Yes, sure. Interface-based and policy-based is only about the internal implementation on the FGT. Where policy-based was historically the first form, later replaced by the interface paradigm. External VPN partners will not notice anything about this.
Just remember: interface-based VPN needs 3 steps at different places in the config
1. VPN definition, as phase1 and phase2
2. a policy from source IF to tunnel IF with action=ACCEPT
3. a route to the remote subnet pointing to the tunnel IF
In a way, routing was determined by the destination address field in policy-based VPN. You'll see that the 'new' (now standard) approach is way more flexible, easier to configure and thus less error-prone.
What I wanted to say is that the setup is doable and relatively simple.
First, routing. The client has to have a route to the second network, or traffic will not go across the SSLVPN to reach the FGT.
On the FGT, you will need a route to the network behind the SSLVPN (i.e. your clients) pointing to the 'ssl.root' interface, and a route to the network behind the IPsec tunnel. Imagine visiting each hop on the way from the client to the IPsec network and back: client - FGT - tunnel - IPsec network. At each hop a route to the next hop and back to the previous hop is needed. Sometimes a static explicit route, sometime a default route (to make life easier).
Second, if all participants know how and where to send the traffic, then you additionally need a policy to allow it. After all, the FGT is a firewall, a control device. For writing the policy, you need address objects of the source and destination networks, the services you allow, some UTM...
In short, both the SSLVPN and the IPsec VPN are represented as virtual ports on the FGT. You route and allow traffic between these ports just like between any pair of physical ports.
As it is a tunnel mode IPSec and not an Interface mode, i can not point to the IPSec tunnel interface.
set srcintf "Lens"
set dstintf "wan1"
set srcaddr "Lens_Subnet" (192.168.7.0/24)
set dstaddr "Cloud_Systemat" (10.133.3.0/24)
set action ipsec
set schedule "always"
set service "ALL"
set natip 172.31.19.0 255.255.255.0
set comments "natted to 172.31.19.0/24"
set inbound enable
set outbound enable
set natoutbound enable
set vpntunnel "Lens_To_Cloud"
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.