nat hairpin does not work

[FWY001]

Hi everyone, I have a LAN user wants to connect to a LAN server from the public address that is in the same subnet as the fortigate external address. I have setup VIP and firewall policies but it does not seem to work, debug flow shows it was DNATed to the server's internal address but the traffic does not go through(my server does not receive any traffic), the final log of the pakcet was "allowed by policy" then followed with nothing. My topo and configs are as follow, any idea is appreciated.

config firewall vip
edit "vip"
set extip "10.1.1.2"
set mappedip "192.168.8.200"
set extintf "wan" # have tried with "any" but also not working
set portforward enable
set extport 443
set mappedport 443

config firewall policy
edit 1
set name "lan1-to-lan2"
set srcintf "lan1"
set dstintf "lan2"
set action accept
set srcaddr "all"
set dstaddr "vip"
set schedule "always"
set service "ALL"
edit 2
set name "wan-to-lan2"
set srcintf "wan"
set dstintf "lan2"
set action accept
set srcaddr "all"
set dstaddr "vip"
set schedule "always"
set service "ALL"
edit 3
set name "lan2-to-wan"
set srcintf "lan2"
set dstintf "wan"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable
edit 4
set name "lan1-to-wan"
set srcintf "lan1"
set dstintf "wan"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable

[Renante_Era]

The easiest solution is to add "Stop Policy Routing"

[FWY001 · Accepted solution]

OK I figured out what happened, configs are correct in fortigate, the problem is the image I posted earlier is not exactly true, there is an active route between SW1 and SW2, so when fortigate DNATed the packet received from client and sent it to the server, the server received the packet as if it was sent from the client, and it sent response directly to the client without passing it to fortigate, so the tcp connection is never established(that's why there is no access logs in the server, but tcpdump can see those packets). I added a static route in SW1, forcing it to send traffic to fortigate, problem resolved.