application showing as incomplete + ipsec tunnel issue

[AY_FASAR]

Hi, 

I have an IPSec tunnel to a 3rd party, which we have some intermittent issues with.

at the time that 3rd party lose its connection to us, under monitor> traffic I can still see traffic flowing but with application showing as incomplete. as I understand, incomplete could mean that source start a 3-way handshake but doesn't get a syn ack back. also understand that this could happen for different reasons main one being lack of routing. so can this suggest that as my tunnel was down at that time and there was no route in routing table to the destination, hence I see the 'incomplete application' in the logs? or palo lto would drop the traffic straight if it didnt have any route in its routing table? 

Thanks