What action does an IPsec Gateway take with the user traffic routed to an IPsec VPN when it does not match any phase 2 quick mode selector?

Phase 2 selectors define the specific subnets and ports that are permitted to traverse the IPsec tunnel; if traffic does not match these selectors, the FortiGate cannot establish a Security Association (SA) for it and therefore drops the non-matching traffic for security reasons.

There is no concept of a 'default phase 2' that would catch all unmatching traffic; each Phase 2 must have explicit selectors.

Once traffic is directed to an IPsec VPN, the routing decision is to use the tunnel; if the traffic doesn't match Phase 2 selectors, it's a security policy failure, not a routing table lookup for an alternative path.

Routing traffic unencrypted when it was intended for an IPsec VPN would be a severe security breach and is not a default behavior; the FortiGate will enforce the policy to either encrypt or drop.