Thank you for this!! I was just about to open a ticket when I came across this post.
I have the exact situation, tried every possible NAT permutation possible and packets would still drop coming into the source-NAT'ed tunnel -- which do NOT show up in any log except the debug packet captures (and I have enabled logging on both inter and intra zone defaults).
The fix is creating that fake route back to the LAN interface in the static routes, worked immediately after adding that entry in. Really would be nice if Palo Alto's shotty 10-year old documentation on this subject (https://live.paloaltonetworks.com/docs/DOC-1594) actually worked or hinted that you need to create a dummy route back internally somewhere.
I have treid to do the same but seems the NAT rule and the security rule is not working.
Also can you please let me know that in the second NAT rule what is the translated packet? destination address translation with static IP or dynamic?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!