config vpn ssl settings
set http-request-header-timeout <1-60>
end
Timers can also help to mitigate DoS attacks with SSL VPN caused by partial HTTP requests.

DNS traffic can be allowed if user has not authenticated yet.
Hostname resolution is often required by the application layer protocol (HTTP/HTTPS/FTP/Telnet) that is used to authenticate.
DNS service must be explicity listed as a service in the policy.

Check the IP address
The remote subnet selectors don't match. Set BR1-FGT's Remote Address to
10.0.11.0/255.255.255.0 (C).
The phase-2 proposal algorithms don't match. Change HQ-NGFW Encryption from AES128 to AES256 to match BR1-FGT (D).

The SSL inspection mode in the firewall policy is set to certificate-inspection, which only examines SSL certificates without decrypting HTTPS traffic. Because of this, FortiGate cannot inspect or block files downloaded over HTTPS, as the content remains encrypted. To enable antivirus scanning on HTTPS traffic, the SSL inspection mode must be set to deep-inspection, allowing the FortiGate to decrypt, inspect, and re-encrypt the traffic.

The browser presents a certificate warning when you attempt to access an HTTPS site that uses an untrusted certificate. Untrusted certificates include self-signed SSL certificates, unless the certificate is imported into the browser-trusted certificate store. FortiGate has its own configuration setting on the SSL/SSH Inspection profile, which includes options to Allow, Block, or Ignoreuntrusted SSL certificates.