Our external users are connecting through SSL-VPN. But they need to reach resources behind another FortiGate.
This is a fairly common scenario, and is not too complicated. Essentially, you need a site-to-site VPN to connect your FortiGate to the other resource (assuming the other resource is being another FortiGate for ease of explanation). Then you need to user facing SSL-VPN portal for accessing the networks behind the FortiGate.
In other words:
User <--- SSL-VPN ---> FortiGate <--- IPsec VPN ---> FortiGate <--> internal resources.
Check out this document for more info how it is configured:
https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/45836/ssl-vpn-to-ipsec-vpn
