec resulting in not failing over when that goes down and not switch routes correctly (if you don't use sdwan). 
• if you set an ipsec (S2S aswell as dial up) to passive mode (or even diesabe p1 autonegotiation) and the remote gw is a random ip (so it hase to use ddns as remote gw on this side) then the ipsec stack does not update the ddns which leaves that ipsec with a no longer correct remote gw ip once the ip changes for the first time. So it will go down (due to dpd/keepalive) and not come up anymore until you restart ipsec stack or the fgt

I do have a TAC case open on these but still they haven't even acknowledged that being a bug.