How to dual IPSec using SD-WAN?

[nikriaz]

I'm trying to connect two sites by two IPSec tunnels. Site A has 2 WANs and site B has single WAN.

My example is exactly the same as in this technical tip:
Technical Tip: Configure IPsec VPN with SD-WAN 

Document says:
Configure the Peer end Device, if it is not already done (the normal Route Priority has been used at the peer side for failover, it is also possible to configure SD-WAN on this side using the above example).

However, it does not work as expected if similarly create SD-WAN on another side because it creates circular dependency!  Whatever side selects best tunnel, it selects an active route for it. As result, another tunnel becomes unavailable for SLA on another side because SLA packets cannot return, and another SD-WAN disable this tunnel as well so first SD-WAN cannot measure SLA on this tunnel anymore. At this point, initially not selected tunnel quickly becomes blocked for ever. 

The obvious way how to solve this problem is to have SD-WAN only on one side, and have two static routes without SD-WAN on another side (as also suggested by document above). 

But how to achieve two-way SD-WAN load balancing? Can I mix static route for each tunnel and static route for SD-WAN so packets would be always able to return?

Like this:
Side A: 
Route through IPSec1 - distance 10
Route through IPSec2 - distance 10
Route through SD-WAN (IPSec1 + IPSec2) - distance 5

Side B:
Just normal SD-WAN + route as per document.

Or maybe another way is appropriate? 

[nikriaz]

Let's me share my findings:

- it is not possible to have static routes through SD-WAN zone and its individual members simultaneously, even with different metrics. As soon as VPN interfaces are added into SD-WAN zone, associated individual static routes are immediately removed, even yet without adding static route to SD-WAN zone.

- however, as soon as SD-WAN zone has a zone balancing (not 100% sure about all requirements) then when a single SD-WAN zone route is added, FGT adds TWO static routes to both SD-WAN individuals members, both with the same metric 1 what is essentially replicates manual setup, so SD-WAN on another side remains operational, no circular tunnel blocking.

[filiaks1]

What about policy routes ?

How to configure Policy-Based Routing in FortiGate Firewall