Palo Alto device is wrongly directing the traffic . DUAL ISP IPSEC VPN issue

[mhm_ameen]

we have two dynamic ISP in single VR with ECMP and we have setup dual IPSEC VPN tunnels towards single public IP to other paloalto . our issue that  PA wrongly forwarding traffic , ISP 2 is using MAC address of ISP1 when initiating VPN traffic to public ip address of second FW. 

Moreover check the source MAC address ! 

 show interface ethernet1/3 [ ISP1]

--------------------------------------------------------------------------------

Name: ethernet1/3, ID: 18

MAC address:

  Port MAC address 00:1b:17:00:01:12

Operation mode: layer3

Interface IP address: 172.20.2.250/24

 show interface ethernet1/2 [ ISP2]

MAC address:

  Port MAC address 00:1b:17:00:01:11

Operation mode: layer3

Interface IP address: 172.20.3.250/24

[BPry]

@mhm_ameen,

Are you forcing symmetric return? 

[mhm_ameen]

Yes enabled and also enable strict source path as well same even trying with 2 VR and PBF same issue we are in 10.1.6 which even we upgraded to from 10.1.5

[BPry]

@mhm_ameen,

Interesting. At least from my end, I would open a ticket so that TAC can review your actual configuration and confirm if something regarding routing is simply setup incorrectly, or if you're running into some undocumented bug. I'm guessing it's not a bug due to this being a regular setup, but maybe it's only present when select features are enabled or something like that. 

[Andreikin]

hello @mhm_ameen, have you got to the bottom of this? Looking at it from 10.2.x perspective I see that 'strict source path' is working fine on it - VPN traffic is tied to correct physical interfaces, but if you have path monitoring for static route you use as default for ISP1 for example and it will fail and be removed from routing table, then you might expect Palo to initiate VPN1 over different interface.