SSH to managed FortiSwitches from external network

I have disabled split interface in order to setup MLAG on two fortiswitches. I am using the default subnet 10.255.1.0/24 which I have made routable external via WAN1 (lab network so its actually all RRFC1918 space). I cannot seem to create a policy to allow inbound access to fortilink interface so I can SSH to the switches (only_default.fortilink).

How do I configure this so I can ssh from an external (non-fortilink) network?

Thanks,