FortiGate uses route-based IPsec by default instead of policy-based IPsec, while the Sangfor NGFW only supports policy-based mode.
This means that during migration, the VPN configuration on the Sangfor NGFW must be manually recreated according to the original FortiGate configuration.

Check tunnel type / interface:
In the CLI, use the following commands:

show vpn ipsec phase1-interface

get vpn ipsec tunnel summary

If the tunnel is associated with a virtual interface (VTI / interface-based), it is route-based.
If there is no interface and traffic is matched only by policies, it is policy-based.

Typically, in the Phase 2 configuration, if there are src-subnet and dst-subnet parameters defining subnets, this indicates a policy-based IPsec configuration.
Therefore, the presence of subnet definitions in Phase 2 can be used to determine that the IPsec mode is policy-based.