For weeks I fought with Fortinet support over our site-to-site VPN not passing traffic, but today they finally found and corrected the problem with our config.
Our environment looks like this:
FG LAN (192.168.168.0/24) -->
FG WAN 10.1.10.2 -->
ISP router LAN 10.1.10.1 -->
IPS router WAN 1.2.3.4 -->
Azure VPN WAN 5.6.7.8 -->
Azure VPN LAN 10.0.0.0/24
If your environment is like ours, then perhaps what fixed our problem will fix yours, too.
I won't keep you in suspense any longer. The setting that fixed allowed traffic to reach our LAN was setting NAT Traversal to Forced:
The Fortinet rep explained that though their documentation which says to set NAT Traversal to Disable, various ISP handle this traffic in various ways, sometimes requiring setting NAT Traversal to Forced.
Hope this helps!