Cannot ping server but monitor sees the ping traffic as allow

[jac101]

My Palo Alto PA200 e1/1 (10.10.10.1/30) is connected to router A and e1/2 (10.10.20.2/30) is connected to router B.

The server 192.168.1.100/24 is behind router A (10.10.10.2) which has a static router to destination 172.16.1.0/24 with next hop 10.10.10.1.

The user 172.16.1.100/24 is behind router B (10.10.20.1) which has a static router to destination 192.168.1.0/24 with next hop 10.10.20.2.

On my PA, I have static routes and policy below:

- destination 172.16.1.0/24 next hop 10.10.20.1 (Router B) via interface e1/2

- destination 192.168.1.0/24 next hop 10.10.10.2 (Router A) via interface e1/1

- policy allow source-address ZONE-ROUTER-A source-address 172.16.1.0/24  destination-zone ZONE-ROUTER-B destination-address 192.168.1.100 with any apps and services, 

It looks like I have a routing between the 2 subnets from my PA FW.

My FW can ping 192.168.1.100 sourcing 10.10.10.1 and 172.16.1.100 sourcing 10.10.20.2.

But I cannot ping 192.168.1.100 sourcing 10.10.20.2 and 172.16.1.100 sourcing 10.10.10.1. The strange thing is I can see the pings going through from the MONITOR on my PA200 when 172.16.1.100 tries to ping 192.168.1.100. But the ping from the user says failed.

Any inputs will be greatly appreciated. Thx

Am I missing a policy? 

[reaper]

the source and destination subnet of your security policy do not match your source and destination zones

- policy allow source-address ZONE-ROUTER-A source-address 172.16.1.0/24  destination-zone ZONE-ROUTER-B destination-address 192.168.1.100 with any apps and services, 

router A hosts 192.168.1.0/24 and router B hosts 172.16.1.100

to be able to ping 192.168.1.100 from 10.10.20.2 you will need additional security policy (from zone-router-B to zone-router-A)

to be able to ping 172.16.1.100 from 10.10.10.1 you will need additonal policy/expand the existing policy as the source subnet is not accounted for in your existing policy