I don't think it's possible to route internal accesses over a WAF on another interface. If you want to use WAF for traffic from internal clients, you will need to define another Virtual Server on the Internal interface.
Cheers - Bob
Sophos UTM Community Moderator Sophos Certified Architect - UTM Sophos Certified Engineer - XG Gold Solution Partner since 2005