Not packet returned via subinterface

[Javith]

Lan2(trust zone-172.16.10.0/24)-> internal  -                switch from trunk->       (eth1/1-172.16.10.100)PAN FW(eth1/2-192.168.1.104/24)->(192.168.1.1/24) DSL modem(untrust)

Lan2(trust zone-172.16.20.0/24)->connected thro. mpls ->                                 (eth1/1.10-172.16.20.100)

My vr config: Destination:0.0.0.0/0, Interface:eth1/1, Next hop:192.168.1.1/24

my security policy: trust to untrust -any any

my Nat: source nat dynamic and port: 192.168.1.104/24

pinging from 172.16.10.0/24 to internet : allowed,nat applied and successful ping

Pinging from 172.16.20.0/24 to internet: allowed,nat applied but packet not returned to 20.0/24

[panos]

Hi,

could you please try from CLI - ssh

ping source 172.16.20.100 host 192.168.1.1

ping source 172.16.20.100 host 8.8.8.8

[Javith]

Hi,

Traffic allowed in the firewall.But return packet is failing.Routing table also looking good. I think return packet not going to sub interface(eth1/1.10-172.16.20.100).so ping failed.

[panos]

so what is the output of these 2 ping command ?