Description
In general, self-originated traffic does not need firewall policy to leave FortiGate, the only exception is when the traffic needs to go inside IPsec tunnel (policy-based). In this case, after route lookup, if an IPsec policy is matched then packet is sent through the tunnel.
The policy lookup is done only based on destination ("dstint" + "dstaddr" + "service"). If no IPsec policy has been found then the packet is sent unencrypted.
A common mistake is to create IPsec policy with "dstaddr=ALL" and "service=ANY", this will force all self-generated traffic to be sent through the tunnel.
Scope
If it is not required to send self-originated traffic inside the tunnel, then try to exclude the destination address and service from the IPsec firewall policy, so the IPsec policy will not be matched and self-originated traffic will be sent unencrypted.
