The default gateway is configured on port2 → The debug output shows find a route:
flag=00000000 gw-0.0.0.0 via port2, which indicates that the default route (0.0.0.0/0) points out port2.
The matching firewall policy denies the traffic → The log line Denied by forward policy check (policy 2) confirms that policy 2 matched and explicitly dropped the traffic.

The HA configuration shows that override is disabled (set override disable), but despite this, HQ- NGFW-1 has the higher priority (200) and is acting as the primary, as indicated by its higher resource usage and uptime. Override allows the device with higher priority to take over as primary, so HQ- NGFW-1 is the primary device.

When FortiGate operates in profile-based NGFW mode, it supports both flow-based and proxy- based inspection for security profiles. However, application profiles (such as Application Control, Web Filter, and Antivirus) are inspected using proxy-based inspection by default in profile-based mode, as this mode allows FortiGate to fully analyze and enforce policies on the application content layer.

Enabling Include in every user group in the RADIUS configuration means the RADIUS server is automatically added to all FortiGate user groups. As a result, any user who can authenticate successfully against that RADIUS server becomes a member of every FortiGate user group, without needing to be manually assigned. This can inadvertently grant excessive access if not carefully controlled.

In a Fortinet Security Fabric setup, the root FortiGate (Local-FortiGate) synchronizes configuration objects, such as address objects, downstream to subordinate FortiGates.
For this synchronization to work, the downstream FortiGate (ISFW) must have the downstream- access option enabled in its CSF (Cooperative Security Fabric) settings.
In the exhibit:
The Local-FortiGate has downstream-access disable, meaning it cannot push configuration

changes downstream.
The ISFW also has downstream-access disable, preventing it from accepting synced objects.

To fix this, downstream-access must be enabled on both FortiGates to allow configuration synchronization.