return traffic being dropped, not being sent through the vpn tunnel

S.Dollerup — Fri, 17 Apr 2026 13:18:54 GMT

issue:

1 server behind PA being accessed through 2 different tunnels

tunnel 1 = working

tunnel 2 = incoming traffic working, the return traffic is being grabbed by interzone-default = deny, and on the PA seen as a new session being initiated, for which there is ofc no security rule in place to allow

anyone with an idea why the return traffic on tunnel 2 isnt being matched correctly on the PA and sent back through the correct tunnel?

Re: return traffic being dropped, not being sent through the vpn tunnel

TomYoung — Sat, 18 Apr 2026 01:03:24 GMT

Hi @S.Dollerup ,

Does the 6-tuple key of the return traffic match the initial traffic? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVECA0

The security-zone is the destination zone of the initial traffic.

Thanks,

Tom

topic return traffic being dropped, not being sent through the vpn tunnel in General Topics

return traffic being dropped, not being sent through the vpn tunnel

Re: return traffic being dropped, not being sent through the vpn tunnel